guix-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH] gnu: r-curl: Respect CURL_CA_BUNDLE variable.


From: Ricardo Wurmus
Subject: Re: [PATCH] gnu: r-curl: Respect CURL_CA_BUNDLE variable.
Date: Sat, 24 Sep 2016 09:46:08 +0200
User-agent: mu4e 0.9.16; emacs 25.1.1

Leo Famulari <address@hidden> writes:

> On Wed, Sep 21, 2016 at 09:24:10PM +0200, Ricardo Wurmus wrote:
>> Leo Famulari <address@hidden> writes:
>> 
>> > On Tue, Sep 13, 2016 at 11:53:33PM +0200, Roel Janssen wrote:
>> >> This patch was essential to me being able to interact with HTTPS urls in
>> >> R.  As far as I understand, by default, R only looks for CURL_CA_BUNDLE
>> >> on Windows, but with this patch it looks for CURL_CA_BUNDLE on GNU/Linux
>> >> as well.  Is this correct?
>> >> 
>> >> I can confirm it works for me, so I'd like to see this patch pushed.
>> >
>> > It's good to hear that it works, but I still think we should run it by
>> > the upstream maintainers. We are activating C code that they
>> > specifically decided not to use on GNU / Linux. Why did they do that?
>> 
>> The comments in the code indicate that on Windows they try to load the
>> certs bundle that comes with R for Windows, i.e. in the R HOME’s “etc”
>> directory.  There is no such file on GNU, so no special handling is
>> needed.
>> 
>> On GNU this is taken care of by libcurl.  It comes with a default path
>> to the certs bundle, which can be overridden with configure flags
>> (“--with-ca-bundle” or “--with-ca-path”).  In our Guix package we don’t
>> do this (yet?), so by default SSL cert validation is broken.
>> 
>> libcurl does not respect CURL_CA_BUNDLE; it assumes that the application
>> will override the CA bundle path if it needs a special path, otherwise
>> it assumes that the default path is fine (using Guix this is not the
>> case).
>> 
>> The maintainers of the R curl package made the special case for Windows
>> because it is not needed on GNU systems following the FHS.  The best fix
>> here would be to patch libcurl such that it checks the CURL_CA_BUNDLE
>> environment variable invariably, just like the curl command line tool
>> does.  Until this is done I think we should path packages such as
>> r-curl to make them usable.  Once we have agreed on a fix to libcurl we
>> can remove all patches to individual packages using libcurl.
>
> That makes sense. Thank you for taking the time to explain.

Sure!  Pushed to master as 8f309571d3847d4bca331061e881fa01d9badb77.

~~ Ricardo




reply via email to

[Prev in Thread] Current Thread [Next in Thread]