bug#28948: feh does encounter certificate errors with valid certificates

[Marius Bakke]

ng0 <address@hidden> writes:

> feh https://i.imgur.com/263enxT.jpg
> feh opens image
>
> Problem:
> address@hidden ~/src/guix/guix$ feh https://i.imgur.com/263enxT.jpg
> feh WARNING: open url: server certificate verification failed. CAfile: none 
> CRLfile: none
> feh WARNING: https://i.imgur.com/263enxT.jpg - File does not exist
> feh: No loadable images specified.
> See 'man feh' for detailed usage information
>
> nss etc are in my profile, no problem with other curl based applications.

The attached patch should fix the problem.  Can you try it?

From cadea693c636affd0d4cc5749eb88b5408aac07f Mon Sep 17 00:00:00 2001
From: Marius Bakke <address@hidden>
Date: Mon, 30 Oct 2017 00:18:03 +0100
Subject: [PATCH] gnu: feh: Respect $CURL_CA_BUNDLE.

* gnu/packages/patches/feh-respect-CURL_CA_BUNDLE.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
* gnu/packages/image-viewers.scm (feh)[source]: Use it.
[native-search-paths]: New field.
---
 gnu/local.mk                                          |  1 +
 gnu/packages/image-viewers.scm                        |  8 ++++++++
 gnu/packages/patches/feh-respect-CURL_CA_BUNDLE.patch | 18 ++++++++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 gnu/packages/patches/feh-respect-CURL_CA_BUNDLE.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 90dc7aec1..7a74501aa 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -616,6 +616,7 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/fasthenry-spFactor.patch                        \
   %D%/packages/patches/fcgi-2.4.0-gcc44-fixes.patch            \
   %D%/packages/patches/fcgi-2.4.0-poll.patch                   \
+  %D%/packages/patches/feh-respect-CURL_CA_BUNDLE.patch                \
   %D%/packages/patches/file-CVE-2017-1000249.patch             \
   %D%/packages/patches/findutils-localstatedir.patch           \
   %D%/packages/patches/findutils-gnulib-multi-core.patch       \
diff --git a/gnu/packages/image-viewers.scm b/gnu/packages/image-viewers.scm
index 9e93a97a9..98193063e 100644
--- a/gnu/packages/image-viewers.scm
+++ b/gnu/packages/image-viewers.scm
@@ -61,6 +61,7 @@
               (method url-fetch)
               (uri (string-append home-page
                                   name "-" version ".tar.bz2"))
+              (patches (search-patches "feh-respect-CURL_CA_BUNDLE.patch"))
               (sha256
                (base32
                 "0azgpr4al2pi4858z4xh4lfz84cvzxw3n426fn7rz6cdj34q212j"))))
@@ -79,6 +80,13 @@
               ("libxt" ,libxt)
               ("libx11" ,libx11)
               ("libxinerama" ,libxinerama)))
+    (native-search-paths
+    ;; Respect the same options as the `curl` command-line client.
+    (list (search-path-specification
+           (variable "CURL_CA_BUNDLE")
+           (file-type 'regular)
+           (separator #f)                         ;single entry
+           (files '("etc/ssl/certs/ca-certificates.crt")))))
     (synopsis "Fast and light imlib2-based image viewer")
     (description
       "feh is an X11 image viewer aimed mostly at console users.
diff --git a/gnu/packages/patches/feh-respect-CURL_CA_BUNDLE.patch 
b/gnu/packages/patches/feh-respect-CURL_CA_BUNDLE.patch
new file mode 100644
index 000000000..cbe2fa16d
--- /dev/null
+++ b/gnu/packages/patches/feh-respect-CURL_CA_BUNDLE.patch
@@ -0,0 +1,18 @@
+Make feh respect CURL_CA_BUNDLE similar to the `curl` tool.
+
+diff --git a/src/imlib.c b/src/imlib.c
+index dfb79aa..82a9865 100644
+--- a/src/imlib.c
++++ b/src/imlib.c
+@@ -429,6 +429,10 @@ static char *feh_http_load_image(char *url)
+                       if (opt.insecure_ssl) {
+                               curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 
0);
+                               curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 
0);
++                      } else {
++                              // Allow the user to specify custom CA 
certificates.
++                              curl_easy_setopt(curl, CURLOPT_CAINFO,
++                                              getenv("CURL_CA_BUNDLE"));
+                       }
+ 
+                       res = curl_easy_perform(curl);
+
-- 
2.14.3

signature.asc
Description: PGP signature