url library and GnuTLS, and Emacs-issued certificates (was: expand tls to elpa.gnu.org)

[Ted Zlatanov]

On Mon, 21 Mar 2011 17:17:20 -0400 Chong Yidong <address@hidden> wrote: 

CY> Ted Zlatanov <address@hidden> writes:
aj> so far there is no tls/ssl support for elpa.gnu.org . In my opinion
aj> this is a real problem as there is no way to check the authenticity
aj> and integrity of downloaded packages. Is it possible to expand the
aj> certificate of gnu.org to elpa.gnu.org?
aj> Of course this makes the package-manager not checking integrity -
aj> but I think anyone interested in doing so can modify it without
aj> problems.
>> 
>> I can install a certificate but it has to be requested by the domain
>> owner so I'm not sure who to bug about it.

CY> Why not simply distribute the certificate file with Emacs?

I assumed we'd want https://elpa.gnu.org/packages/ to look reasonable in
a web browser.

In any case, I think it's a good idea to set up an Emacs Certificate
Authority (CA) so we can create certificates that Emacs will trust.  We
just need to ship the CA's certificate with Emacs then, not every
certificate it has signed.  We can then make a .p12 file that browser
users can import to trust Emacs-signed certificates.

It may make sense, though, to make this CA a facility for the whole GNU
project and then the Emacs CA can be an intermediate CA hanging off that
root CA.  That should be decided before we start pushing out
certificates, please, so we don't have to invalidate them later.

CY> Also, the Emacs package manager uses the url library for downloading via
CY> http.  How well does that library support https?  If I give
CY> `url-retrieve-synchronously' a https url, does it currently DTRT?

It's insecure currently and won't work on all platforms.  It uses tls.el
(see `url-https-create-secure-wrapper') which in turn relies on the
gnutls-cli or openssl binaries to be installed and usable, calling
gnutls-cli by default with --insecure (though the user can manually
adjust that, see `tls-checktrust').  We need the GnuTLS support at the C
level to make the url library secure through gnutls.el.  

I need to look at Claudio Bley's patch that was posted on emacs-devel 2
days ago and figure out what's wrong with hostname verification against
the certificate.  Once that's done we can promote gnutls.el+gnutls.c to
"need testing" and make them the default for the url library, Gnus, etc.

If anyone wants to help with any part of this process, please let me
know.  I'm slow, especially at the C level, so Claudio's help was very
welcome.

Thanks
Ted