ca-certificates rebuild

system/base/ca-certificates/files/ca-certificates-DESTDIR.patch

@@ -0,0 +1,33 @@
+--- a/sbin/update-ca-certificates~	2015-06-29 14:06:06.000000000 +0200
++++ b/sbin/update-ca-certificates	2015-06-29 14:09:30.591543265 +0200
+@@ -24,6 +24,7 @@
+ verbose=0
+ fresh=0
+ default=0
++DESTDIR=
+ CERTSCONF=/etc/ca-certificates.conf
+ CERTSDIR=/usr/share/ca-certificates
+ LOCALCERTSDIR=/etc/certs
+@@ -41,6 +42,8 @@ do
+     --default|-d)
+       default=1
+       fresh=1;;
++    --destdir)
++      DESTDIR=$2; shift;;
+     --certsconf)
+       shift
+       CERTSCONF="$1";;
+@@ -66,6 +69,13 @@ do
+   shift
+ done
+ 
++CERTSCONF=${DESTDIR}${CERTSCONF}
++CERTSDIR=${DESTDIR}${CERTSDIR}
++LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR}
++CERTBUNDLE=${DESTDIR}${CERTBUNDLE}
++ETCCERTSDIR=${DESTDIR}${ETCCERTSDIR}
++HOOKSDIR=${DESTDIR}${HOOKSDIR}
++
+ if [ ! -s "$CERTSCONF" ]
+ then
+   fresh=1

system/base/ca-certificates/files/ca-certificates-etc-certs.patch

@@ -0,0 +1,71 @@
+--- ca-certificates-20140223/sbin/update-ca-certificates~	2014-03-14 12:55:24.000000000 +0200
++++ ca-certificates-20140223/sbin/update-ca-certificates	2014-03-14 14:38:31.587876211 +0200
+@@ -37,7 +37,7 @@
+ 
+ CERTSCONF=/etc/ca-certificates.conf
+ CERTSDIR=/usr/share/ca-certificates
+-LOCALCERTSDIR=/usr/local/share/ca-certificates
+-CERTBUNDLE=ca-certificates.crt
++LOCALCERTSDIR=/etc/certs
++CERTBUNDLE=/etc/certs/ca-certificates.crt
+ ETCCERTSDIR=@openssldir@
+ cd $ETCCERTSDIR
+@@ -52,7 +52,7 @@
+ 
+ # Helper files.  (Some of them are not simple arrays because we spawn
+ # subshells later on.)
+-TEMPBUNDLE="$(mktemp -t "${CERTBUNDLE}.tmp.XXXXXX")"
++TEMPBUNDLE="$(mktemp "${CERTBUNDLE}.tmp.XXXXXX")"
+ ADDED="$(mktemp -t "ca-certificates.tmp.XXXXXX")"
+ REMOVED="$(mktemp -t "ca-certificates.tmp.XXXXXX")"
+ 
+@@ -62,7 +62,7 @@
+ # bundle.
+ add() {
+   CERT="$1"
+-  PEM="$ETCCERTSDIR/$(basename "$CERT" .crt | sed -e 's/ /_/g' \
++  PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed -e 's/.crt$//' -e 's/ /_/g' \
+                                                   -e 's/[()]/=/g' \
+                                                   -e 's/,/_/g').pem"
+   if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
+@@ -74,7 +74,7 @@
+ 
+ remove() {
+   CERT="$1"
+-  PEM="$ETCCERTSDIR/$(basename "$CERT" .crt).pem"
++  PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed 's/.crt$//').pem"
+   if test -L "$PEM"
+   then
+     rm -f "$PEM"
+@@ -111,24 +111,18 @@
+ 
+ sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $CERTSCONF | while read crt
+ do
+-  if ! test -f "$CERTSDIR/$crt"
++  if test -f "$CERTSDIR/$crt"
++   then
++    add "$CERTSDIR/$crt"
++  elif test -f "$LOCALCERTSDIR/$crt"
+   then
+-    echo "W: $CERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
++    add "$LOCALCERTSDIR/$crt"
++  else
++    echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
+     continue
+   fi
+-  add "$CERTSDIR/$crt"
+ done
+ 
+-# Now process certificate authorities installed by the local system
+-# administrator.
+-if [ -d "$LOCALCERTSDIR" ]
+-then
+-  find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read crt
+-  do
+-    add "$crt"
+-  done
+-fi
+-
+ rm -f "$CERTBUNDLE"
+ 
+ ADDED_CNT=$(wc -l < "$ADDED")

