Andreas Enge <andr...@enge.fr> writes:
> On Mon, Feb 02, 2015 at 06:11:02PM -0500, Mark H Weaver wrote:
>> +
>> "--with-default-trust-store-file=/etc/ssl/certs/ca-certificates.crt")))
>
> I would suggest to use --with-default-trust-store-dir=/etc/ssl/certs instead.
> The option is available in gnutls-3.3.12, which I am building in the
> wip-gnutls branch right now, and which looks good to push.
>
> This would allow us to provide not only a single file, but to potentially
> merge different trust stores. We could also, for instance, prepare a package
> per certification authority, so that the user could install exactly the
> ones he trusts.
Sounds good to me! Thanks :)
Since GnuTLS updates require so much rebuilding, I would prefer to wait
for Hydra to finish the rebuild of intel platforms on another branch
before merging into master.
> PS: Ideally, I still think it would be optimal if gnutls used a per user
> environment variable, in the spirit of liberating users and not
> system administrators. I will enquire. But for the time being, the
> global specification looks better than nothing.
I agree it would be good if upstream supported such a variable, so
please do propose it to them! I think it has to be done upstream
because of the potential security implications of setuid programs, as I
mentioned in the thread a year ago.
> When I have some time,
> I will try to look into how to package certificates of certification
> authorities. Putting individual certificates into /etc/ssl/certs
> (and running c_rehash before installation) should make them usable
> by gnutls and openssl alike.
I've been looking into this as well, but will address it in another
message.
Thanks!
Mark
