Re: Builtin GnuTLS support and certificate verification

[Ted Zlatanov <tzz@lifelogs.com>]

On Mon, 16 Dec 2013 10:39:48 +0900 Katsumi Yamaoka <yamaoka@jpl.org> wrote: 

KY> Ted Zlatanov wrote:
>> I pushed this work to the Emacs trunk with the old behavior (connections
>> never abort, just warn).  Please customize `gnutls-verify-error' to get
>> the new behavior, erroring out on validation failures.  I encourage you
>> to try it and report any issues.

KY> One of my POP mail sources got to not work for today's Emacs build
KY> from the trunk.

KY> First, `mapcan' that `gnutls-negotiate' uses is a cl run-time
KY> function, so I needed to load cl manually.

Ah, yes.  Stefan fixed it already.  Sorry.

KY> If `gnutls-verify-error' is nil, `mail-source-fetch-pop' fails
KY> for the error: (wrong-type-argument listp nil)
KY> This is what the built-in function `gnutls-boot' issues.
KY> The arguments passed to it then are:
KY> #<prosess POP>
KY> gnutls-x509pki
KY> (:priority "NORMAL" :hostname "my.pop.server" :loglevel 0
KY>  :min-prime-bits 1024 :trustfiles ("/usr/ssl/certs/ca-bundle.crt")
KY>  :crlfiles nil :keylist nil :verify-flags nil :verify-error nil
KY>  :callbacks nil)

KY> If I set `gnutls-verify-error' to t, `gnutls-boot' issues the error
KY> (wrong-type-argument listp t) because :verify-error is t.

Looks like http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16161 as well.
I'll follow up.

Ted