pkgs/development/libraries/gnutls/nix-ssl-cert-file.patch

   1 allow overriding system trust store location via $NIX_SSL_CERT_FILE
   2
   3 diff --git a/lib/system/certs.c b/lib/system/certs.c
   4 index 611c645..6ef6edb 100644
   5 --- a/lib/system/certs.c
   6 +++ b/lib/system/certs.c
   7 @@ -369,6 +369,11 @@ gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list,
   8                                         unsigned int tl_flags,
   9                                         unsigned int tl_vflags)
  10  {
  11 -       return add_system_trust(list, tl_flags|GNUTLS_TL_NO_DUPLICATES, tl_vflags);
  12 +       tl_flags = tl_flags|GNUTLS_TL_NO_DUPLICATES;
  13 +       const char *file = secure_getenv("NIX_SSL_CERT_FILE");
  14 +       return file
  15 +               ? gnutls_x509_trust_list_add_trust_file(
  16 +                       list, file, NULL/*CRL*/, GNUTLS_X509_FMT_PEM, tl_flags, tl_vflags)
  17 +               : add_system_trust(list, tl_flags, tl_vflags);
  18  }
  19