Hi, alctra <[email protected]> writes:
> Hello, > > Maxim Cournoyer <[email protected]> writes: > > [...] > >> I think in light of this it'd be reasonable reverting to the >> certdata2pem.py Python script or something equivalent that would >> generate the .p11-kit files that seem to be valuable (I wasn't aware of >> these). >> >> A patch would be welcome (it would need to target a world-rebuild >> branch). > > I've written a guile script that can parse NSS's certdata.txt and create > both the certs folder with the pems as well as the p11-kit trust > file. Any opinions on what I should do with it? The script is ~380LOC > (~290LOC w/o docstrings and comments) so I think it's too large to merge > into nss.scm yet too small to warrant a standalone package (i.e. what > NixOS do with their solution). Ideally, it would be some helper module > which would reside somewhere in the codebase, but I aren't familiar > enough with it to know where. That sounds nice. I think it could go either way, with my personal preference going toward packaging it as its own Guile library, which is less difficult that in may look like to bootstrap when using a tool like `hall` and would make it more generally useful to others. Otherwise 'guix' has amassed some amount of modules directly under the (guix ...) namespace, examples that come to my mind: (guix rpm), (guix pki), etc. >> An area we could improve would also be documenting how to use p11-kit in >> Guix, e.g. to add extra user certificates or disallow a single or all >> the default ones. > > First, we need the .p11-kit file so libnssckbi can be replaced with > p11-kit-trust in NSS users as other distros have done. Then it should be > possible to modify /etc/ssl/certs and have that reflected in programs > like Librewolf or Icecat without breaking their extensions. > > Once that's dealt with, the certificate store could be configured as > part of the operating-system record? > > But generally I agree, modifications to the certificate store are not > uncommon and should be easy to perform. I've had to create a custom > nss-certs package, custom Librewolf package and disable its built-in > certs check in about:config; just to add one custom CA. The direction/plan you've outlined sounds good to me. Thanks for your efforts in improving Guix! -- Maxim
