crypto/x509: add /usr/local/etc/ssl/certs for CA certificates on Linux

[afbjorklund]

What version of Go are you using (go version)?

go version go1.10.4 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

linux-amd64

What did you do?

go get golang.org/x/tools/cmd/godoc

What did you expect to see?

(nothing)

What did you see instead?

package golang.org/x/tools/cmd/godoc: unrecognized import path "golang.org/x/tools/cmd/godoc" (https fetch: Get https://golang.org/x/tools/cmd/godoc?go-get=1: x509: failed to load system roots and no roots provided)

---

Reason

Under TinyCore, the files are installed under /usr/local/etc/ssl/certs rather than /etc/ssl/certs.
It would be nice if both locations would be accepted (it is allowed, under the File Hierarchy Standard) ?

[afbjorklund]

https://go-review.googlesource.com/c/go/+/141821

[minaevmike]

hm, i am not sure that it's a good idea to add this, because even it's could be tested well. For your case you can set env variables

go/src/crypto/x509/root_unix.go

Line 28 in 29907b1

certFileEnv = "SSL_CERT_FILE"

[afbjorklund]

Added the symlink for now, but maybe those files can be added in e.g. profile ?

Just seemed like it had a long list of other special cases hard-coded into it already ?

[agnivade]

/cc @bradfitz @FiloSottile

[FiloSottile]

We already have a laundry list of possible locations, and by the nature of Linux distributions, that list could grow forever, which is not a manageable outcome. That's why SSL_CERT_FILE is supported, and I recommend distributions set it in the system profile. Other software supports it as well, so it's not just a Go accommodation.

[afbjorklund]

Confirm that the workaround works fine, was also unnecessary to change certDirectories...

export SSL_CERT_FILE=/usr/local/etc/ssl/certs/ca-certificates.crt

I suppose I could always patch it downstream, if it is hard to get it into /etc/profile.d/go.sh ?

If interested, here are the complete build instructions for TCL: building_go.md

[gopherbot]

Change https://golang.org/cl/141821 mentions this issue: crypto/x509: add path for TinyCore ca-certificates

[FiloSottile]

I recommend using SSL_CERT_FILE if possible, as we are committed to supporting that, while the patch might stop applying.

[afbjorklund]

It's not so easy to use SSL_CERT_FILE, since for instance when using sudo it is gone again...
Adding it to /etc/profile.d only helped for subshells, but not when invoking go commands.

So it would have been easier, if the "crypto/x509" go module had just worked out-of-the-box ?
For instance git and curl are able to use https, since libcurl is able to find /usr/local/etc/ssl/certs:

./configure --prefix=/usr/local --disable-static --enable-threaded-resolver --with-ca-bundle=/usr/local/etc/ssl/certs/ca-certificates.crt

So it seems like patching Go to look in this standard location, will be the easiest way to support it.

diff --git a/src/crypto/x509/root_linux.go b/src/crypto/x509/root_linux.go
index aa1785e..755af89 100644
--- a/src/crypto/x509/root_linux.go
+++ b/src/crypto/x509/root_linux.go
@@ -11,4 +11,5 @@
 	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
 	"/etc/pki/tls/cacert.pem",                           // OpenELEC
 	"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
+	"/usr/local/etc/ssl/certs/ca-certificates.crt",      // TinyCore
 }

[adamdecaf]

Go needs to be able to read the file. If permissions/ownership are a problem Go can't help.

[afbjorklund]

@adamdecaf : the file is there (readable) alright, it was the environment variable that went missing...

i.e. one needs to either use sudo -E or "sudo SSL_CERT_FILE=$SSL_CERT_FILE" for everything