Re: Certificates in pure and containerized environments

[zimoun]

Hi Konrad and Wiktór,

On Sun, 03 Oct 2021 at 18:45, Wiktor Żelazny <wz@freeshell.de> wrote:
> On Thu, Sep 30, 2021 at 12:08:53PM +0200, Konrad Hinsen wrote:
>
>>    guix environment --pure \
>>            --ad-hoc python nss-certs -- \
>>            python3 -c 'import urllib.request; 
>> print(urllib.request.urlopen("http://wwwbis.sidc.be/DATA/uset/Wlight/2003/11/UPH20031109112104.FTS";))'
>>
>> but this doesn't work - same error as initially.

Yeah for some reasom SSL_CERT_DIR is not exported…

> For some reason, it works for me with
>
>    --ad-hoc python nss-certs guix -- \

…but exported here.

--8<---------------cut here---------------start------------->8---
$ guix environment --ad-hoc python nss-certs
$ cat $GUIX_ENVIRONMENT/etc/profile
# Source this file to define all the relevant environment variables in Bash
# for this profile.  You may want to define the 'GUIX_PROFILE' environment
# variable to point to the "visible" name of the profile, like this:
#
#  GUIX_PROFILE=/path/to/profile ; \
#  source /path/to/profile/etc/profile
#
# When GUIX_PROFILE is undefined, the various environment variables refer
# to this specific profile generation.

export 
PATH="${GUIX_PROFILE:-/gnu/store/bp1xirq9p5cw36nkgi1131knhmhdzcvf-profile}/bin${PATH:+:}$PATH"
export 
PYTHONPATH="${GUIX_PROFILE:-/gnu/store/bp1xirq9p5cw36nkgi1131knhmhdzcvf-profile}/lib/python3.8/site-packages${PYTHONPATH:+:}$PYTHONPATH"
--8<---------------cut here---------------end--------------->8---

If any package depending on nss-certs is added, then it works, I guess.
For instance, a package totally unrelated, say r-reqon:

--8<---------------cut here---------------start------------->8---
$ guix environment --ad-hoc python nss-certs r-reqon
$ cat $GUIX_ENVIRONMENT/etc/profile
# Source this file to define all the relevant environment variables in Bash
# for this profile.  You may want to define the 'GUIX_PROFILE' environment
# variable to point to the "visible" name of the profile, like this:
#
#  GUIX_PROFILE=/path/to/profile ; \
#  source /path/to/profile/etc/profile
#
# When GUIX_PROFILE is undefined, the various environment variables refer
# to this specific profile generation.

export 
PATH="${GUIX_PROFILE:-/gnu/store/mj821vsw16c8krqm2c4syg2mdfzqy3j0-profile}/bin${PATH:+:}$PATH"
export 
CURL_CA_BUNDLE="${GUIX_PROFILE:-/gnu/store/mj821vsw16c8krqm2c4syg2mdfzqy3j0-profile}/etc/ssl/certs/ca-certificates.crt"
export 
SSL_CERT_FILE="${GUIX_PROFILE:-/gnu/store/mj821vsw16c8krqm2c4syg2mdfzqy3j0-profile}/etc/ssl/certs/ca-certificates.crt"
export 
SSL_CERT_DIR="${GUIX_PROFILE:-/gnu/store/mj821vsw16c8krqm2c4syg2mdfzqy3j0-profile}/etc/ssl/certs"
export 
PYTHONPATH="${GUIX_PROFILE:-/gnu/store/mj821vsw16c8krqm2c4syg2mdfzqy3j0-profile}/lib/python3.8/site-packages${PYTHONPATH:+:}$PYTHONPATH"
--8<---------------cut here---------------end--------------->8---


Hope that helps,
simon