extensionSystem: Use the system cert list

libsoup won't check for a valid cert by default, so copy some logic from
glib-networking to check against the system cert list. Additionally, allow a
fallback for developers, ~/.local/share/extensions.gnome.org.crt, for easy
local development of the website.

https://bugzilla.gnome.org/show_bug.cgi?id=658870

diff --git a/configure.ac b/configure.ac
index f2db9eb91bca3d6bdf23c9d517f23d76d5039bb1..35c567d2430cc50f0ff6d3535ee1f3356bb28b4a 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -210,6 +210,31 @@ AC_ARG_ENABLE(jhbuild-wrapper-script,
   AS_HELP_STRING([--jhbuild-wrapper-script=yes],[Make "gnome-shell" script work for jhbuild]),,enable_jhbuild_wrapper_script=no)
 AM_CONDITIONAL(USE_JHBUILD_WRAPPER_SCRIPT, test "x$enable_jhbuild_wrapper_script" = xyes)
 
+AC_MSG_CHECKING([location of system Certificate Authority list])
+AC_ARG_WITH(ca-certificates,
+            [AC_HELP_STRING([--with-ca-certificates=@<:@path@:>@],
+                            [path to system Certificate Authority list])])
+
+if test "$with_ca_certificates" = "no"; then
+    AC_MSG_RESULT([disabled])
+else
+    if test -z "$with_ca_certificates"; then
+        for f in /etc/pki/tls/certs/ca-bundle.crt \
+                 /etc/ssl/certs/ca-certificates.crt; do
+             if test -f "$f"; then
+                with_ca_certificates="$f"
+             fi
+        done
+        if test -z "$with_ca_certificates"; then
+            AC_MSG_ERROR([could not find. Use --with-ca-certificates=path to set, or --without-ca-certificates to disable])
+        fi
+   fi
+
+   AC_MSG_RESULT($with_ca_certificates)
+   AC_DEFINE_UNQUOTED(SHELL_SYSTEM_CA_FILE, ["$with_ca_certificates"], [The system TLS CA list])
+fi
+AC_SUBST(SHELL_SYSTEM_CA_FILE,["$with_ca_certificates"])
+
 AC_CONFIG_FILES([
   Makefile
   data/Makefile

diff --git a/js/misc/config.js.in b/js/misc/config.js.in
index 25a0e728723ccf52c90988a5461af9928cbbc503..85ab7b57a36d091e9b568b13966140416dd87d9c 100644 (file)
--- a/js/misc/config.js.in
+++ b/js/misc/config.js.in
@@ -7,4 +7,5 @@ const PACKAGE_VERSION = '@PACKAGE_VERSION@';
 const GJS_VERSION = '@GJS_VERSION@';
 /* 1 if gnome-bluetooth is available, 0 otherwise */
 const HAVE_BLUETOOTH = @HAVE_BLUETOOTH@;
-
+/* The system TLS CA list */
+const SHELL_SYSTEM_CA_FILE = '@SHELL_SYSTEM_CA_FILE@';

diff --git a/js/ui/extensionSystem.js b/js/ui/extensionSystem.js
index d6e399abfa1026c13e8988d8f1e1072d8a085f6a..cc2510f2373b8f382f1fd846912e5c352c43acaf 100644 (file)
--- a/js/ui/extensionSystem.js
+++ b/js/ui/extensionSystem.js
@@ -44,6 +44,16 @@ const _httpSession = new Soup.SessionAsync();
 if (Soup.Session.prototype.add_feature != null)
     Soup.Session.prototype.add_feature.call(_httpSession, new Soup.ProxyResolverDefault());
 
+function _getCertFile() {
+    let localCert = GLib.build_filenamev([global.userdatadir, 'extensions.gnome.org.crt']);
+    if (GLib.file_test(localCert, GLib.FileTest.EXISTS))
+        return localCert;
+    else
+        return Config.SHELL_SYSTEM_CA_FILE;
+}
+
+_httpSession.ssl_ca_file = _getCertFile();
+
 // Maps uuid -> metadata object
 const extensionMeta = {};
 // Maps uuid -> importer object (extension directory tree)