Befator-Inc-Firmen-Netzwerk/MSYS2-packages
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

ca-certificates: Install root certificates. Add changes from fedora packages.

Browse Source
This commit is contained in:
Alexpux
2015-02-14 00:42:15 +03:00
parent c85732fd58
commit 022f3879ad
3 changed files with 1947 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
ca-certificates/PKGBUILD
View File

@@ -2,13 +2,16 @@
pkgname=ca-certificates
pkgver=20141019
pkgrel=1
pkgrel=2
pkgdesc='Common CA certificates'
arch=('any')
url='http://www.mozilla.org/projects/security/certs/'
license=('MPL' 'GPL')
source=("http://ftp.debian.org/debian/pool/main/c/${pkgname}/${pkgname}_${pkgver}.tar.xz"
'CAcert.org_root.crt::http://www.cacert.org/certs/root.crt'
'CAcert.org_class3.crt::http://www.cacert.org/certs/class3.crt'
'certdata2pem-redhat.patch'
'diff-from-upstream-2.2.patch'
'trust-fixes'
'update-ca-trust'
'update-ca-trust.8')
@@ -16,7 +19,10 @@ depends=('bash' 'openssl' 'findutils' 'coreutils' 'sed' 'p11-kit')
makedepends=('asciidoc' 'python2' 'libxslt' 'sed' 'grep')
install='ca-certificates.install'
sha256sums=('684902d3f4e9ad27829f4af0d9d2d588afed03667997579b9c2be86fcd1eb73a'
'87bab93ca70a8517d84ce4680d77c51108e37b69e9be0edc49c9872b36f9e47b'
'c0e0773a79dceb622ef6410577c19c1e177fb2eb9c623a49340de3c9f1de2560'
'f5badaa5da1cc05b110a9492455a2c2790d00c7175dcf3a7bcb5441af71bf84f'
'4b44df3a92438555e347f74a2b2da3670eaae3c38b349308fff5fb6b80b938aa'
'ac5fb6d6ecd77668a4fff8a90ec35e719d39eaf456a89c8edc219d5d21b35fcf'
'eeebba0de2635ba4115c05b2acc95d475d47aa58796bb0868203805212f50381'
'75ef2f4b0fddd2ca3c69b234a6abb66fd732e4af96814b65dcedb0dd52018381'
'a73c6430e734178b9aa4d303709470383bc2b1cfbeb0d44fe34615df812f479d')
@@ -27,13 +33,15 @@ prepare() {
cp ${srcdir}/update-ca-trust sbin/
cp ${srcdir}/update-ca-trust.8 sbin/
patch -p1 -i ${srcdir}/certdata2pem-redhat.patch
patch -p1 -i ${srcdir}/diff-from-upstream-2.2.patch
sed "s|/usr/bin/python|/usr/bin/python2|g" -i mozilla/certdata2pem.py
}
build() {
cd ${srcdir}/${pkgname}-${pkgver}/mozilla
mkdir -p legacy-{enable,disable}
/usr/bin/python2 certdata2pem.py
(
cat <<EOF
# This is a bundle of X.509 certificates of public Certificate
@@ -89,23 +97,63 @@ EOF
openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.trust.crt
else
echo "no trust flags for $f" >> tee -a info.notrust
openssl x509 -text -in "$f" -setalias "$alias" >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.neutral-trust.crt
# p11-kit-trust defines empty trust lists as "rejected for all purposes".
# That's why we use the simple file format
# (BEGIN CERTIFICATE, no trust information)
# because p11-kit-trust will treat it as a certificate with neutral trust.
# This means we cannot use the -setalias feature for neutral trust certs.
openssl x509 -text -in "$f" >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.neutral-trust.crt
fi
done
for p in *.p11-kit
do
cat $p >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.supplement.p11-kit
for f in legacy-enable/*.crt; do
echo "processing $f"
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
targs=""
if [ -n "$tbits" ]; then
for t in $tbits; do
targs="${targs} -addtrust $t"
done
fi
if [ -n "$targs" ]; then
echo "legacy enable flags $targs for $f" >> info.trust
openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.legacy.enable.crt
fi
done
for f in legacy-disable/*.crt; do
echo "processing $f"
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
targs=""
if [ -n "$tbits" ]; then
for t in $tbits; do
targs="${targs} -addtrust $t"
done
fi
if [ -n "$targs" ]; then
echo "legacy disable flags $targs for $f" >> info.trust
openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.legacy.disable.crt
fi
done
local P11FILES=`find . -name *.p11-kit | wc -l`
if [ $P11FILES -ne 0 ]; then
for p in *.p11-kit; do
cat "$p" >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.supplement.p11-kit
done
fi
cat trust-fixes >> ${srcdir}/${pkgname}-${pkgver}/ca-bundle.supplement.p11-kit
}
package() {
cd ${srcdir}/${pkgname}-${pkgver}
mkdir -p ${pkgdir}/usr/{bin,lib,share}
mkdir -p ${pkgdir}/etc
mkdir -p ${pkgdir}/usr/share/man/man8
cp -f sbin/update-ca-trust ${pkgdir}/usr/bin/
cp -f sbin/update-ca-trust.8 ${pkgdir}/usr/share/man/man8/
@@ -114,13 +162,13 @@ package() {
cp -f sbin/update-ca-trust ${pkgdir}/usr/lib/p11-kit/p11-kit-extract-trust
mkdir -p ${pkgdir}/usr/share/pki/ca-trust-source
for file in ca-bundle.{trust.crt,neutral-trust.crt,supplement.p11-kit}
for file in ca-bundle.{trust.crt,neutral-trust.crt,supplement.p11-kit,legacy.enable.crt,legacy.disable.crt}
do
cp -f $file ${pkgdir}/usr/share/pki/ca-trust-source
done
# touch all files overwritten by update-ca-trust for easy cleanup
mkdir -p ${pkgdir}/etc/pki/ca-trust/{extracted,source}
mkdir -p ${pkgdir}/etc/pki/ca-trust/{extracted,legacy,source}
mkdir -p ${pkgdir}/etc/pki/ca-trust/source/{anchors,blacklist}
mkdir -p ${pkgdir}/etc/pki/ca-trust/extracted/{openssl,pem,java}
touch ${pkgdir}/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
@@ -132,4 +180,7 @@ package() {
cp -f ${pkgdir}/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ${pkgdir}/usr/ssl/certs/ca-bundle.crt
cp -f ${pkgdir}/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ${pkgdir}/usr/ssl/cert.pem
cp -f ${pkgdir}/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt ${pkgdir}/usr/ssl/certs/ca-bundle.trust.crt
install -t "$pkgdir/etc/pki/ca-trust/source/anchors" -m644 ${srcdir}/CAcert.org_root.crt
install -t "$pkgdir/etc/pki/ca-trust/source/anchors" -m644 ${srcdir}/CAcert.org_class3.crt
}

