Re: [Pan-users] SSL on Pan 137

[Lacrocivious Acrophosist]

On Sat, 19 May 2012 22:24:21 -0300, Ed Fletcher wrote:

> On 05/19/2012 09:04 PM, Duncan wrote:
>> Yes, cert-store has to do with storing the certificates pan receives
>> for a secure connection, so indeed, it's ssl-related.
>>
>> My guess is that it's still finding the old include files since you
>> didn't mention moving them or editing the *.pc file.  The *.pc file
>> should give the correct paths, but in the actual compilation, it's
>> likely the system paths are coming first, in ordered to be able to find
>> other libs, so the build is using the headers in those system paths,
>> which are still the old headers since that version wasn't removed.
>>
>> Meanwhile, in the other subthread you mentioned possibly building the
>> new version, pointed at the system location, thereby replacing the old
>> one already there.  That should work for pan since you're rebuilding it
>> now, but do be aware that it may well break other apps/libs depending
>> on gnutls.  They'd likewise be fixed with a rebuild (possibly with a
>> patch or of a newer version), but I'd at least check to see what
>> packages you actually have linked against gnutls, so you have some idea
>> of how big the hole you're digging might get.
>>
>> That's one good thing about gentoo and similar
>> managed-build-from-source distros.  Since everything's built from
>> source, and at least gentoo has a tool called revdep-rebuild that can
>> automatically scan for such broken dependencies and tell you what to
>> rebuild, breaking such dependencies due to update is no big deal, you
>> simply run the tool and let it rebuild what it needs to, afterward, and
>> since everything's built from source already,
>> there's no worry about having to manually bring in whole lists of
>> missing build dependencies and resolve everything one manual build and
>> test at a time.  I remember running mandrake and having to do that
>> manually, and how nice it was when I first started on gentoo, having it
>> all "just work", because the whole set of assumptions were different
>> when you were building /everything/ from sources.
> 
> I did edit the gnutls.pc and gnutls-extras.pc files, but not correctly.
>   I (think) I've now got them the way they should be.  And I moved the
> include files, as I did the 2.12.7 libs.  But it still fails to compile.
>   I think I'm going to throw in the towel and wait for Slackware-current
> to get a newer version of GnuTLS.  I don't want to end up with a system
> that has more problems than I know how to fix.  Right now, I can still
> put everything back where it belongs.  And pan compiled just fine
> without the gnutls flag.  So I think I'll stick to using stunnel for a
> little while longer.
> 
> I tried Gentoo a long time ago.  Like ten or twelve years, I think,
> maybe more.  The only thing I can remember from that experience is that
> after four or five days of compiling absolutely everything multiple
> times, I never did get a system that I could use.  I would think that
> it's a lot better now.
> 
> Thanks very much for your help.  And thanks to everyone else who chipped
> in with advice.
> 
> As Schwarzenegger said, I'll be back.
> 
> Ed

There is another, much more crude, unsanctioned, and possibly deadly fix 
for this. But I used it and I'm not dead yet, nor has Pan crashed or 
behaved psychotically or sent dragons to flash-fry and eat me or anything.

Namely, lie. My primary Pan system is still using Fedora 15 and a 
formidable combination of sloth and inertia prevent me from upgrading it 
to F16, and the gnutls in F15's repos is 2.10.5.

So I changed configure.in line 53 to read: GNUTLS_REQUIRED=2.10.5

...after the git pull but before ./autogen.sh

Heinrich said he had segfaults with earlier gnutls versions, but I 
haven't, through numerous builds including 0.137, and I'm currently using 
Pan 0.138 Der Gerät (GIT bb6d29a git://git.gnome.org/pan2; i686-pc-linux-
gnu).

So I heartily endorse lying about gnutls ;-)