GNU bug report logs -
#24466
`guix download` accepts expired TLS certificates
Previous Next
Reported by: Leo Famulari <leo <at> famulari.name>
Date: Mon, 19 Sep 2016 01:16:02 UTC
Severity: normal
Done: ludo <at> gnu.org (Ludovic Courtès)
Bug is archived. No further changes may be made.
To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 24466 in the body.
You can then email your comments to 24466 AT debbugs.gnu.org in the normal way.
Toggle the display of automated, internal messages from the tracker.
Report forwarded
to
bug-guix <at> gnu.org
:
bug#24466
; Package
guix
.
(Mon, 19 Sep 2016 01:16:02 GMT)
Full text and
rfc822 format available.
Acknowledgement sent
to
Leo Famulari <leo <at> famulari.name>
:
New bug report received and forwarded. Copy sent to
bug-guix <at> gnu.org
.
(Mon, 19 Sep 2016 01:16:02 GMT)
Full text and
rfc822 format available.
Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):
[Message part 1 (text/plain, inline)]
While testing Nicolas's patch "Update giac-xcas", I found that `guix
download` accepts expired TLS certificates.
I tried visiting the upstream site in order to verify the hash of the
updated package, and my browsers (Firefox and Chromium) warned me that
the site's certificate had expired ~1 day ago.
However, `guix build -S` did not warn me or prevent me from downloading
the source code.
Perhaps it doesn't matter for the case of `guix build -S`, since we
already know what we expect to download. But, for `guix download`, this
is a bug.
[0]
http://lists.gnu.org/archive/html/guix-devel/2016-09/msg01460.html
[signature.asc (application/pgp-signature, inline)]
Reply sent
to
ludo <at> gnu.org (Ludovic Courtès)
:
You have taken responsibility.
(Mon, 07 Nov 2016 22:46:02 GMT)
Full text and
rfc822 format available.
Notification sent
to
Leo Famulari <leo <at> famulari.name>
:
bug acknowledged by developer.
(Mon, 07 Nov 2016 22:46:02 GMT)
Full text and
rfc822 format available.
Message #10 received at 24466-done <at> debbugs.gnu.org (full text, mbox):
Leo Famulari <leo <at> famulari.name> skribis:
> While testing Nicolas's patch "Update giac-xcas", I found that `guix
> download` accepts expired TLS certificates.
>
> I tried visiting the upstream site in order to verify the hash of the
> updated package, and my browsers (Firefox and Chromium) warned me that
> the site's certificate had expired ~1 day ago.
>
> However, `guix build -S` did not warn me or prevent me from downloading
> the source code.
>
> Perhaps it doesn't matter for the case of `guix build -S`, since we
> already know what we expect to download. But, for `guix download`, this
> is a bug.
This is fixed by commit bc3c41ce36349ed4ec758c70b48a7059e363043a.
Now ‘guix download’ shows a message like this upon failure:
--8<---------------cut here---------------start------------->8---
$ SSL_CERT_DIR=/nowhere ./pre-inst-env guix download https://mirror.guixsd.org/index.html
Starting download of /tmp/guix-file.jT2WjA
From https://mirror.guixsd.org/index.html...
ERROR: X.509 certificate of 'mirror.guixsd.org' could not be verified:
signer-not-found
invalid
failed to download "/tmp/guix-file.jT2WjA" from "https://mirror.guixsd.org/index.html"
--8<---------------cut here---------------end--------------->8---
The message is not optimal, but it convey the message that something is
wrong.
For fixed-output derivations (‘guix build -S’, etc.), the behavior is
unchanged: server certificates are happily ignored. This is IMO the
right thing because (1) we know the hash of the expected content, which
is the only authentication method that matters, and (2) checking
certificates would require having fixed-output derivations depend on
‘nss’.
Thanks,
Ludo’.
bug archived.
Request was from
Debbugs Internal Request <help-debbugs <at> gnu.org>
to
internal_control <at> debbugs.gnu.org
.
(Tue, 06 Dec 2016 12:24:04 GMT)
Full text and
rfc822 format available.
This bug report was last modified 7 years and 142 days ago.
Previous Next
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.