From 275a3856cae3f33ed08cd07edcedcf913503d47f Mon Sep 17 00:00:00 2001 From: Christopher Degawa Date: Mon, 9 May 2022 00:22:11 -0400 Subject: [PATCH] ca-certificate: update to 20211016 and explicitly request .exe p11-kit blacklist-dst-root-ca-x3.patch has been added upstream using .exe explicitly allows for usage through archlinux's pacman through wine. If not, then programs using libcurl such as git will fail due to the .crt files being empty Signed-off-by: Christopher Degawa --- mingw-w64-ca-certificates/PKGBUILD | 13 +++++-------- .../blacklist-dst-root-ca-x3.patch | 7 ------- .../ca-certificates-CLANG32.install | 10 +++++----- .../ca-certificates-CLANG64.install | 10 +++++----- .../ca-certificates-CLANGARM64.install | 10 +++++----- .../ca-certificates-MINGW32.install | 10 +++++----- .../ca-certificates-MINGW64.install | 10 +++++----- .../ca-certificates-UCRT64.install | 10 +++++----- mingw-w64-ca-certificates/update-ca-trust | 10 +++++----- 9 files changed, 40 insertions(+), 50 deletions(-) delete mode 100644 mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch diff --git a/mingw-w64-ca-certificates/PKGBUILD b/mingw-w64-ca-certificates/PKGBUILD index e956fced7f..8ae849f861 100644 --- a/mingw-w64-ca-certificates/PKGBUILD +++ b/mingw-w64-ca-certificates/PKGBUILD @@ -3,7 +3,7 @@ _realname=ca-certificates pkgbase=mingw-w64-${_realname} pkgname="${MINGW_PACKAGE_PREFIX}-${_realname}" -pkgver=20210119 +pkgver=20211016 pkgrel=1 pkgdesc='Common CA certificates (mingw-w64)' arch=('any') @@ -15,19 +15,17 @@ source=("https://ftp.debian.org/debian/pool/main/c/${_realname}/${_realname}_${p 'certdata2pem.py' 'certdata2pem.patch' 'update-ca-trust' - 'update-ca-trust.8' - 'blacklist-dst-root-ca-x3.patch') + 'update-ca-trust.8') depends=("${MINGW_PACKAGE_PREFIX}-p11-kit") makedepends=("${MINGW_PACKAGE_PREFIX}-openssl" "${MINGW_PACKAGE_PREFIX}-p11-kit" "${MINGW_PACKAGE_PREFIX}-python" 'asciidoc' 'libxslt' 'sed' 'grep') -sha256sums=('daa3afae563711c30a0586ddae4336e8e3974c2b627faaca404c4e0141b64665' +sha256sums=('2ae9b6dc5f40c25d6d7fe55e07b54f12a8967d1955d3b7b2f42ee46266eeef88' '9508738b61cc89bfc1f42580b1091a650f0acbf5c1b49edc2aa4e0313276ea0d' '5736cc3a73ff9bceed43bafad85100a2fcfdfae1cf2cb7e201b5fa6f1421fc2e' - '65fc13d01550be7f89046a62605d6203eb68dba7edf5dbb04a2068b4f7cd2e65' - 'b052972dd118a3e25f785b6caa141599f0db6fc1d943e9ebcd6ca0e1f0421f60' - 'ded49e7b1a79f61ac02531b308a0a8cf96ca7476e669af5c29ec6e9d19b25e23') + 'ad9fd7ba5c304521128a0a15f3c3ccd79480d9414de08c93bca8bbb7a942f1b0' + 'b052972dd118a3e25f785b6caa141599f0db6fc1d943e9ebcd6ca0e1f0421f60') prepare() { cd "${srcdir}" @@ -39,7 +37,6 @@ prepare() { cd ${srcdir}/${_realname}-${pkgver} cp ${srcdir}/update-ca-trust sbin/ cp ${srcdir}/update-ca-trust.8 sbin/ - patch -p1 -i ${srcdir}/blacklist-dst-root-ca-x3.patch } build() { diff --git a/mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch b/mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch deleted file mode 100644 index 50198964d6..0000000000 --- a/mingw-w64-ca-certificates/blacklist-dst-root-ca-x3.patch +++ /dev/null @@ -1,7 +0,0 @@ ---- a/mozilla/blacklist.txt 2021-01-19 11:11:04.000000000 +0100 -+++ b/mozilla/blacklist.txt 2021-10-02 11:14:46.449980400 +0200 -@@ -7,3 +7,4 @@ - "MITM subCA 2 issued by Trustwave" - "TURKTRUST Mis-issued Intermediate CA 1" - "TURKTRUST Mis-issued Intermediate CA 2" -+"DST Root CA X3" diff --git a/mingw-w64-ca-certificates/ca-certificates-CLANG32.install b/mingw-w64-ca-certificates/ca-certificates-CLANG32.install index bb0a02d9c1..c647620c00 100644 --- a/mingw-w64-ca-certificates/ca-certificates-CLANG32.install +++ b/mingw-w64-ca-certificates/ca-certificates-CLANG32.install @@ -6,11 +6,11 @@ post_install() { # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) - ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts + ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts mkdir -p ${_mingw_prefix}/ssl/certs cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt diff --git a/mingw-w64-ca-certificates/ca-certificates-CLANG64.install b/mingw-w64-ca-certificates/ca-certificates-CLANG64.install index 