From 1868619ffd6277eb01d676f816cba61b52083927 Mon Sep 17 00:00:00 2001
From: Ian Jackson <ijackson@chiark.greenend.org.uk>
Date: Sun, 28 Jun 2015 16:04:13 +0100
Subject: TLS keys: Use ca-certificates on end user machines, introducing bug
 #790093 :-(

---
 dgit | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'dgit')

diff --git a/dgit b/dgit
index eea4dbc..f6bf3a7 100755
--- a/dgit
+++ b/dgit
@@ -450,8 +450,11 @@ our %defcfg = ('dgit.default.distro' => 'debian',
 	       'dgit-distro.debian.git-path' => '/dgit/debian/repos',
 	       'dgit-distro.debian.git-check' => 'ssh-cmd',
  'dgit-distro.debian.archive-query-url', 'https://api.ftp-master.debian.org/',
- 'dgit-distro.debian.archive-query-tls-key',
-    '/etc/ssl/certs/%HOST%.pem:/etc/dgit/%HOST%.pem',
+# 'dgit-distro.debian.archive-query-tls-key',
+#    '/etc/ssl/certs/%HOST%.pem:/etc/dgit/%HOST%.pem',
+# ^ this does not work because curl is broken nowadays
+# Fixing #790093 properly will involve providing providing the key
+# in some pacagke and maybe updating these paths.
 #
 # 'dgit-distro.debian.archive-query-tls-curl-args',
 #   '--ca-path=/etc/ssl/ca-debian',
@@ -717,7 +720,12 @@ sub archive_api_query_cmd ($) {
 		fail "for $url: stat $key: $!" unless $!==ENOENT;
 		next;
 	    }
-	    push @cmd, "--cacert", $key, "--capath", "/dev/enoent";
+	    fail "config requested specific TLS key but do not know".
+		" how to get curl to use exactly that EE key ($key)";
+#	    push @cmd, "--cacert", $key, "--capath", "/dev/enoent";
+#           # Sadly the above line does not work because of changes
+#           # to gnutls.   The real fix for #790093 may involve
+#           # new curl options.
 	    last;
 	}
 	# Fixing #790093 properly will involve providing a value
-- 
cgit v1.2.3