Katherine,
(...sorry for the sloooooow response...)
Katherine Cox-Buday <address@hidden> writes:
> I was receiving X.509 certificate errors when attempting to run `guix
> download`. After investigating, I found that it was because my
> `SSL_CERT_DIR` environmental variable had two paths separated by a
> colon. The two paths were actually the same. After removing the second
> path, `guix download` began working again.
>
> Wondering how the duplicate paths came to be, I discovered that
> `${GUIX_PROFILE}/etc/profile` had two exports defined for
> `SSL_CERT_DIR`. I discovered this was because I had both openssl and
> libressl installed (if memory serves, I needed openssl for some
> development task that relied on an idiosyncrasy of openssl). Removing
> openssl removed the duplicate entry.
The duplicate exports was because the search path specifications of
OpenSSL and LibreSSL have slightly different "signatures": the former
has a "singly entry" search path, whereas LibreSSLs native-search-paths
have a TODO comment suggesting that they too should be single-entry.
I've fixed it by resolving the TODO: now including both packages in the
same profile will point SSL_CERT_DIR to the profile union.
> I think there may be two bugs:
>
> 1. `guix download` needs to respect colon-separated paths.
Adding support for multiple SSL_CERT_DIR paths could be useful, but I
think the real problem was that LibreSSL and OpenSSL caused inconsistent
entries. Thus, I'm closing this issue, but feel free to reopen if you
disagree. :-)
> 2. The profile mechanics in Guix should probably have some way to check
> if they're redefining the same thing before placing things in
> `etc/profile`.
Let's open a separate bug report for this if it turns out to be a
recurring problem.
> Thank you to everyone for all of your hard work, and for Guix.
Thank you for the report, and the kind words! :-)
Fixed in 04cfe91efd41a89d7d01d2cd7b736213059dde5a.
signature.asc
Description: PGP signature
--- End Message ---