1c2ae3cc5d..7cd6f6bc84 100644 --- a/mingw-w64-ca-certificates/ca-certificates-CLANG64.install +++ b/mingw-w64-ca-certificates/ca-certificates-CLANG64.install @@ -6,11 +6,11 @@ post_install() { # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) - ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts + ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts mkdir -p ${_mingw_prefix}/ssl/certs cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt diff --git a/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install b/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install index eef522a02c..4606e33edb 100644 --- a/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install +++ b/mingw-w64-ca-certificates/ca-certificates-CLANGARM64.install @@ -6,11 +6,11 @@ post_install() { # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) - ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts + ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts mkdir -p ${_mingw_prefix}/ssl/certs cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt diff --git a/mingw-w64-ca-certificates/ca-certificates-MINGW32.install b/mingw-w64-ca-certificates/ca-certificates-MINGW32.install index 667e963d7d..7260690d4a 100644 --- a/mingw-w64-ca-certificates/ca-certificates-MINGW32.install +++ b/mingw-w64-ca-certificates/ca-certificates-MINGW32.install @@ -6,11 +6,11 @@ post_install() { # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) - ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts + ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts mkdir -p ${_mingw_prefix}/ssl/certs cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt diff --git a/mingw-w64-ca-certificates/ca-certificates-MINGW64.install b/mingw-w64-ca-certificates/ca-certificates-MINGW64.install index f236ce0b93..c7cd703fe9 100644 --- a/mingw-w64-ca-certificates/ca-certificates-MINGW64.install +++ b/mingw-w64-ca-certificates/ca-certificates-MINGW64.install @@ -6,11 +6,11 @@ post_install() { # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) - ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts + ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts mkdir -p ${_mingw_prefix}/ssl/certs cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt diff --git a/mingw-w64-ca-certificates/ca-certificates-UCRT64.install b/mingw-w64-ca-certificates/ca-certificates-UCRT64.install index 6f2acee515..a9ddae74f0 100644 --- a/mingw-w64-ca-certificates/ca-certificates-UCRT64.install +++ b/mingw-w64-ca-certificates/ca-certificates-UCRT64.install @@ -6,11 +6,11 @@ post_install() { # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) - ${_mingw_prefix}/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem - ${_mingw_prefix}/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts + ${_mingw_prefix}/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem + ${_mingw_prefix}/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts mkdir -p ${_mingw_prefix}/ssl/certs cp -f $DEST/pem/tls-ca-bundle.pem ${_mingw_prefix}/ssl/certs/ca-bundle.crt diff --git a/mingw-w64-ca-certificates/update-ca-trust b/mingw-w64-ca-certificates/update-ca-trust index 1a38da1a71..11d3a8e01a 100644 --- a/mingw-w64-ca-certificates/update-ca-trust +++ b/mingw-w64-ca-certificates/update-ca-trust @@ -11,8 +11,8 @@ DEST=@PREFIX@/etc/pki/ca-trust/extracted # OpenSSL PEM bundle that includes trust flags # (BEGIN TRUSTED CERTIFICATE) -@PREFIX@/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt -@PREFIX@/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem -@PREFIX@/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem -@PREFIX@/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem -@PREFIX@/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts +@PREFIX@/bin/p11-kit.exe extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt +@PREFIX@/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem +@PREFIX@/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem +@PREFIX@/bin/p11-kit.exe extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem +@PREFIX@/bin/p11-kit.exe extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts