There I was thinking that students use Linux almost exclusively for its TeX to write papers in...

Thankfully you can either disable the cURL check for TLS certificate or just install manually: https://www.haskell.org/ghcup/install/#manual-installation Cheers, Hécate On 23/02/2023 10:32, Alexis Praga via Haskell-Cafe wrote:

Hi,

Being on Windows being a firewall at work, I cannot use ghcup (a custom SSL certificate is needed).

I settled to stack through scoop : scoop install haskell stack

Alexis

------- Original Message ------- On Thursday, February 23rd, 2023 at 10:23 AM, Dan Dart wrote:

...

There I was thinking that students use Linux almost exclusively for its TeX to write papers in... _______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

_______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

-- Hécate ✨ 🐦: @TechnoEmpress IRC: Hecate WWW: https://glitchbra.in RUN: BSD

And I of course forgot the most relevant part for you: https://www.haskell.org/ghcup/guide/#certificate-authority-errors-curl Hope this can help! Cheers, Hécate On 23/02/2023 11:29, Hécate wrote:

Thankfully you can either disable the cURL check for TLS certificate or just install manually:

https://www.haskell.org/ghcup/install/#manual-installation

Cheers, Hécate

On 23/02/2023 10:32, Alexis Praga via Haskell-Cafe wrote:

...

Hi,

Being on Windows being a firewall at work, I cannot use ghcup (a custom SSL certificate is needed).

I settled to stack through scoop : scoop install haskell stack

Alexis

------- Original Message ------- On Thursday, February 23rd, 2023 at 10:23 AM, Dan Dart wrote:

...

There I was thinking that students use Linux almost exclusively for its TeX to write papers in... _______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

_______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

-- Hécate ✨ 🐦: @TechnoEmpress IRC: Hecate WWW: https://glitchbra.in RUN: BSD

Sigh, I guess since the GHCUp docs have to explicitly call out this situation, it's not unusual. I've also heard rumours in the past that corporate networks can have an.. incomplete? set of root certificates? Does anyone know what the root cause is here? It would be nice if GHCUp just worked. On Thu, 23 Feb 2023 at 12:58, Alexis Praga via Haskell-Cafe < haskell-cafe@haskell.org> wrote:

Thanks. For my use case, the Powershell command below fails to download mysys2 dependncies due to issues with "self-signed certificates". This is why I used scoop in the end.

Just my two cents.

Alexis

------- Original Message ------- On Thursday, February 23rd, 2023 at 11:40 AM, Hécate wrote:

...

And I of course forgot the most relevant part for you: https://www.haskell.org/ghcup/guide/#certificate-authority-errors-curl

Hope this can help!

Cheers, Hécate

On 23/02/2023 11:29, Hécate wrote:

...

Thankfully you can either disable the cURL check for TLS certificate or just install manually:

https://www.haskell.org/ghcup/install/#manual-installation

Cheers, Hécate

On 23/02/2023 10:32, Alexis Praga via Haskell-Cafe wrote:

...

Hi,

Being on Windows being a firewall at work, I cannot use ghcup (a custom SSL certificate is needed).

I settled to stack through scoop : scoop install haskell stack

Alexis

------- Original Message ------- On Thursday, February 23rd, 2023 at 10:23 AM, Dan Dart haskellcafe@dandart.co.uk wrote:

...

There I was thinking that students use Linux almost exclusively for its TeX to write papers in... _______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post. _______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

-- Hécate ✨ 🐦: @TechnoEmpress IRC: Hecate WWW: https://glitchbra.in RUN: BSD

_______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

_______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

On Thu, Feb 23, 2023 at 11:40:21AM +0100, Hécate wrote:

And I of course forgot the most relevant part for you: https://www.haskell.org/ghcup/guide/#certificate-authority-errors-curl

Why not publish the relevant issuer certificate chain, it could even be curated and regularly updated as ghcup "updates". The curl executable has a "--cacert" option allowing the specification of an alternative trust anchor (root CA if you prefer) and any missing intermediate certificates. It also supports a "CURL_CA_BUNDLE" environment variable, if that's simpler. An explicit (securely obtained) trust anchor is safer than ignoring download source authentication. -- Viktor.

On Thu, Feb 23, 2023 at 12:50:40PM -0500, Brandon Allbery wrote:

You're all missing the possibility that the corporate gateway requires a specific certificate so it can inspect traffic (anyone remember https://arstechnica.com/information-technology/2015/02/lenovo-pcs-ship-with-...

In which case, *that* certificate can be configured as trusted by curl, of course it that case it can't be provided by the ghcup team, and needs to obtained locally by the user. -- Viktor.

The curl man page suggests the --cacert or --capath option. https://www.man7.org/linux/man-pages/man1/curl.1.html On Thu, 23 Feb 2023 at 20:00, Alexis Praga via Haskell-Cafe < haskell-cafe@haskell.org> wrote:

I do have such a certificate. Do you have any pointer on how to configure curl to use, especially on windows and for ghcup ?

------- Original Message ------- On Thursday, February 23rd, 2023 at 6:53 PM, Viktor Dukhovni < ietf-dane@dukhovni.org> wrote:

...

On Thu, Feb 23, 2023 at 12:50:40PM -0500, Brandon Allbery wrote:

...

You're all missing the possibility that the corporate gateway requires a specific certificate so it can inspect traffic (anyone remember

https://arstechnica.com/information-technology/2015/02/lenovo-pcs-ship-with-... )?

...

In which case, that certificate can be configured as trusted by curl, of course it that case it can't be provided by the ghcup team, and needs to obtained locally by the user.

-- Viktor. _______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

_______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

Firewall or transparent proxy to spy on you? Certificates are invented to prevent man the middle attacks.. Greete, Branimir.

On 23. 2. 2023., at 10:32, Alexis Praga via Haskell-Cafe wrote:

Hi,

Being on Windows being a firewall at work, I cannot use ghcup (a custom SSL certificate is needed).

I settled to stack through scoop : scoop install haskell stack

Alexis

------- Original Message ------- On Thursday, February 23rd, 2023 at 10:23 AM, Dan Dart wrote:

...

There I was thinking that students use Linux almost exclusively for its TeX to write papers in... _______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.

_______________________________________________ Haskell-Cafe mailing list To (un)subscribe, modify options or view archives go to: http://mail.haskell.org/cgi-bin/mailman/listinfo/haskell-cafe Only members subscribed via the mailman list are allowed to post.