From cccc65a201eb32114f3ae1c1b7fc1444c798f2a6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ertu=C4=9Frul=20Erata?= Date: Fri, 20 Jul 2018 22:41:13 +0300 Subject: [PATCH] ca-certificates rebuild --- .../files/ca-certificates-DESTDIR.patch | 33 ++++++++ .../files/ca-certificates-etc-certs.patch | 71 +++++++++++++++++ .../files/ca-certificates-more-certs.patch | 56 +++++++++++++ .../files/ca-certificates-undebianize.patch | 79 +++++++++++++++++++ .../files/ca-certificates.d.patch | 67 ++++++++++++++++ .../files/no-openssl-rehash.patch | 14 ++++ system/base/ca-certificates/pspec.xml | 10 ++- 7 files changed, 329 insertions(+), 1 deletion(-) create mode 100644 system/base/ca-certificates/files/ca-certificates-DESTDIR.patch create mode 100644 system/base/ca-certificates/files/ca-certificates-etc-certs.patch create mode 100644 system/base/ca-certificates/files/ca-certificates-more-certs.patch create mode 100644 system/base/ca-certificates/files/ca-certificates-undebianize.patch create mode 100644 system/base/ca-certificates/files/ca-certificates.d.patch create mode 100644 system/base/ca-certificates/files/no-openssl-rehash.patch diff --git a/system/base/ca-certificates/files/ca-certificates-DESTDIR.patch b/system/base/ca-certificates/files/ca-certificates-DESTDIR.patch new file mode 100644 index 00000000..07b62088 --- /dev/null +++ b/system/base/ca-certificates/files/ca-certificates-DESTDIR.patch @@ -0,0 +1,33 @@ +--- a/sbin/update-ca-certificates~ 2015-06-29 14:06:06.000000000 +0200 ++++ b/sbin/update-ca-certificates 2015-06-29 14:09:30.591543265 +0200 +@@ -24,6 +24,7 @@ + verbose=0 + fresh=0 + default=0 ++DESTDIR= + CERTSCONF=/etc/ca-certificates.conf + CERTSDIR=/usr/share/ca-certificates + LOCALCERTSDIR=/etc/certs +@@ -41,6 +42,8 @@ do + --default|-d) + default=1 + fresh=1;; ++ --destdir) ++ DESTDIR=$2; shift;; + --certsconf) + shift + CERTSCONF="$1";; +@@ -66,6 +69,13 @@ do + shift + done + ++CERTSCONF=${DESTDIR}${CERTSCONF} ++CERTSDIR=${DESTDIR}${CERTSDIR} ++LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR} ++CERTBUNDLE=${DESTDIR}${CERTBUNDLE} ++ETCCERTSDIR=${DESTDIR}${ETCCERTSDIR} ++HOOKSDIR=${DESTDIR}${HOOKSDIR} ++ + if [ ! -s "$CERTSCONF" ] + then + fresh=1 diff --git a/system/base/ca-certificates/files/ca-certificates-etc-certs.patch b/system/base/ca-certificates/files/ca-certificates-etc-certs.patch new file mode 100644 index 00000000..8d25f7c3 --- /dev/null +++ b/system/base/ca-certificates/files/ca-certificates-etc-certs.patch @@ -0,0 +1,71 @@ +--- ca-certificates-20140223/sbin/update-ca-certificates~ 2014-03-14 12:55:24.000000000 +0200 ++++ ca-certificates-20140223/sbin/update-ca-certificates 2014-03-14 14:38:31.587876211 +0200 +@@ -37,7 +37,7 @@ + + CERTSCONF=/etc/ca-certificates.conf + CERTSDIR=/usr/share/ca-certificates +-LOCALCERTSDIR=/usr/local/share/ca-certificates +-CERTBUNDLE=ca-certificates.crt ++LOCALCERTSDIR=/etc/certs ++CERTBUNDLE=/etc/certs/ca-certificates.crt + ETCCERTSDIR=@openssldir@ + cd $ETCCERTSDIR +@@ -52,7 +52,7 @@ + + # Helper files. (Some of them are not simple arrays because we spawn + # subshells later on.) +-TEMPBUNDLE="$(mktemp -t "${CERTBUNDLE}.tmp.XXXXXX")" ++TEMPBUNDLE="$(mktemp "${CERTBUNDLE}.tmp.XXXXXX")" + ADDED="$(mktemp -t "ca-certificates.tmp.XXXXXX")" + REMOVED="$(mktemp -t "ca-certificates.tmp.XXXXXX")" + +@@ -62,7 +62,7 @@ + # bundle. + add() { + CERT="$1" +- PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \ ++ PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed -e 's/.crt$//' -e 's/ /_/g' \ + -e 's/[()]/=/g' \ + -e 's/,/_/g').pem" + if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ] +@@ -74,7 +74,7 @@ + + remove() { + CERT="$1" +- PEM="$ETCCERTSDIR/$(basename "$CERT" .crt).pem" ++ PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed 's/.crt$//').pem" + if test -L "$PEM" + then + rm -f "$PEM" +@@ -111,24 +111,18 @@ + + sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $CERTSCONF | while read crt + do +- if ! test -f "$CERTSDIR/$crt" ++ if test -f "$CERTSDIR/$crt" ++ then ++ add "$CERTSDIR/$crt" ++ elif test -f "$LOCALCERTSDIR/$crt" + then +- echo "W: $CERTSDIR/$crt not found, but listed in $CERTSCONF." >&2 ++ add "$LOCALCERTSDIR/$crt" ++ else ++ echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2 + continue + fi +- add "$CERTSDIR/$crt" + done + +-# Now process certificate authorities installed by the local system +-# administrator. +-if [ -d "$LOCALCERTSDIR" ] +-then +- find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read crt +- do +- add "$crt" +- done +-fi +- + rm -f "$CERTBUNDLE" + + ADDED_CNT=$(wc -l < "$ADDED") diff --git a/system/base/ca-certificates/files/ca-certificates-more-certs.patch b/system/base/ca-certificates/files/ca-certificates-more-certs.patch new file mode 100644 index 00000000..3338fc68 --- /dev/null +++ b/system/base/ca-certificates/files/ca-certificates-more-certs.patch @@ -0,0 +1,56 @@ +--- ca-certificates-20160104/Makefile~ 2015-12-20 11:49:23.000000000 +0200 ++++ ca-certificates-20160104/Makefile 2016-01-18 14:57:26.210501084 +0200 +@@ -3,7 +3,7 @@ + # + + CERTSDIR = /usr/share/ca-certificates +-SUBDIRS = mozilla ++SUBDIRS = mozilla certum terena esteid + + all: + for dir in $(SUBDIRS); do \ +--- ca-certificates/certum/Makefile 1970-01-01 01:00:00.000000000 +0100 ++++ ca-certificates-more/certum/Makefile 2007-02-02 07:23:19.000000000 +0100 +@@ -0,0 +1,12 @@ ++# ++# Makefile ++# ++ ++all: ++ ++clean: ++ ++install: ++ for p in *.crt; do \ ++ install -p -m 644 $$p $(CERTSDIR)/$$p ; \ ++ done +--- ca-certificates/terena/Makefile 1970-01-01 01:00:00.000000000 +0100 ++++ ca-certificates-more/terena/Makefile 2007-02-02 07:23:19.000000000 +0100 +@@ -0,0 +1,12 @@ ++# ++# Makefile ++# ++ ++all: ++ ++clean: ++ ++install: ++ for p in *.crt; do \ ++ install -p -m 644 $$p $(CERTSDIR)/$$p ; \ ++ done +--- ca-certificates/esteid/Makefile 1970-01-01 01:00:00.000000000 +0100 ++++ ca-certificates-more/esteid/Makefile 2007-02-02 07:23:19.000000000 +0100 +@@ -0,0 +1,12 @@ ++# ++# Makefile ++# ++ ++all: ++ ++clean: ++ ++install: ++ for p in *.crt; do \ ++ install -p -m 644 $$p $(CERTSDIR)/$$p ; \ ++ done diff --git a/system/base/ca-certificates/files/ca-certificates-undebianize.patch b/system/base/ca-certificates/files/ca-certificates-undebianize.patch new file mode 100644 index 00000000..125661e6 --- /dev/null +++ b/system/base/ca-certificates/files/ca-certificates-undebianize.patch @@ -0,0 +1,79 @@ +--- ca-certificates-undebianize/sbin/update-ca-certificates 2008-11-01 12:17:37.000000000 +0100 ++++ ca-certificates-20090814/sbin/update-ca-certificates 2010-05-05 14:03:33.683398895 +0300 +@@ -28,7 +28,7 @@ CERTSCONF=/etc/ca-certificates.conf + CERTSDIR=/usr/share/ca-certificates + LOCALCERTSDIR=/usr/local/share/ca-certificates + CERTBUNDLE=ca-certificates.crt +-ETCCERTSDIR=/etc/ssl/certs ++ETCCERTSDIR=@openssldir@ + HOOKSDIR=/etc/ca-certificates/update.d + + while [ $# -gt 0 ]; +@@ -187,19 +187,4 @@ mv -f "$TEMPBUNDLE" "$CERTBUNDLE" + + echo "$ADDED_CNT added, $REMOVED_CNT removed; done." + +-if [ -d "$HOOKSDIR" ] +-then +- +- echo "Running hooks in $HOOKSDIR..." +- VERBOSE_ARG= +- [ "$verbose" = 0 ] || VERBOSE_ARG="--verbose" +- eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read hook +- do +- ( cat "$ADDED" +- cat "$REMOVED" ) | "$hook" || echo "E: $hook exited with code $?." +- done +- echo "done." +- +-fi +- + # vim:set et sw=2: +--- ca-certificates-20130610/sbin/update-ca-certificates.8~ 2013-06-11 11:32:35.000000000 +0300 ++++ ca-certificates-20130610/sbin/update-ca-certificates.8 2013-06-11 11:54:40.662201388 +0300 +@@ -16,7 +16,7 @@ + .\" .sp insert n+1 empty lines + .\" for manpage-specific macros, see man(7) + .SH NAME +-update-ca-certificates \- update /etc/ssl/certs and ca-certificates.crt ++update-ca-certificates \- update @openssldir@ and ca-certificates.crt + .SH SYNOPSIS + .B update-ca-certificates + .RI [ options ] +@@ -26,7 +26,7 @@ This manual page documents briefly the + command. + .PP + \fBupdate-ca-certificates\fP is a program that updates the directory +-/etc/ssl/certs to hold SSL certificates and generates ca-certificates.crt, ++@openssldir@ to hold SSL certificates and generates ca-certificates.crt, + a concatenated single-file list of certificates. + .PP + It reads the file /etc/ca-certificates.conf. Each line gives a pathname of +@@ -38,11 +38,6 @@ + .PP + Furthermore all certificates with a .crt extension found below + /usr/local/share/ca-certificates are also included as implicitly trusted. +-.PP +-Before terminating, \fBupdate-ca-certificates\fP invokes +-\fBrun-parts\fP on /etc/ca-certificates/update.d and calls each hook with +-a list of certificates: those added are prefixed with a +, those removed are +-prefixed with a -. + .SH OPTIONS + A summary of options is included below. + .TP +@@ -53,13 +48,13 @@ + Be verbose. Output \fBc_rehash\fP. + .TP + .B \-f, \-\-fresh +-Fresh updates. Remove symlinks in /etc/ssl/certs directory. ++Fresh updates. Remove symlinks in @openssldir@ directory. + .SH FILES + .TP + .I /etc/ca-certificates.conf + A configuration file. + .TP +-.I /etc/ssl/certs/ca-certificates.crt ++.I /etc/openssl/ca-certificates.crt + A single-file version of CA certificates. This holds + all CA certificates that you activated in /etc/ca-certificates.conf. + .TP diff --git a/system/base/ca-certificates/files/ca-certificates.d.patch b/system/base/ca-certificates/files/ca-certificates.d.patch new file mode 100644 index 00000000..c8b9d3af --- /dev/null +++ b/system/base/ca-certificates/files/ca-certificates.d.patch @@ -0,0 +1,67 @@ +--- ca-certificates-20140223/sbin/update-ca-certificates 