system/base/ca-certificates/files/ca-certificates-more-certs.patch

@@ -0,0 +1,56 @@
+--- ca-certificates-20160104/Makefile~	2015-12-20 11:49:23.000000000 +0200
++++ ca-certificates-20160104/Makefile	2016-01-18 14:57:26.210501084 +0200
+@@ -3,7 +3,7 @@
+ #
+ 
+ CERTSDIR = /usr/share/ca-certificates
+-SUBDIRS = mozilla
++SUBDIRS = mozilla certum terena esteid
+ 
+ all:
+ 	for dir in $(SUBDIRS); do \
+--- ca-certificates/certum/Makefile	1970-01-01 01:00:00.000000000 +0100
++++ ca-certificates-more/certum/Makefile	2007-02-02 07:23:19.000000000 +0100
+@@ -0,0 +1,12 @@
++#
++# Makefile
++#
++
++all:
++
++clean:
++
++install:
++	for p in *.crt; do \
++	 install -p -m 644 $$p $(CERTSDIR)/$$p ; \
++	done
+--- ca-certificates/terena/Makefile	1970-01-01 01:00:00.000000000 +0100
++++ ca-certificates-more/terena/Makefile	2007-02-02 07:23:19.000000000 +0100
+@@ -0,0 +1,12 @@
++#
++# Makefile
++#
++
++all:
++
++clean:
++
++install:
++	for p in *.crt; do \
++	 install -p -m 644 $$p $(CERTSDIR)/$$p ; \
++	done
+--- ca-certificates/esteid/Makefile	1970-01-01 01:00:00.000000000 +0100
++++ ca-certificates-more/esteid/Makefile	2007-02-02 07:23:19.000000000 +0100
+@@ -0,0 +1,12 @@
++#
++# Makefile
++#
++
++all:
++
++clean:
++
++install:
++	for p in *.crt; do \
++	 install -p -m 644 $$p $(CERTSDIR)/$$p ; \
++	done

system/base/ca-certificates/files/ca-certificates-undebianize.patch

@@ -0,0 +1,79 @@
+--- ca-certificates-undebianize/sbin/update-ca-certificates	2008-11-01 12:17:37.000000000 +0100
++++ ca-certificates-20090814/sbin/update-ca-certificates	2010-05-05 14:03:33.683398895 +0300
+@@ -28,7 +28,7 @@ CERTSCONF=/etc/ca-certificates.conf
+ CERTSDIR=/usr/share/ca-certificates
+ LOCALCERTSDIR=/usr/local/share/ca-certificates
+ CERTBUNDLE=ca-certificates.crt
+-ETCCERTSDIR=/etc/ssl/certs
++ETCCERTSDIR=@openssldir@
+ HOOKSDIR=/etc/ca-certificates/update.d
+ 
+ while [ $# -gt 0 ];
+@@ -187,19 +187,4 @@ mv -f "$TEMPBUNDLE" "$CERTBUNDLE"
+ 
+ echo "$ADDED_CNT added, $REMOVED_CNT removed; done."
+ 
+-if [ -d "$HOOKSDIR" ]
+-then
+-
+-  echo "Running hooks in $HOOKSDIR..."
+-  VERBOSE_ARG=
+-  [ "$verbose" = 0 ] || VERBOSE_ARG="--verbose"
+-  eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read hook
+-  do
+-    ( cat "$ADDED"
+-      cat "$REMOVED" ) | "$hook" || echo "E: $hook exited with code $?."
+-  done
+-  echo "done."
+-
+-fi
+-
+ # vim:set et sw=2:
+--- ca-certificates-20130610/sbin/update-ca-certificates.8~	2013-06-11 11:32:35.000000000 +0300
++++ ca-certificates-20130610/sbin/update-ca-certificates.8	2013-06-11 11:54:40.662201388 +0300
+@@ -16,7 +16,7 @@
+ .\" .sp <n>    insert n+1 empty lines
+ .\" for manpage-specific macros, see man(7)
+ .SH NAME
+-update-ca-certificates \- update /etc/ssl/certs and ca-certificates.crt
++update-ca-certificates \- update @openssldir@ and ca-certificates.crt
+ .SH SYNOPSIS
+ .B update-ca-certificates
+ .RI [ options ]
+@@ -26,7 +26,7 @@ This manual page documents briefly the
+ command.
+ .PP
+ \fBupdate-ca-certificates\fP is a program that updates the directory
+-/etc/ssl/certs to hold SSL certificates and generates ca-certificates.crt,
++@openssldir@ to hold SSL certificates and generates ca-certificates.crt,
+ a concatenated single-file list of certificates.
+ .PP
+ It reads the file /etc/ca-certificates.conf. Each line gives a pathname of
+@@ -38,11 +38,6 @@
+ .PP
+ Furthermore all certificates with a .crt extension found below
+ /usr/local/share/ca-certificates are also included as implicitly trusted.
+-.PP
+-Before terminating, \fBupdate-ca-certificates\fP invokes
+-\fBrun-parts\fP on /etc/ca-certificates/update.d and calls each hook with
+-a list of certificates: those added are prefixed with a +, those removed are
+-prefixed with a -.
+ .SH OPTIONS
+ A summary of options is included below.
+ .TP
+@@ -53,13 +48,13 @@
+ Be verbose. Output \fBc_rehash\fP.
+ .TP
+ .B \-f, \-\-fresh
+-Fresh updates.  Remove symlinks in /etc/ssl/certs directory.
++Fresh updates.  Remove symlinks in @openssldir@ directory.
+ .SH FILES
+ .TP
+ .I /etc/ca-certificates.conf
+ A configuration file.
+ .TP
+-.I /etc/ssl/certs/ca-certificates.crt
++.I /etc/openssl/ca-certificates.crt
+ A single-file version of CA certificates.  This holds
+ all CA certificates that you activated in /etc/ca-certificates.conf.
+ .TP

