SSL certificate path does not propagate to builds during `nix-build` about nix HOT 10 OPEN

What do you think?

Hmm, indeed curl in nixpkgs does reference NIX_SSL_CERT_FILE in a comment - not sure how this is intended to fit together.

#3155 and https://discourse.nixos.org/t/nix-cannot-find-my-custom-ssl-certificate/27361/5 might also be relevant.

from nix.

I wonder if behavior changes with --option ssl-cert-file /path/to/bundle (it might not, since I think it takes effect in the same way NIX_SSL_CERT_FILE does, but worth a shot...)

from nix.

yeah same result, unfortunately

from nix.

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/nix-build-curl-issues-behind-proxy/45911/5

from nix.

Fetchers such as fetchzip

since fetchzip is not a nix builtin but implemented in nixpkgs (based on fetchurl), this issue should perhaps be moved to the nixpkgs repo instead?

from nix.

this issue should perhaps be moved to the nixpkgs repo instead?

I thought it might also be a Nix (daemon?) issue that it kills NIX_SSL_CERT_FILE or something, because I experienced this with multiple fetchers, but I don't actually know. What do you think?

from nix.

yeah, I saw those issues and already applied the Environment fix, by adding NIX_SSL_CERT_FILE to systemd.services.nix-daemon.serviceConfig.Environment, and checking systemctl show nix-daemon | grep Environment, whose output correctly includes

CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt 
NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

from nix.

A workaround when using curl through fetchurl is to set NIX_CURL_FLAGS in the nix-daemon environment [1] [2]. On NixOS in configuration.nix you can do something like this:

  systemd.services.nix-daemon = {
    enable = true;
    serviceConfig = {
      Environment = [
        "NIX_CURL_FLAGS=\"--cacert /etc/ssl/certs/ca-certificates.crt\""
      ];
    };
  };

which seems to work in my setup. Still, I think NIX_SSL_CERT_FILE should be fixed and used instead.

edit: this workaround seems to work with nix-build but not with nixos-rebuild on NixOS which runs into the original error

from nix.

Triaged in Nix maintainers meeting:

• This is a documentation issue, partly in the Nix manual, largely in the Nixpkgs manual.

from nix.

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2024-05-29-nix-team-meeting-minutes-148/46195/1

from nix.