alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

Configure a default trust store for openssl

Browse source
This commit is contained in:
Guillaume Maudoux 2016-02-01 10:18:31 +01:00 committed by Eelco Dolstra
parent 0876a44169
commit 9f358f809d
19 changed files with 16 additions and 91 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/modules/installer/tools/auto-upgrade.nix
View file

@ -74,7 +74,7 @@ let cfg = config.system.autoUpgrade; in
serviceConfig.Type = "oneshot";
environment = config.nix.envVars //
{ inherit (config.environment.sessionVariables) NIX_PATH SSL_CERT_FILE;
{ inherit (config.environment.sessionVariables) NIX_PATH;
HOME = "/root";
};

1
nixos/modules/programs/venus.nix
View file

@ -165,7 +165,6 @@ in
script = "exec venus-planet ${configFile}";
serviceConfig.User = "${cfg.user}";
serviceConfig.Group = "${cfg.group}";
environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
startAt = cfg.dates;
};

6
nixos/modules/security/ca.nix
View file

@ -64,12 +64,6 @@ in
# CentOS/Fedora compatibility.
environment.etc."pki/tls/certs/ca-bundle.crt".source = caCertificates;
environment.sessionVariables =
{ SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
# FIXME: unneeded - remove eventually.
GIT_SSL_CAINFO = "/etc/ssl/certs/ca-certificates.crt";
};
};
}

17
nixos/modules/services/continuous-integration/jenkins/default.nix
View file

@ -92,11 +92,12 @@ in {
type = with types; attrsOf str;
description = ''
Additional environment variables to be passed to the jenkins process.
As a base environment, jenkins receives NIX_PATH, SSL_CERT_FILE and
GIT_SSL_CAINFO from <option>environment.sessionVariables</option>,
NIX_REMOTE is set to "daemon" and JENKINS_HOME is set to
the value of <option>services.jenkins.home</option>. This option has
precedence and can be used to override those mentioned variables.
As a base environment, jenkins receives NIX_PATH from
<option>environment.sessionVariables</option>, NIX_REMOTE is set to
"daemon" and JENKINS_HOME is set to the value of
<option>services.jenkins.home</option>.
This option has precedence and can be used to override those
mentioned variables.
'';
};
@ -136,11 +137,7 @@ in {
environment =
let
selectedSessionVars =
lib.filterAttrs (n: v: builtins.elem n
[ "NIX_PATH"
"SSL_CERT_FILE"
"GIT_SSL_CAINFO"
])
lib.filterAttrs (n: v: builtins.elem n [ "NIX_PATH" ])
config.environment.sessionVariables;
in
selectedSessionVars //

1
nixos/modules/services/monitoring/dd-agent.nix
View file

@ -183,7 +183,6 @@ in {
Restart = "always";
RestartSec = 2;
};
environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
restartTriggers = [ pkgs.dd-agent ddConf diskConfig networkConfig postgresqlConfig nginxConfig mongoConfig ];
};

1
nixos/modules/services/networking/ddclient.nix
View file

@ -127,7 +127,6 @@ in
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
environment.SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
serviceConfig = {
# Uncomment this if too many problems occur:
# Type = "forking";

6
nixos/modules/virtualisation/azure-agent.nix
View file

@ -156,12 +156,6 @@ in
after = [ "ip-up.target" ];
wants = [ "ip-up.target" ];
environment = {
GIT_SSL_CAINFO = "/etc/ssl/certs/ca-certificates.crt";
OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
SSL_CERT_FILE = "/etc/ssl/certs/ca-certificates.crt";
};
path = [ pkgs.e2fsprogs ];
description = "Windows Azure Agent Service";
unitConfig.ConditionPathExists = "/etc/waagent.conf";

1
pkgs/applications/networking/cluster/panamax/api/default.nix
View file

@ -62,7 +62,6 @@ stdenv.mkDerivation rec {
--prefix "PATH" : "$out/share/panamax-api/bin:${env.ruby}/bin:$PATH" \
--prefix "HOME" : "$out/share/panamax-api" \
--prefix "GEM_HOME" : "${env}/${env.ruby.gemPath}" \
--prefix "SSL_CERT_FILE" : /etc/ssl/certs/ca-certificates.crt \
--prefix "GEM_PATH" : "$out/share/panamax-api:${bundler}/${env.ruby.gemPath}"
'';

6
pkgs/applications/networking/instant-messengers/tkabber/default.nix
View file

@ -40,11 +40,7 @@ let
} // removeAttrs attrs [ "name" "sha256" ]);
in mkTkabber (main // {
postPatch = ''
substituteInPlace login.tcl --replace \
"custom::defvar loginconf(sslcacertstore) \"\"" \
"custom::defvar loginconf(sslcacertstore) \$env(SSL_CERT_FILE)"
'' + optionalString (theme != null) ''
postPatch = optionalString (theme != null) ''
themePath="$out/share/doc/tkabber/examples/xrdb/${theme}.xrdb"
sed -i '/^if.*load_default_xrdb/,/^}$/ {
s@option readfile \(\[fullpath [^]]*\]\)@option readfile "'"$themePath"'"@

12
pkgs/applications/version-management/git-and-tools/git/cert-path.patch
View file

@ -1,12 +0,0 @@
diff -ru -x '*~' git-1.9.2-orig/git-send-email.perl git-1.9.2/git-send-email.perl
--- git-1.9.2-orig/git-send-email.perl 2014-04-09 21:09:34.000000000 +0200
+++ git-1.9.2/git-send-email.perl 2014-04-16 18:35:05.861132282 +0200
@@ -1094,6 +1094,8 @@
return;
}
+ $smtp_ssl_cert_path //= $ENV{'SSL_CERT_FILE'};
+
if (!defined $smtp_ssl_cert_path) {
# use the OpenSSL defaults
return (SSL_verify_mode => SSL_VERIFY_PEER());

