CA pinning for DNF (sslcacert is ignored)

Sat Aug 23 15:53:22 UTC 2014

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

> since it has been suggested that I should file bug [1] (CA pinning 
> for mirrors.fedoraproject.org for yum) also against yum's
> successor dnf [2], I'm wondering if sslcacert is also understood by
> dnf?
> 
> from the man page of dnf.conf: "DNF  by  default uses the global 
> configuration file at /etc/dnf/dnf.conf and all *.repo files found 
> under /etc/yum.repos.d."
> 
> That tells me that dnf parses the same repo files as dnf, but
> there is no 'sslcacert' option in dnf.conf 's man page. So I'm
> wondering whether just the man page is not complete or dnf has no
> such option (yet)?

dnf ignores sslcacert option in repo files (implementation matches
documentation).

Anyone know how to do CA pinning when using dnf instead of yum?
or: Are we about to loose that feature? and we need a feature request
for dnf?