alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

stdenv, cacert: consider $NIX_SSL_CERT_FILE in hooks

Browse source 
Some SSL libs don't react to $SSL_CERT_FILE.
That actually makes sense to me, as we add this behavior
as nixpkgs-specific, so it seems "safer" to use $NIX_*.
This commit is contained in:
Vladimír Čunát 2019-05-09 08:42:07 +02:00
parent 9d3d5e98bc
commit 79bd4ad579
No known key found for this signature in database
GPG key ID: E747DF1F9575A3AA
3 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkgs/data/misc/cacert/setup-hook.sh
View file

@ -1,4 +1,6 @@
cacertHook() { cacertHook() {
export NIX_SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
# left for compatibility
export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt export SSL_CERT_FILE=@out@/etc/ssl/certs/ca-bundle.crt
} }

2
pkgs/development/interpreters/gauche/default.nix
View file

@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
"--with-iconv=${libiconv}" "--with-iconv=${libiconv}"
"--with-dbm=gdbm" "--with-dbm=gdbm"
"--with-zlib=${zlib}" "--with-zlib=${zlib}"
"--with-ca-bundle=$SSL_CERT_FILE" "--with-ca-bundle=$NIX_SSL_CERT_FILE"
# TODO: Enable slib # TODO: Enable slib
# Current slib in nixpkgs is specialized to Guile # Current slib in nixpkgs is specialized to Guile
# "--with-slib=${slibGuile}/lib/slib" # "--with-slib=${slibGuile}/lib/slib"

7
pkgs/stdenv/generic/setup.sh
View file

@ -646,9 +646,12 @@ fi
export NIX_BUILD_CORES export NIX_BUILD_CORES
# Prevent OpenSSL-based applications from using certificates in # Prevent SSL libraries from using certificates in /etc/ssl, unless set explicitly.
# /etc/ssl.
# Leave it in shells for convenience. # Leave it in shells for convenience.
if [ -z "${NIX_SSL_CERT_FILE:-}" ] && [ -z "${IN_NIX_SHELL:-}" ]; then
export NIX_SSL_CERT_FILE=/no-cert-file.crt
fi
# Another variant left for compatibility.
if [ -z "${SSL_CERT_FILE:-}" ] && [ -z "${IN_NIX_SHELL:-}" ]; then if [ -z "${SSL_CERT_FILE:-}" ] && [ -z "${IN_NIX_SHELL:-}" ]; then
export SSL_CERT_FILE=/no-cert-file.crt export SSL_CERT_FILE=/no-cert-file.crt
fi fi