nixos/security/ca: enable support for compatibility bundles #286857
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
RaitoBezarius
requested review from
ajs124,
lukegb and
mweinelt
as code owners
github-actions
bot
added
6.topic: nixos
https://github.com/lukegb/buildcatrust/releases/tag/v0.2.0 https://github.com/lukegb/buildcatrust/releases/tag/v0.2.1 It contains support for exporting the bundle without additional trust rules. Signed-off-by: Raito Bezarius <[email protected]>
RaitoBezarius
force-pushed
the
cacerts
branch
from
6d58605
to
955291c
Compare
|
I will retarget staging. |
lukegb
reviewed
Feb 11, 2024
lukegb
approved these changes
Feb 11, 2024
RaitoBezarius
force-pushed
the
cacerts
branch
from
955291c
to
2f1d3e7
Compare
|
You missed a reference to |
Certain software stacks have no support for OpenSSL non-standard PEM format and will fail to use our NixOS CA bundle. For this, it is necessary to fallback on a 'compatibility' bundle which will contain no additional trust rules. Signed-off-by: Raito Bezarius <[email protected]>
RaitoBezarius
force-pushed
the
cacerts
branch
from
2f1d3e7
to
19159a2
Compare
"I had one job" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
Certain software stacks have no support for OpenSSL non-standard PEM format and will fail to use our NixOS CA bundle.
For this, it is necessary to fallback on a 'compatibility' bundle, which will contain no additional trust rules.
Open questions:
cacertpackage level to save on space?Depends on lukegb/buildcatrust#4.Depends on stable release of buildcatrust.Closes #286722.
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.