curl https://nixos.org/nix/install | sh ignores nix NIX_SSL_CERT_FILE

[makefu]

Problem Description

When trying to set NIX_SSL_CERT_FILE for the installation i encountered Peer certificate cannot be authenticated with given CA certificates (60) even though i had manually set the path to my custom certificate bundle.

I encountered the issue because it seems like the old openssl version installed on CentOS7 validates certificates a bit different than the one used by nix which resulted in the cacert file working for the curl |sh call but not afterwards for running nix-channel.

Cause

The install script sources $nix/etc/profile.d/nix.sh ( https://github.com/NixOS/nix/blob/master/scripts/install-nix-from-closure.sh#L123 ) just before calling nix-channel --update. nix.sh env in turn will almost certainly override NIX_SSL_CERT_FILE when it is able to find another cert file in one of the distribution default directories ( https://github.com/NixOS/nix/blob/master/scripts/nix-profile.sh.in#L63-L76 ).

This will also result in an branch where the nix-provided cert file would be installed to (almost) never be encountered ( https://github.com/NixOS/nix/blob/master/scripts/install-nix-from-closure.sh#L131-L134 ).

Possible solution

Check for NIX_SSL_CERT_FILE to be set in nix.sh before overriding it.

related irc logs: https://logs.nix.samueldr.com/nixos/2018-11-27#1543340933-1543343464;
Related PR which added support for NIX_SSL_CERT_FILE: #2181

[mogorman]

adding cacert to my default.nix solved my problem.

[makefu]

@mogorman to which default.nix exactly? when running curl | sh i do not see an entry point to update any sources.

[mogorman]

sorry makefu. i was experiencing same error issue inside of a nix-shell --pure so i thought it was related. my problem was resolved by adding cacert into the closure.

[makefu]

ah okay! good to know 👍

[stale]

I marked this as stale due to inactivity. → More info

[makefu]

haven't tested with latest installer but definitely still relevant for me

[stale]

I marked this as stale due to inactivity. → More info

[makefu]

can anyone confirm everything now works as expected? i will be able to test earliest in 2 weeks.
still relevant for me obviously

[stale]

I marked this as stale due to inactivity. → More info