Elpher client certificates
--------------------------

Prelude:

I'm tempted to apologize once more for adding yet _another_
Elpher-related post to this phlog.  It's difficult to avoid though, as
this is my main platform for announcing major changes.  I've been
considering using tags or something to split the entries into
elpher/non-elpher categories, so that people not interested in this
seemingly never-ending tirade of Elpher updates can leave early with
their sanity and temper intact.

So, to those people: be warned, this is another of "those" posts.

-=-=-=-=-

In a recent [1,2] *log entry, I lamented being unable to get Elpher to
use client certificates---which are an integral component of the
Gemini protocol---in establishing TLS connections using the native
Emacs network functions.  Several people have subsequently pointed out
that this limitation seems to be lifted by Emacs 27, whenever that
gets released. While encouraging, the Emacs release schedule is a
slow, methodical, and mysterious target of numerologists [3], and thus
it seemed the present situation was likely to remain in place for a
while longer.

On the weekend though, I was fiddling around with the networking code
in an effort to (a) consolidate the network code related to gopher,
gemini and finger into one method, and to (b) solve a handful of minor
bugs relating to conflicts between forcing use of IPv4 and server name
identification (SNI) for TLS connections.  To solve these issues I
wound up needing to switch out the use of the `open-network-stream`
procedure with the lower-level `make-network-process` function, as
this allows directly selecting the IP protocol version and specifying
the host name to use for SNI.  (For anybody interested, previously
forcing IPv4, when requested, was achieved using an ugly hack
involving performing a separate DNS lookup to retrieve the IPv4
address of a server, then using this as the host in the
open-network-stream call.)

On a whim I then decided to try attaching my astrobotany [4] TLS
client certificates to the make-network-process call and connect to
the astrobotany server...

... and bam, I was looking at a dead virtual plant.

I don't think I will ever be as happy to see virtual botanical tragedy
as I was at that moment!

So, with this discovery, Elpher v2.9.0 supports client certificates.
I've tried to make the interface as frictionless as possible, but of
course I'm open to suggestions.  The info manual (installed
automatically when you install Elpher from MELPA) goes through the
gory details of this, but I'll try to quickly summarize here.

* When a Gemini server requests a certificate, Elpher presents a small
  menu in the minibuffer. Pressing "?" presents a description of the
  available options, which are "t" to create and use a "throwaway"
  single-use certificate, "p" to create a permanent (or use an
  existing one), and "a" to abort the connection.

* Certificate creation uses the "openssl" command line program which
  is part of OpenSSL and is probably already installed on your
  machine.  If it's not, you'll need to install it.  If it is
  installed but the command line tool is not in your PATH (whatever
  that means on your system) you can specify the location of the tool
  by customizing the elpher-openssl-command variable.

* Temporary certificates are stored in the system temp directory and
  are deleted when the certificate is "forgotten", as described below.
  
* Permanent certificates are stored in the directory
  `elpher-certificate-directory', which by default is the directory
  "elpher-certificates/" inside the emacs configuration directory.

* When choosing the "p" option to use a permanent certificate,
  choosing a name which does not correspond to an existing certificate
  will cause a new one to be created and added to that directory.

* The prompt for the certificate name autocompletes to existing
  certificates, so just hit TAB to see a list of all available
  certificates (really just the contents of the
  `elpher-certificate-directory' directory.

* Certificates are "forgotten" by pressing "F", or when you try to
  establish a connection to a host other than the one for which the
  certificate was created).

That's pretty much it!  It's the initial release, so there may be some
rough edges.  (One that I already know about but haven't addressed yet
is that the "certificate name" you choose has to be a valid filename -
there's no sanitization yet.)  If you encounter any others please let
me know either by email or via the feedback button on the Elpher
project page.

Remember to water those plants!!

---
[1]: gemini://thelambdalab.xyz/phlog/2020-05-31-Inanity-3:-Virtual-Gardening.txt
[2]: gopher://thelambdalab.xyz/0/phlog/2020-05-31-Inanity-3:-Virtual-Gardening.txt
[3]: https://www.emacswiki.org/emacs/EmacsReleaseDates
[4]: gemini://astrobotany.mozz.us/