nixpkgs/nixos/modules/security/ca.nix

{ config, lib, pkgs, ... }:

with lib;

{

  config = {

    environment.etc =
      [ { source = "${pkgs.cacert}/etc/ca-bundle.crt";
          target = "ssl/certs/ca-bundle.crt";
        }
      ];

    environment.sessionVariables =
      { SSL_CERT_FILE          = "/etc/ssl/certs/ca-bundle.crt";
        # FIXME: unneeded - remove eventually.
        OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
        # FIXME: unneeded - remove eventually.
        GIT_SSL_CAINFO         = "/etc/ssl/certs/ca-bundle.crt";
      };

  };

}
Rewrite ‘with pkgs.lib’ -> ‘with lib’ Using pkgs.lib on the spine of module evaluation is problematic because the pkgs argument depends on the result of module evaluation. To prevent an infinite recursion, pkgs and some of the modules are evaluated twice, which is inefficient. Using ‘with lib’ prevents this problem. 2014-04-14 14:26:48 +00:00			`{ config, lib, pkgs, ... }:`
* Provide a bundle of CA certificates in /etc/ca-bundle.crt, and set the CURL_CA_BUNDLE environment variable. This allows curl to work without the `-k' flag on https sites with a properly signed certificate. svn path=/nixos/trunk/; revision=19572 2010-01-20 14:22:47 +00:00
Rewrite ‘with pkgs.lib’ -> ‘with lib’ Using pkgs.lib on the spine of module evaluation is problematic because the pkgs argument depends on the result of module evaluation. To prevent an infinite recursion, pkgs and some of the modules are evaluated twice, which is inefficient. Using ‘with lib’ prevents this problem. 2014-04-14 14:26:48 +00:00			`with lib;`
* Provide a bundle of CA certificates in /etc/ca-bundle.crt, and set the CURL_CA_BUNDLE environment variable. This allows curl to work without the `-k' flag on https sites with a properly signed certificate. svn path=/nixos/trunk/; revision=19572 2010-01-20 14:22:47 +00:00
			`{`

			`config = {`

* Put the CA certificate bundle in /etc/ssl/certs because Qt expects them there. svn path=/nixos/trunk/; revision=28009 2011-07-29 19:06:27 +00:00			`environment.etc =`
Revert "Add /etc/ssl/certs/ca-certificates.crt symlink for Ubuntu compatibility" This reverts commit 10133f0b5b30e4d36a0c66742e1483d126d86f28. See discussion at https://github.com/NixOS/nixos/pull/224 2013-08-18 15:46:07 +00:00			`[ { source = "${pkgs.cacert}/etc/ca-bundle.crt";`
			`target = "ssl/certs/ca-bundle.crt";`
* Put the CA certificate bundle in /etc/ssl/certs because Qt expects them there. svn path=/nixos/trunk/; revision=28009 2011-07-29 19:06:27 +00:00			`}`
			`];`
* Provide a bundle of CA certificates in /etc/ca-bundle.crt, and set the CURL_CA_BUNDLE environment variable. This allows curl to work without the `-k' flag on https sites with a properly signed certificate. svn path=/nixos/trunk/; revision=19572 2010-01-20 14:22:47 +00:00
Rename environment.systemVariables -> environment.sessionVariables This makes it clearer that they're part of PAM sessions. 2014-06-13 15:56:46 +00:00			`environment.sessionVariables =`
Set $SSL_CERT_FILE It's more standard than $OPENSSL_X509_CERT_FILE (which I guess was a totally unnecessary patch to OpenSSL). Since curl respects $SSL_CERT_FILE, it's no longer needed to set $CURL_CA_BUNDLE. Git unfortunately doesn't. 2014-07-28 17:06:09 +00:00			`{ SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";`
			`# FIXME: unneeded - remove eventually.`
			`OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";`
Revert $GIT_SSL_CAINFO removal Users have an older git in their user environment and it doesn't work without it. We should keep it around for a while. 2014-12-01 22:07:50 +00:00			`# FIXME: unneeded - remove eventually.`
			`GIT_SSL_CAINFO = "/etc/ssl/certs/ca-bundle.crt";`
Revert "Revert "Merge #2692: Use pam_env to properly setup system-wide env"" This reverts commit 491c088731022463978e595956427e72db6306a9. 2014-06-10 11:07:10 +00:00			`};`
strip trailing whitespace; no functional change svn path=/nixos/trunk/; revision=29285 2011-09-14 18:20:50 +00:00
* Provide a bundle of CA certificates in /etc/ca-bundle.crt, and set the CURL_CA_BUNDLE environment variable. This allows curl to work without the `-k' flag on https sites with a properly signed certificate. svn path=/nixos/trunk/; revision=19572 2010-01-20 14:22:47 +00:00			`};`

			`}`