2014-03-14 14:42:21.171246343 +0200 ++++ ca-certificates-20140223/sbin/update-ca-certificates 2014-03-14 14:46:50.556014888 +0200 +@@ -26,6 +26,7 @@ fresh=0 + default=0 + DESTDIR= + CERTSCONF=/etc/ca-certificates.conf ++CERTSCONFD=/etc/ca-certificates.d + CERTSDIR=/usr/share/ca-certificates + LOCALCERTSDIR=/etc/certs + CERTBUNDLE=/etc/certs/ca-certificates.crt +@@ -70,6 +71,7 @@ do + done + + CERTSCONF=${DESTDIR}${CERTSCONF} ++CERTSCONFD=${DESTDIR}${CERTSCONFD} + CERTSDIR=${DESTDIR}${CERTSDIR} + LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR} + CERTBUNDLE=${DESTDIR}${CERTBUNDLE} +@@ -105,25 +106,30 @@ + + echo -n "Updating certificates in $ETCCERTSDIR... " + +-# Handle certificates that should be removed. This is an explicit act +-# by prefixing lines in the configuration files with exclamation marks (!). +-sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read crt +-do +- remove "$CERTSDIR/$crt" +-done ++for conf in $CERTSCONF $CERTSCONFD/*.conf; do ++ # skip inexistent files (matched by glob) ++ [ -f $conf ] || continue ++ ++ # Handle certificates that should be removed. This is an explicit act ++ # by prefixing lines in the configuration files with exclamation marks (!). ++ sed -n -e '/^$/d' -e 's/^!//p' $conf | while read crt ++ do ++ remove "$CERTSDIR/$crt" ++ done + +-sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read crt +-do +- if test -f "$CERTSDIR/$crt" +- then +- add "$CERTSDIR/$crt" +- elif test -f "$LOCALCERTSDIR/$crt" +- then +- add "$LOCALCERTSDIR/$crt" +- else +- echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2 +- continue +- fi ++ sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $conf | while read crt ++ do ++ if test -f "$CERTSDIR/$crt" ++ then ++ add "$CERTSDIR/$crt" ++ elif test -f "$LOCALCERTSDIR/$crt" ++ then ++ add "$LOCALCERTSDIR/$crt" ++ else ++ echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $conf." >&2 ++ continue ++ fi ++ done + done + + rm -f "$CERTBUNDLE" diff --git a/system/base/ca-certificates/files/no-openssl-rehash.patch b/system/base/ca-certificates/files/no-openssl-rehash.patch new file mode 100644 index 00000000..bdd965b9 --- /dev/null +++ b/system/base/ca-certificates/files/no-openssl-rehash.patch @@ -0,0 +1,14 @@ +--- ca-certificates/sbin/update-ca-certificates~ 2018-04-13 22:08:15.000000000 +0200 ++++ ca-certificates/sbin/update-ca-certificates 2018-04-13 22:30:21.837942256 +0200 +@@ -185,9 +185,9 @@ + # only run if set of files has changed + if [ "$verbose" = 0 ] + then +- openssl rehash . > /dev/null ++ c_rehash.sh . > /dev/null + else +- openssl rehash . ++ c_rehash.sh . + fi + fi + diff --git a/system/base/ca-certificates/pspec.xml b/system/base/ca-certificates/pspec.xml index 52b17f0a..3d6ceaec 100644 --- a/system/base/ca-certificates/pspec.xml +++ b/system/base/ca-certificates/pspec.xml @@ -12,6 +12,14 @@ Common CA certificates Common CA certificates http://ftp.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_20180409.tar.xz + + ca-certificates-undebianize.patch + + ca-certificates-etc-certs.patch + ca-certificates-DESTDIR.patch + ca-certificates.d.patch + no-openssl-rehash.patch + @@ -32,7 +40,7 @@ - 2018-07-15 + 2018-07-20 20180409 Version Bump Ertuğrul Erata