#46829 - Let's Encrypt certificate store (le-certs) expired

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #120 received at 46829@debbugs.gnu.org (full text, mbox, reply):

Received: (at 46829) by debbugs.gnu.org; 14 Apr 2021 19:57:22 +0000
From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 14 15:57:22 2021
Received: from localhost ([127.0.0.1]:35802 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lWldZ-0003LH-Sl
	for submit@debbugs.gnu.org; Wed, 14 Apr 2021 15:57:22 -0400
Received: from michel.telenet-ops.be ([195.130.137.88]:36156)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maximedevos@telenet.be>) id 1lWldY-0003L6-1Z
 for 46829@debbugs.gnu.org; Wed, 14 Apr 2021 15:57:21 -0400
Received: from ptr-bvsjgyjmffd7q9timvx.18120a2.ip6.access.telenet.be
 ([IPv6:2a02:1811:8c09:9d00:aaf1:9810:a0b8:a55d])
 by michel.telenet-ops.be with bizsmtp
 id sjxH2400D0mfAB406jxJxp; Wed, 14 Apr 2021 21:57:18 +0200
Message-ID: <bd2e02c02a294adce2c197060539d6c84af9538c.camel@telenet.be>
Subject: Re: bug#46829: `guix pull` uses incorrect certificate store
From: Maxime Devos <maximedevos@telenet.be>
To: Ludovic Courtès <ludo@gnu.org>, Leo Famulari
 <leo@famulari.name>
Date: Wed, 14 Apr 2021 21:57:03 +0200
In-Reply-To: <87im4pf8cg.fsf@gnu.org>
References: <871rd0ebd5.fsf@cbaines.net> <877dmrtbvn.fsf@gnu.org>
 <877dm54zk3.fsf@gnu.org> <YHNe5+taYSQI70dt@jasmine.lan>
 <YHOiXP0JJZZej+7H@jasmine.lan> <YHPrv2NdqqaLWh42@jasmine.lan>
 <87zgy2leg9.fsf_-_@gnu.org> <YHXYkTHmMk3FbxMu@jasmine.lan>
 <87im4pf8cg.fsf@gnu.org>
Content-Type: multipart/signed; micalg="pgp-sha512";
 protocol="application/pgp-signature"; boundary="=-I84WCGqI4xKMZApGImiz"
User-Agent: Evolution 3.34.2 
MIME-Version: 1.0
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telenet.be; s=r21;
 t=1618430238; bh=QkgaNxb6OjfXI3InKnU5OwhSezUq7n20B8aj3rnvv9U=;
 h=Subject:From:To:Cc:Date:In-Reply-To:References;
 b=I9jjEtGbeGV6cd0CDv7w6JfvmacBqC2pX10JL1lzg7PlVEuHEhLAkTY2Bosm5/q2I
 TWKXdrAELWhihUGA6TtjpnK2pka6kwj31nOAQEakxfQUcTJja3ARnXGdxpzMPbbeX4
 S1xLw9OwagJx/ZteWtH7+IjDdXcjmKnqQjpI4wgWA4x08YA3cbzsPgDkZYzZuCmwQv
 dYeNVfTRZ4l++5FCyL+EkV2mkSlQbqe5NSPq6iMyNEJmf5IB4/fsqpcayMo4WYsB3c
 gTm8eYpXwnEGz8PE/BGsb/A4SXxexA6/CdehrFiLE9+zM3x5VasSor9/LDsMYlch6W
 CeTZxfb4ana4A==
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 46829
Cc: 46829@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

[Message part 1 (text/plain, inline)]

On Wed, 2021-04-14 at 12:50 +0200, Ludovic Courtès wrote:
> [...]
> > > We could also add a ‘--no-check-certificates’ option to ‘guix pull’.
> > 
> > I think we should avoid adding "use insecure connection" options. Even
> > if the code itself is signed.
> 
> “Insecure” is a strong word: it still prevents eavesdropping, which is
> the only property that matters in the presence of authenticated
> channels.

Maybe call the option '--tolerate-eavesdropping' then?  That name:

* is technically correct
* doesn't suggest the option is "Insecure"
* but still sounds like something you don't want
* should be clear to people not knowing about TLS' PKI infrastructure,
  ‘will eventually’™ be replaced with GNS + <insert GNUnet protocol here> or
  something like that, which wouldn't use such a centralised structure.

Thoughts?
Maxime.

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 08:16:06 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#46829 Let's Encrypt certificate store (le-certs) expired