diff options
| -rw-r--r-- | misc/launchd/org.nixos.nix-daemon.plist.in | 5 | ||||
| -rw-r--r-- | src/libstore/download.cc | 7 | ||||
| -rw-r--r-- | src/libstore/globals.cc | 10 |
3 files changed, 13 insertions, 9 deletions
diff --git a/misc/launchd/org.nixos.nix-daemon.plist.in b/misc/launchd/org.nixos.nix-daemon.plist.in index c5ef97ee9a..66fcd155ee 100644 --- a/misc/launchd/org.nixos.nix-daemon.plist.in +++ b/misc/launchd/org.nixos.nix-daemon.plist.in @@ -12,10 +12,5 @@ <string>/var/log/nix-daemon.log</string> <key>StandardOutPath</key> <string>/dev/null</string> - <key>EnvironmentVariables</key> - <dict> - <key>NIX_SSL_CERT_FILE</key> - <string>/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt</string> - </dict> </dict> </plist> diff --git a/src/libstore/download.cc b/src/libstore/download.cc index 63e498f060..33ab1f0278 100644 --- a/src/libstore/download.cc +++ b/src/libstore/download.cc @@ -221,9 +221,10 @@ struct CurlDownloader : public Downloader if (request.head) curl_easy_setopt(req, CURLOPT_NOBODY, 1); - if (request.verifyTLS) - curl_easy_setopt(req, CURLOPT_CAINFO, settings.caFile.c_str()); - else { + if (request.verifyTLS) { + if (settings.caFile != "") + curl_easy_setopt(req, CURLOPT_CAINFO, settings.caFile.c_str()); + } else { curl_easy_setopt(req, CURLOPT_SSL_VERIFYPEER, 0); curl_easy_setopt(req, CURLOPT_SSL_VERIFYHOST, 0); } diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc index 2aceed2705..935018132d 100644 --- a/src/libstore/globals.cc +++ b/src/libstore/globals.cc @@ -41,7 +41,15 @@ Settings::Settings() { buildUsersGroup = getuid() == 0 ? "nixbld" : ""; lockCPU = getEnv("NIX_AFFINITY_HACK", "1") == "1"; - caFile = getEnv("NIX_SSL_CERT_FILE", getEnv("SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt")); + + caFile = getEnv("NIX_SSL_CERT_FILE", getEnv("SSL_CERT_FILE", "")); + if (caFile == "") { + for (auto & fn : {"/etc/ssl/certs/ca-certificates.crt", "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt"}) + if (pathExists(fn)) { + caFile = fn; + break; + } + } /* Backwards compatibility. */ auto s = getEnv("NIX_REMOTE_SYSTEMS"); |