weechat @0.4.3 use CA certificates provided by curl-ca-bundle

[anddam (Andrea D'Amore)]

I'm attaching a patch adding run dependency on port curl-ca-bundles, the config option to use those by default in weechat and bumping the revision.

[cooljeanius (Eric Gallager)]

Should probably be a path-style dependency so that certsync can satisfy it

[cooljeanius (Eric Gallager)]

Cc Me!

[harciga]

Replying to egall@…:

Should probably be a path-style dependency so that certsync can satisfy it

This should do it:

depends_run         path:share/curl/curl-ca-bundle.crt:curl-ca-bundle

I'll test the patch later tonight

[harciga]

I've attached the Portfile.diff, if anyone with commit rights would be kind enough to apply it.

Thanks.

[anddam (Andrea D'Amore)]

Committed in r119526, I used the same share/[…] path as configure option since certsync doesn't provide the symlink in $prefix/etc (should it?).

Thanks for the prompt reply, ticket closed.

[harciga]

Replying to and.damore@…:

Committed in r119526, I used the same share/[…] path as configure option since certsync doesn't provide the symlink in $prefix/etc (should it?).

Thanks for the prompt reply, ticket closed.

I thought certsync did provide ${prefix}/etc because of

ln -s ${prefix}/etc/openssl/cert.pem ${destroot}${prefix}/share/curl/curl-ca-bundle.crt

at browser:trunk/dports/security/certsync/Portfile#L70​

anyway, both paths will work.

Thanks

[anddam (Andrea D'Amore)]

Replying to starkhalo@…:

I thought certsync did provide ${prefix}/etc because of

ln -s ${prefix}/etc/openssl/cert.pem ${destroot}${prefix}/share/curl/curl-ca-bundle.crt

at browser:trunk/dports/security/certsync/Portfile#L70​

As you can see it's the opposite, that line is creating a symlink located in ${prefix}/share/curl and pointing to ${prefix}/etc/openssl/cert.pem even if the latter doesn't exist. I'm not sure what certsync is doing, I'll check with the maintainer.

Actually I didn't even check the certsync portfile, I activated the package from the binary package repository and noticed etc/openssl/cert.pem was not there.

edit:

certsync provides a dynamic update of cert.pem from Apple's CAs in Keychain, its behavior is correct I just didn't leave it the time to populate cert.pem on my system before removing the port, also certsync is preferred due to its auto-updating and "official" nature, see

​https://lists.macosforge.org/pipermail/macports-dev/2013-May/022793.html

​https://lists.macosforge.org/pipermail/macports-dev/2013-August/023792.html

and following parts of the thread.

[anddam (Andrea D'Amore)]

I'd say to make the path dependency default to certsync and change the default value of gnutls_ca_file to the etc/openssl file, any thoughts?

[harciga]

Replying to and.damore@…:

I'd say to make the path dependency default to certsync and change the default value of gnutls_ca_file to the etc/openssl file, any thoughts?

depends_run path:share/curl/curl-ca-bundle.crt:certsync

and

-DCA_FILE=${prefix}/etc/openssl/cert.pem 

Sounds about right, I'll attach the Portfile diff in a few hours, I'm off to bed atm

[anddam (Andrea D'Amore)]

No need, I'll go with the change.