system/base/ca-certificates/files/ca-certificates.d.patch

@@ -0,0 +1,67 @@
+--- ca-certificates-20140223/sbin/update-ca-certificates	2014-03-14 14:42:21.171246343 +0200
++++ ca-certificates-20140223/sbin/update-ca-certificates	2014-03-14 14:46:50.556014888 +0200
+@@ -26,6 +26,7 @@ fresh=0
+ default=0
+ DESTDIR=
+ CERTSCONF=/etc/ca-certificates.conf
++CERTSCONFD=/etc/ca-certificates.d
+ CERTSDIR=/usr/share/ca-certificates
+ LOCALCERTSDIR=/etc/certs
+ CERTBUNDLE=/etc/certs/ca-certificates.crt
+@@ -70,6 +71,7 @@ do
+ done
+ 
+ CERTSCONF=${DESTDIR}${CERTSCONF}
++CERTSCONFD=${DESTDIR}${CERTSCONFD}
+ CERTSDIR=${DESTDIR}${CERTSDIR}
+ LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR}
+ CERTBUNDLE=${DESTDIR}${CERTBUNDLE}
+@@ -105,25 +106,30 @@
+ 
+ echo -n "Updating certificates in $ETCCERTSDIR... "
+ 
+-# Handle certificates that should be removed.  This is an explicit act
+-# by prefixing lines in the configuration files with exclamation marks (!).
+-sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read crt
+-do
+-  remove "$CERTSDIR/$crt"
+-done
++for conf in $CERTSCONF $CERTSCONFD/*.conf; do
++  # skip inexistent files (matched by glob)
++  [ -f $conf ] || continue
++
++  # Handle certificates that should be removed.  This is an explicit act
++  # by prefixing lines in the configuration files with exclamation marks (!).
++  sed -n -e '/^$/d' -e 's/^!//p' $conf | while read crt
++  do
++    remove "$CERTSDIR/$crt"
++  done
+ 
+-sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read crt
+-do
+-  if test -f "$CERTSDIR/$crt"
+-   then
+-    add "$CERTSDIR/$crt"
+-  elif test -f "$LOCALCERTSDIR/$crt"
+-  then
+-    add "$LOCALCERTSDIR/$crt"
+-  else
+-    echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
+-    continue
+-  fi
++  sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $conf | while read crt
++  do
++    if test -f "$CERTSDIR/$crt"
++    then
++      add "$CERTSDIR/$crt"
++    elif test -f "$LOCALCERTSDIR/$crt"
++    then
++      add "$LOCALCERTSDIR/$crt"
++    else
++      echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $conf." >&2
++      continue
++    fi
++  done
+ done
+ 
+ rm -f "$CERTBUNDLE"

system/base/ca-certificates/files/no-openssl-rehash.patch

@@ -0,0 +1,14 @@
+--- ca-certificates/sbin/update-ca-certificates~	2018-04-13 22:08:15.000000000 +0200
++++ ca-certificates/sbin/update-ca-certificates	2018-04-13 22:30:21.837942256 +0200
+@@ -185,9 +185,9 @@
+   # only run if set of files has changed
+   if [ "$verbose" = 0 ]
+   then
+-    openssl rehash . > /dev/null
++    c_rehash.sh . > /dev/null
+   else
+-    openssl rehash .
++    c_rehash.sh .
+   fi
+ fi
+ 

system/base/ca-certificates/pspec.xml

@@ -12,6 +12,14 @@
         <Summary>Common CA certificates</Summary>
         <Description>Common CA certificates</Description>
         <Archive sha1sum="edf0ec04b02fcbc90cc65906ff83fb042894a3b7" type="tarxz">http://ftp.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_20180409.tar.xz</Archive>
+        <Patches>
+            <Patch>ca-certificates-undebianize.patch</Patch>
+            <!--Patch>ca-certificates-more-certs.patch</Patch-->
+            <Patch>ca-certificates-etc-certs.patch</Patch>
+            <Patch>ca-certificates-DESTDIR.patch</Patch>
+            <Patch>ca-certificates.d.patch</Patch>
+            <Patch>no-openssl-rehash.patch</Patch>
+        </Patches>
     </Source>
 
     <Package>
@@ -32,7 +40,7 @@
 
     <History>
         <Update release="4">
-            <Date>2018-07-15</Date>
+            <Date>2018-07-20</Date>
             <Version>20180409</Version>
             <Comment>Version Bump</Comment>
             <Name>Ertuğrul Erata</Name>