fetchurl: revert enabling TLS verification when NIX_SSL_CERT_FILE

[LeSuisse]

This reverts commit f829274.

It seems to cause issues #351312. This is still something we should do but I do not have a reproducer right now nor the available time to troubleshot this quickly.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[emilazy]

FWIW (I didn’t see the initial PR), the use of builtins.getEnv here meant that it would break depending on whether or not you were using flakes, since accessing environment variables is forbidden in pure evaluation mode, and I believe that applies even if it’s getting passed through to the builders. Probably needs a slightly different approach when we do this again (which I support).

[emilazy]

For bootstrap, I suspect we may need to bundle cacert in the bootstrap tools, which might not be so bad.

[LeSuisse]

FWIW (I didn’t see the initial PR), the use of builtins.getEnv here meant that it would break depending on whether or not you were using flakes, since accessing environment variables is forbidden in pure evaluation mode, and I believe that applies even if it’s getting passed through to the builders. Probably needs a slightly different approach when we do this again (which I support).

Yup but I wanted to limit the chances of breaking something and start by supporting NIX_SSL_CERT_FILE like it is the case in some other fetchers. It is still an improvement on some situations (and NIX_SSL_CERT_FILE is in impureEnvVars) and it allows us to start identifying some issues.

Anyway the curl: (77) error setting certificate file error is surprising to me when it is set to the cacert CA bundle path, I will reproduce so I can troubleshot it.