{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nix/issues/921","repository_url":"https://api.github.com/repos/NixOS/nix","labels_url":"https://api.github.com/repos/NixOS/nix/issues/921/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nix/issues/921/comments","events_url":"https://api.github.com/repos/NixOS/nix/issues/921/events","html_url":"https://github.com/NixOS/nix/issues/921","id":157775870,"number":921,"title":"SSL_CERT_FILE causes SSL certificate errors with other tools","user":{"login":"kballard","id":714,"avatar_url":"https://avatars.githubusercontent.com/u/714?v=3","gravatar_id":"","url":"https://api.github.com/users/kballard","html_url":"https://github.com/kballard","followers_url":"https://api.github.com/users/kballard/followers","following_url":"https://api.github.com/users/kballard/following{/other_user}","gists_url":"https://api.github.com/users/kballard/gists{/gist_id}","starred_url":"https://api.github.com/users/kballard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kballard/subscriptions","organizations_url":"https://api.github.com/users/kballard/orgs","repos_url":"https://api.github.com/users/kballard/repos","events_url":"https://api.github.com/users/kballard/events{/privacy}","received_events_url":"https://api.github.com/users/kballard/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NixOS/nix/labels/bug","name":"bug","color":"e10c02"},{"url":"https://api.github.com/repos/NixOS/nix/labels/darwin","name":"darwin","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":29,"created_at":"2016-05-31T21:33:41Z","updated_at":"2016-10-13T14:18:32Z","closed_at":null,"body":"I tried to install something with Homebrew today (a package that is out of date on Nix) and it failed with the following error:\r\n\r\n> curl: (51) SSL: certificate verification failed (result: 5)\r\n\r\nDigging into this, it's trying to download a file using curl that, after redirects, ends up fetching a URL like\r\n\r\nhttps://akamai.bintray.com/5c/5ce4e36ed803d7ee2863b8a84b2123fb29f34e02e7c2f908284bb24408f94a65?__gda__=exp=1464730847~hmac=bfe122e8b6bcbf8d01952ab997861ac1fed2434aceccc74cf5c356ad107a1481&response-content-disposition=attachment%3Bfilename%3D%22git-lfs-1.2.0.el_capitan.bottle.tar.gz%22&response-content-type=application%2Fgzip\r\n\r\n(I assume this URL is not permanent)\r\n\r\nThe fetch for this resource is what triggers the certificate verification failure. Unsetting `$SSL_CERT_FILE` fixes the issue. My assumption here is that the root certificate for that server isn't included in Nix's ca-bundle.crt, though I don't know why that would be.\r\n\r\nThis is with Nix 1.11.2 on OS X 10.11.5."},"comment":{"url":"https://api.github.com/repos/NixOS/nix/issues/comments/253526610","html_url":"https://github.com/NixOS/nix/issues/921#issuecomment-253526610","issue_url":"https://api.github.com/repos/NixOS/nix/issues/921","id":253526610,"user":{"login":"domenkozar","id":126339,"avatar_url":"https://avatars.githubusercontent.com/u/126339?v=3","gravatar_id":"","url":"https://api.github.com/users/domenkozar","html_url":"https://github.com/domenkozar","followers_url":"https://api.github.com/users/domenkozar/followers","following_url":"https://api.github.com/users/domenkozar/following{/other_user}","gists_url":"https://api.github.com/users/domenkozar/gists{/gist_id}","starred_url":"https://api.github.com/users/domenkozar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenkozar/subscriptions","organizations_url":"https://api.github.com/users/domenkozar/orgs","repos_url":"https://api.github.com/users/domenkozar/repos","events_url":"https://api.github.com/users/domenkozar/events{/privacy}","received_events_url":"https://api.github.com/users/domenkozar/received_events","type":"User","site_admin":false},"created_at":"2016-10-13T14:18:32Z","updated_at":"2016-10-13T14:18:32Z","body":"@Blaisorblade once we find a proper solution, this will be implemented. It doesn't make sense to ship new Nix with half-baked solution and break the behaviour each release without knowing all the consequences. It gives a false hope."}}
{"actor":{"display_login":"domenkozar"}}