2
pkgs/applications/version-management/git-and-tools/git/default.nix
View file

@ -24,8 +24,6 @@ stdenv.mkDerivation {
patches = [
./docbook2texi.patch
./symlinks-in-bin.patch
./cert-path.patch
./ssl-cert-file.patch
];
buildInputs = [curl openssl zlib expat gettext cpio makeWrapper libiconv]

13
pkgs/applications/version-management/git-and-tools/git/ssl-cert-file.patch
View file

@ -1,13 +0,0 @@
This patch adds support for the OpenSSL SSL_CERT_FILE environment variable.
GIT_SSL_CAINFO still takes precedence.
--- git-orig/http.c.orig 2014-11-25 23:27:56.000000000 +0100
+++ git-orig/http.c 2014-11-25 23:28:48.000000000 +0100
@@ -433,6 +433,7 @@
#if LIBCURL_VERSION_NUM >= 0x070908
set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
#endif
+ set_from_env(&ssl_cainfo, "SSL_CERT_FILE");
set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
set_from_env(&user_agent, "GIT_HTTP_USER_AGENT");

2
pkgs/build-support/rust/fetchcargo.nix
View file

@ -16,8 +16,6 @@ stdenv.mkDerivation {
outputHashMode = "recursive";
outputHash = sha256;
SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
impureEnvVars = [ "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy" ];
preferLocalBuild = true;
}

1
pkgs/development/libraries/gnutls/generic.nix
View file

@ -16,7 +16,6 @@ stdenv.mkDerivation {
outputs = [ "out" "man" ];
configureFlags =
# FIXME: perhaps use $SSL_CERT_FILE instead
lib.optional stdenv.isLinux "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt"
++ [
"--disable-dependency-tracking"

6
pkgs/development/libraries/openssl/default.nix
View file

@ -1,5 +1,6 @@
{ stdenv, fetchurl, perl
, withCryptodev ? false, cryptodevHeaders }:
, withCryptodev ? false, cryptodevHeaders
, defaultCertificate ? "/etc/ssl/certs/ca-certificates.crt" }:
with stdenv.lib;
let
@ -58,6 +59,9 @@ stdenv.mkDerivation rec {
# remove dependency on Perl at runtime
rm -r $out/etc/ssl/misc $out/bin/c_rehash
# configure the default trust store
${optionalString (defaultCertificate != null) "ln -s ${defaultCertificate} $out/etc/ssl/cert.pem"}
'';
postFixup = ''

17
pkgs/development/perl-modules/lwp-protocol-https-cert-file.patch
View file

@ -1,17 +0,0 @@
Use $SSL_CERT_FILE to get the CA certificates.
diff -ru -x '*~' LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm LWP-Protocol-https-6.02/lib/LWP/Protocol/https.pm
--- LWP-Protocol-https-6.02-orig/lib/LWP/Protocol/https.pm 2011-03-27 13:54:01.000000000 +0200
+++ LWP-Protocol-https-6.02/lib/LWP/Protocol/https.pm 2011-10-07 13:23:41.398628375 +0200
@@ -21,6 +21,11 @@
}
if ($ssl_opts{SSL_verify_mode}) {
unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
+ if (defined $ENV{'SSL_CERT_FILE'}) {
+ $ssl_opts{SSL_ca_file} = $ENV{'SSL_CERT_FILE'};
+ }
+ }
+ unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
eval {
require Mozilla::CA;
};

6
pkgs/tools/networking/curl/7.15.nix
View file

@ -33,12 +33,8 @@ stdenv.mkDerivation rec {
sed -e 's|/usr/bin|/no-such-path|g' -i.bak configure
'';
# make curl honor CURL_CA_BUNDLE & SSL_CERT_FILE
postConfigure = ''
echo '#define CURL_CA_BUNDLE (getenv("CURL_CA_BUNDLE") || getenv("SSL_CERT_FILE"))' >> lib/curl_config.h
'';
configureFlags = [
"--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
( if sslSupport then "--with-ssl=${openssl}" else "--without-ssl" )
( if scpSupport then "--with-libssh2=${libssh2}" else "--without-libssh2" )
]

6
pkgs/tools/networking/curl/default.nix
View file

@ -44,12 +44,8 @@ stdenv.mkDerivation rec {
rm src/tool_hugehelp.c
'';
# make curl honor CURL_CA_BUNDLE & SSL_CERT_FILE
postConfigure = ''
echo '#define CURL_CA_BUNDLE (getenv("CURL_CA_BUNDLE") ? getenv("CURL_CA_BUNDLE") : getenv("SSL_CERT_FILE"))' >> lib/curl_config.h
'';
configureFlags = [
"--with-ca-bundle=/etc/ssl/certs/ca-certificates.crt"
"--disable-manual"
"--with-nghttp2=${libnghttp2}"
( if sslSupport then "--with-ssl=${openssl}" else "--without-ssl" )

1
pkgs/top-level/perl-packages.nix
View file

@ -6934,7 +6934,6 @@ let self = _self // overrides; _self = with self; {
url = mirror://cpan/authors/id/G/GA/GAAS/LWP-Protocol-https-6.04.tar.gz;
sha256 = "0agnga5dg94222h6rlzqxa0dri2sh3gayncvfb7jad9nxr87gxhy";
};
patches = [ ../development/perl-modules/lwp-protocol-https-cert-file.patch ];
propagatedBuildInputs = [ LWP IOSocketSSL ];
doCheck = false; # tries to connect to https://www.apache.org/.
meta = {