Created attachment 279351 [details] [review]
[WIP] Add tls-ca-path

Untested.

Created attachment 279407 [details] [review]
core: add "tls-ca-path" option

Some organizations will want to use private Certificate Authorities to
serve content to their clients.  While it's possible to add the CA
to the system-wide CA store, that has two drawbacks:

1) Compromise of that cert means it can be used for other web traffic
2) All of ca-certificates is trusted

This patch allows a much stronger scenario where *only* the CAs in
tls-ca-path are used for verification from the given repository.

Review of attachment 279407 [details] [review]:

::: src/libostree/ostree-fetcher.c
@@ +242,3 @@
+  g_object_set ((GObject*)self->session, "ssl-use-system-ca-file", use_system, NULL);
+  if (db)
+    g_object_set ((GObject*)self->session, "tls-database", db, NULL);

setting tls-database to something other than the default db automatically sets ssl-use-system-ca-file false, so you could instead just do

  if (db)
    g_object_set ((GObject*)self->session, "tls-database", db, NULL);
  else
    g_object_set ((GObject*)self->session, "ssl-use-system-ca-file", TRUE);

but either way, looks right

Updated to use suggested code, thanks!

Created attachment 279674 [details] [review]
pull: Only set ca path if we actually have a setting for it

Otherwise, GTlsFileDatabase ends up accepting NULL for anchors, and
then we don't trust any CAs at all.

Reopened for regression.

Got review by James on IRC.

Attachment 279674 [details] pushed as 772409e - pull: Only set ca path if we actually have a setting for it