Re: [PATCH] gnu: gnutls: Configure location of system-wide trust store

[Mark H Weaver]

Andreas Enge <address@hidden> writes:

> On Mon, Feb 02, 2015 at 06:11:02PM -0500, Mark H Weaver wrote:
>> +             
>> "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt")))
>
> I would suggest to use --with-default-trust-store-dir=/etc/ssl/certs instead.
> The option is available in gnutls-3.3.12, which I am building in the
> wip-gnutls branch right now, and which looks good to push.
>
> This would allow us to provide not only a single file, but to potentially
> merge different trust stores. We could also, for instance, prepare a package
> per certification authority, so that the user could install exactly the
> ones he trusts.

Sounds good to me!  Thanks :)

Since GnuTLS updates require so much rebuilding, I would prefer to wait
for Hydra to finish the rebuild of intel platforms on another branch
before merging into master.

> PS: Ideally, I still think it would be optimal if gnutls used a per user
>     environment variable, in the spirit of liberating users and not
>     system administrators. I will enquire. But for the time being, the
>     global specification looks better than nothing.

I agree it would be good if upstream supported such a variable, so
please do propose it to them!  I think it has to be done upstream
because of the potential security implications of setuid programs, as I
mentioned in the thread a year ago.

>     When I have some time,
>     I will try to look into how to package certificates of certification
>     authorities. Putting individual certificates into /etc/ssl/certs
>     (and running c_rehash before installation) should make them usable
>     by gnutls and openssl alike.

I've been looking into this as well, but will address it in another
message.

     Thanks!
       Mark