Pisilinux/core
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ca-certificates rebuild

Browse Source
This commit is contained in:
Ertuğrul Erata
2018-07-20 22:41:13 +03:00
parent e5c4308f1b
commit cccc65a201
7 changed files with 329 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/base/ca-certificates/files/ca-certificates-DESTDIR.patch
+33
View File
@@ -0,0 +1,33 @@
--- a/sbin/update-ca-certificates~ 2015-06-29 14:06:06.000000000 +0200
+++ b/sbin/update-ca-certificates 2015-06-29 14:09:30.591543265 +0200
@@ -24,6 +24,7 @@
verbose=0
fresh=0
default=0
+DESTDIR=
CERTSCONF=/etc/ca-certificates.conf
CERTSDIR=/usr/share/ca-certificates
LOCALCERTSDIR=/etc/certs
@@ -41,6 +42,8 @@ do
--default|-d)
default=1
fresh=1;;
+ --destdir)
+ DESTDIR=$2; shift;;
--certsconf)
shift
CERTSCONF="$1";;
@@ -66,6 +69,13 @@ do
shift
done
+CERTSCONF=${DESTDIR}${CERTSCONF}
+CERTSDIR=${DESTDIR}${CERTSDIR}
+LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR}
+CERTBUNDLE=${DESTDIR}${CERTBUNDLE}
+ETCCERTSDIR=${DESTDIR}${ETCCERTSDIR}
+HOOKSDIR=${DESTDIR}${HOOKSDIR}
+
if [ ! -s "$CERTSCONF" ]
then
fresh=1
system/base/ca-certificates/files/ca-certificates-etc-certs.patch
+71
View File
@@ -0,0 +1,71 @@
--- ca-certificates-20140223/sbin/update-ca-certificates~ 2014-03-14 12:55:24.000000000 +0200
+++ ca-certificates-20140223/sbin/update-ca-certificates 2014-03-14 14:38:31.587876211 +0200
@@ -37,7 +37,7 @@
CERTSCONF=/etc/ca-certificates.conf
CERTSDIR=/usr/share/ca-certificates
-LOCALCERTSDIR=/usr/local/share/ca-certificates
-CERTBUNDLE=ca-certificates.crt
+LOCALCERTSDIR=/etc/certs
+CERTBUNDLE=/etc/certs/ca-certificates.crt
ETCCERTSDIR=@openssldir@
cd $ETCCERTSDIR
@@ -52,7 +52,7 @@
# Helper files. (Some of them are not simple arrays because we spawn
# subshells later on.)
-TEMPBUNDLE="$(mktemp -t "${CERTBUNDLE}.tmp.XXXXXX")"
+TEMPBUNDLE="$(mktemp "${CERTBUNDLE}.tmp.XXXXXX")"
ADDED="$(mktemp -t "ca-certificates.tmp.XXXXXX")"
REMOVED="$(mktemp -t "ca-certificates.tmp.XXXXXX")"
@@ -62,7 +62,7 @@
# bundle.
add() {
CERT="$1"
- PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \
+ PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed -e 's/.crt$//' -e 's/ /_/g' \
-e 's/[()]/=/g' \
-e 's/,/_/g').pem"
if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
@@ -74,7 +74,7 @@
remove() {
CERT="$1"
- PEM="$ETCCERTSDIR/$(basename "$CERT" .crt).pem"
+ PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed 's/.crt$//').pem"
if test -L "$PEM"
then
rm -f "$PEM"
@@ -111,24 +111,18 @@
sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $CERTSCONF | while read crt
do
- if ! test -f "$CERTSDIR/$crt"
+ if test -f "$CERTSDIR/$crt"
+ then
+ add "$CERTSDIR/$crt"
+ elif test -f "$LOCALCERTSDIR/$crt"
then
- echo "W: $CERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
+ add "$LOCALCERTSDIR/$crt"
+ else
+ echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
continue
fi
- add "$CERTSDIR/$crt"
done
-# Now process certificate authorities installed by the local system
-# administrator.
