talons

commit 6d7861078433a7807f32359332a01479d71fc4ac
parent 0b3e475621dfa6b22017095fb285c5087a1a096b
Author: Oliver Lowe <o@olowe.co>
Date:   Mon, 24 Nov 2025 12:32:23 +1100

common: ignore SSL_CERT_FILE like libressl

From X509_LOOKUP_new(3):

> For reasons of security and simplicity, LibreSSL ignores the environment
> variables SSL_CERT_DIR and SSL_CERT_FILE

Diffstat:
M
src/common/ssl.c
 | 
8
+-------
M
src/common/ssl_certificate.c
 | 
2
+-

2 files changed, 2 insertions(+), 8 deletions(-)
diff --git a/src/common/ssl.c b/src/common/ssl.c
@@ -122,10 +122,6 @@ const gchar *claws_ssl_get_cert_file(void)
 		NULL};
 	int i;
 
-	/* We honor this environment variable on all platforms. */
-	if (g_getenv("SSL_CERT_FILE"))
-		return g_getenv("SSL_CERT_FILE");
-
 	for (i = 0; cert_files[i]; i++) {
 		if (is_file_exist(cert_files[i]))
 			return cert_files[i];
@@ -135,8 +131,6 @@ const gchar *claws_ssl_get_cert_file(void)
 
 const gchar *claws_ssl_get_cert_dir(void)
 {
-	if (g_getenv("SSL_CERT_DIR"))
-		return g_getenv("SSL_CERT_DIR");
 	const char *cert_dirs[]={
 		"/etc/pki/tls/certs",
 		"/etc/certs",
@@ -320,7 +314,7 @@ gboolean ssl_init_socket(SockInfo *sockinfo)
 	if (claws_ssl_get_cert_file()) {
 		r = gnutls_certificate_set_x509_trust_file(xcred, claws_ssl_get_cert_file(),  GNUTLS_X509_FMT_PEM);
 		if (r < 0)
-			g_warning("can't read SSL_CERT_FILE '%s': %s",
+			g_warning("get certificate file '%s': %s",
 				claws_ssl_get_cert_file(),
 				gnutls_strerror(r));
 	} else {
diff --git a/src/common/ssl_certificate.c b/src/common/ssl_certificate.c
@@ -818,7 +818,7 @@ gboolean ssl_certificate_check_chain(gnutls_x509_crt_t *certs, gint chain_len,
 		}
 
 		if (r < 0)
-			g_warning("can't read SSL_CERT_FILE '%s': %s",
+			g_warning("read certificate file '%s': %s",
 				claws_ssl_get_cert_file(),
 				gnutls_strerror(r));
 	} else {