Hello, Maxim Cournoyer <[email protected]> writes:
[...] > I think in light of this it'd be reasonable reverting to the > certdata2pem.py Python script or something equivalent that would > generate the .p11-kit files that seem to be valuable (I wasn't aware of > these). > > A patch would be welcome (it would need to target a world-rebuild > branch). I've written a guile script that can parse NSS's certdata.txt and create both the certs folder with the pems as well as the p11-kit trust file. Any opinions on what I should do with it? The script is ~380LOC (~290LOC w/o docstrings and comments) so I think it's too large to merge into nss.scm yet too small to warrant a standalone package (i.e. what NixOS do with their solution). Ideally, it would be some helper module which would reside somewhere in the codebase, but I aren't familiar enough with it to know where. > An area we could improve would also be documenting how to use p11-kit in > Guix, e.g. to add extra user certificates or disallow a single or all > the default ones. First, we need the .p11-kit file so libnssckbi can be replaced with p11-kit-trust in NSS users as other distros have done. Then it should be possible to modify /etc/ssl/certs and have that reflected in programs like Librewolf or Icecat without breaking their extensions. Once that's dealt with, the certificate store could be configured as part of the operating-system record? But generally I agree, modifications to the certificate store are not uncommon and should be easy to perform. I've had to create a custom nss-certs package, custom Librewolf package and disable its built-in certs check in about:config; just to add one custom CA. Alex