-if [ -d "$LOCALCERTSDIR" ]
-then
- find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read crt
- do
- add "$crt"
- done
-fi
-
rm -f "$CERTBUNDLE"
ADDED_CNT=$(wc -l < "$ADDED")
system/base/ca-certificates/files/ca-certificates-more-certs.patch
+56
View File
@@ -0,0 +1,56 @@
--- ca-certificates-20160104/Makefile~ 2015-12-20 11:49:23.000000000 +0200
+++ ca-certificates-20160104/Makefile 2016-01-18 14:57:26.210501084 +0200
@@ -3,7 +3,7 @@
#
CERTSDIR = /usr/share/ca-certificates
-SUBDIRS = mozilla
+SUBDIRS = mozilla certum terena esteid
all:
for dir in $(SUBDIRS); do \
--- ca-certificates/certum/Makefile 1970-01-01 01:00:00.000000000 +0100
+++ ca-certificates-more/certum/Makefile 2007-02-02 07:23:19.000000000 +0100
@@ -0,0 +1,12 @@
+#
+# Makefile
+#
+
+all:
+
+clean:
+
+install:
+ for p in *.crt; do \
+ install -p -m 644 $$p $(CERTSDIR)/$$p ; \
+ done
--- ca-certificates/terena/Makefile 1970-01-01 01:00:00.000000000 +0100
+++ ca-certificates-more/terena/Makefile 2007-02-02 07:23:19.000000000 +0100
@@ -0,0 +1,12 @@
+#
+# Makefile
+#
+
+all:
+
+clean:
+
+install:
+ for p in *.crt; do \
+ install -p -m 644 $$p $(CERTSDIR)/$$p ; \
+ done
--- ca-certificates/esteid/Makefile 1970-01-01 01:00:00.000000000 +0100
+++ ca-certificates-more/esteid/Makefile 2007-02-02 07:23:19.000000000 +0100
@@ -0,0 +1,12 @@
+#
+# Makefile
+#
+
+all:
+
+clean:
+
+install:
+ for p in *.crt; do \
+ install -p -m 644 $$p $(CERTSDIR)/$$p ; \
+ done
system/base/ca-certificates/files/ca-certificates-undebianize.patch
+79
View File
@@ -0,0 +1,79 @@
--- ca-certificates-undebianize/sbin/update-ca-certificates 2008-11-01 12:17:37.000000000 +0100
+++ ca-certificates-20090814/sbin/update-ca-certificates 2010-05-05 14:03:33.683398895 +0300
@@ -28,7 +28,7 @@ CERTSCONF=/etc/ca-certificates.conf
CERTSDIR=/usr/share/ca-certificates
LOCALCERTSDIR=/usr/local/share/ca-certificates
CERTBUNDLE=ca-certificates.crt
-ETCCERTSDIR=/etc/ssl/certs
+ETCCERTSDIR=@openssldir@
HOOKSDIR=/etc/ca-certificates/update.d
while [ $# -gt 0 ];
@@ -187,19 +187,4 @@ mv -f "$TEMPBUNDLE" "$CERTBUNDLE"
echo "$ADDED_CNT added, $REMOVED_CNT removed; done."
-if [ -d "$HOOKSDIR" ]
-then
-
- echo "Running hooks in $HOOKSDIR..."
- VERBOSE_ARG=
- [ "$verbose" = 0 ] || VERBOSE_ARG="--verbose"
- eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read hook
- do
- ( cat "$ADDED"
- cat "$REMOVED" ) | "$hook" || echo "E: $hook exited with code $?."
- done
- echo "done."
-
-fi
-
# vim:set et sw=2:
--- ca-certificates-20130610/sbin/update-ca-certificates.8~ 2013-06-11 11:32:35.000000000 +0300
+++ ca-certificates-20130610/sbin/update-ca-certificates.8 2013-06-11 11:54:40.662201388 +0300
@@ -16,7 +16,7 @@
.\" .sp <n> insert n+1 empty lines
.\" for manpage-specific macros, see man(7)
.SH NAME
-update-ca-certificates \- update /etc/ssl/certs and ca-certificates.crt
+update-ca-certificates \- update @openssldir@ and ca-certificates.crt
.SH SYNOPSIS
.B update-ca-certificates
.RI [ options ]
@@ -26,7 +26,7 @@ This manual page documents briefly the
command.
.PP
\fBupdate-ca-certificates\fP is a program that updates the directory
-/etc/ssl/certs to hold SSL certificates and generates ca-certificates.crt,
+@openssldir@ to hold SSL certificates and generates ca-certificates.crt,
a concatenated single-file list of certificates.
.PP
It reads the file /etc/ca-certificates.conf. Each line gives a pathname of
@@ -38,11 +38,6 @@
.PP
Furthermore all certificates with a .crt extension found below
/usr/local/share/ca-certificates are also included as implicitly trusted.
-.PP
-Before terminating, \fBupdate-ca-certificates\fP invokes
-\fBrun-parts\fP on /etc/ca-certificates/update.d and calls each hook with
-a list of certificates: those added are prefixed with a +, those removed are
-prefixed with a -.
.SH OPTIONS
A summary of options is included below.
.TP
@@ -53,13 +48,13 @@
Be verbose. Output \fBc_rehash\fP.
.TP
.B \-f, \-\-fresh
-Fresh updates. Remove symlinks in /etc/ssl/certs directory.
+Fresh updates. Remove symlinks in @openssldir@ directory.
.SH FILES
.TP
.I /etc/ca-certificates.conf
A configuration file.
.TP
-.I /etc/ssl/certs/ca-certificates.crt
+.I /etc/openssl/ca-certificates.crt
A single-file version of CA certificates. This holds
all CA certificates that you activated in /etc/ca-certificates.conf.
.TP
system/base/ca-certificates/files/ca-certificates.d.patch
+67
View File
@@ -0,0 +1,67 @@
--- ca-certificates-20140223/sbin/update-ca-certificates 2014-03-14 14:42:21.171246343 +0200
+++ ca-certificates-20140223/sbin/update-ca-certificates 2014-03-14 14:46:50.556014888 +0200
@@ -26,6 +26,7 @@ fresh=0
default=0
DESTDIR=
CERTSCONF=/etc/ca-certificates.conf
+CERTSCONFD=/etc/ca-certificates.d
CERTSDIR=/usr/share/ca-certificates
LOCALCERTSDIR=/etc/certs
CERTBUNDLE=/etc/certs/ca-certificates.crt
@@ -70,6 +71,7 @@ do
done
CERTSCONF=${DESTDIR}${CERTSCONF}
+CERTSCONFD=${DESTDIR}${CERTSCONFD}
CERTSDIR=${DESTDIR}${CERTSDIR}
LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR}
CERTBUNDLE=${DESTDIR}${CERTBUNDLE}
@@ -105,25 +106,30 @@
echo -n "Updating certificates in $ETCCERTSDIR... "
-# Handle certificates that should be removed. This is an explicit act
-# by prefixing lines in the configuration files with exclamation marks (!).
-sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read crt
-do
- remove "$CERTSDIR/$crt"
-done
+for conf in $CERTSCONF $CERTSCONFD/*.conf; do
+ # skip inexistent files (matched by glob)
+ [ -f $conf ] || continue
+
+ # Handle certificates that should be removed. This is an explicit act
+ # by prefixing lines in the configuration files with exclamation marks (!).
+ sed -n -e '/^$/d' -e 's/^!//p' $conf | while read crt
+ do
+ remove "$CERTSDIR/$crt"
+ done
-sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read crt
-do
- if test -f "$CERTSDIR/$crt"
- then
- add "$CERTSDIR/$crt"
- elif test -f "$LOCALCERTSDIR/$crt"
- then
- add "$LOCALCERTSDIR/$crt"
- else
- echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
- continue
- fi
+ sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $conf | while read crt
+ do
+ if test -f "$CERTSDIR/$crt"
+ then
+ add "$CERTSDIR/$crt"
+ elif test -f "$LOCALCERTSDIR/$crt"
+ then
+ add "$LOCALCERTSDIR/$crt"
+ else
+ echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $conf." >&2
+ continue
+ fi
+ done
done
rm -f "$CERTBUNDLE"
system/base/ca-certificates/files/no-openssl-rehash.patch
+14
View File
@@ -0,0 +1,14 @@
--- ca-certificates/sbin/update-ca-certificates~ 2018-04-13 22:08:15.000000000 +0200
+++ ca-certificates/sbin/update-ca-certificates 2018-04-13 22:30:21.837942256 +0200
@@ -185,9 +185,9 @@
# only run if set of files has changed
if [ "$verbose" = 0 ]
then
- openssl rehash . > /dev/null
+ c_rehash.sh . > /dev/null
else
- openssl rehash .
+ c_rehash.sh .
fi
fi
system/base/ca-certificates/pspec.xml
+9 -1
View File
@@ -12,6 +12,14 @@
<Summary>Common CA certificates</Summary>
<Description>Common CA certificates</Description>
<Archive sha1sum="edf0ec04b02fcbc90cc65906ff83fb042894a3b7" type="tarxz">http://ftp.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_20180409.tar.xz</Archive>
<Patches>
<Patch>ca-certificates-undebianize.patch</Patch>
<!--Patch>ca-certificates-more-certs.patch</Patch-->
<Patch>ca-certificates-etc-certs.patch</Patch>
<Patch>ca-certificates-DESTDIR.patch</Patch>
<Patch>ca-certificates.d.patch</Patch>
<Patch>no-openssl-rehash.patch</Patch>
</Patches>
</Source>
<Package>
@@ -32,7 +40,7 @@
<History>
<Update release="4">
<Date>2018-07-15</Date>
<Date>2018-07-20</Date>
<Version>20180409</Version>
<Comment>Version Bump</Comment>
<Name>Ertuğrul Erata</Name>