50
ca-certificates/certdata2pem-redhat.patch
View File

@@ -1,5 +1,5 @@
--- ca-certificates/mozilla/certdata2pem.py.orig 2014-03-13 16:43:00.000000000 +0400
+++ ca-certificates/mozilla/certdata2pem.py 2014-07-26 01:53:07.583600000 +0400
--- ca-certificates/mozilla/certdata2pem.py.orig 2014-10-16 21:05:16.000000000 +0400
+++ ca-certificates/mozilla/certdata2pem.py 2015-02-13 22:33:39.354400000 +0300
@@ -4,6 +4,7 @@
# certdata2pem.py - splits certdata.txt into multiple files
#
@@ -31,7 +31,7 @@
if type == 'MULTILINE_OCTAL':
in_multiline = True
value = ""
@@ -79,55 +84,117 @@
@@ -79,55 +84,161 @@
if len(obj.items()) > 0:
objects.append(obj)
@@ -130,6 +130,18 @@
+ "CKA_TRUST_STEP_UP_APPROVED": "step-up-approved",
+}
+
+legacy_trust_types = {
+ "LEGACY_CKA_TRUST_SERVER_AUTH": "server-auth",
+ "LEGACY_CKA_TRUST_CODE_SIGNING": "code-signing",
+ "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "email-protection",
+}
+
+legacy_to_real_trust_types = {
+ "LEGACY_CKA_TRUST_SERVER_AUTH": "CKA_TRUST_SERVER_AUTH",
+ "LEGACY_CKA_TRUST_CODE_SIGNING": "CKA_TRUST_CODE_SIGNING",
+ "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "CKA_TRUST_EMAIL_PROTECTION",
+}
+
+openssl_trust = {
+ "CKA_TRUST_SERVER_AUTH": "serverAuth",
+ "CKA_TRUST_CLIENT_AUTH": "clientAuth",
@@ -145,6 +157,8 @@
+ distrustbits = []
+ openssl_trustflags = []
+ openssl_distrustflags = []
+ legacy_trustbits = []
+ legacy_openssl_trustflags = []
+ for t in trust_types.keys():
+ if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR':
+ trustbits.append(t)
@@ -155,6 +169,15 @@
+ if t in openssl_trust:
+ openssl_distrustflags.append(openssl_trust[t])
+
+ for t in legacy_trust_types.keys():
+ if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR':
+ real_t = legacy_to_real_trust_types[t]
+ legacy_trustbits.append(real_t)
+ if real_t in openssl_trust:
+ legacy_openssl_trustflags.append(openssl_trust[real_t])
+ if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED':
+ raise NotImplementedError, 'legacy distrust not supported.\n' + line
+
+ fname = obj_to_filename(tobj)
+ try:
+ obj = certmap[key]
@@ -165,6 +188,26 @@
+ fname += ".crt"
+ else:
+ fname += ".p11-kit"
+
+ is_legacy = 0
+ if tobj.has_key('LEGACY_CKA_TRUST_SERVER_AUTH') or tobj.has_key('LEGACY_CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('LEGACY_CKA_TRUST_CODE_SIGNING'):
+ is_legacy = 1
+ if obj == None:
+ raise NotImplementedError, 'found legacy trust without certificate.\n' + line
+ legacy_fname = "legacy-enable/" + fname
+ f = open(legacy_fname, 'w')
+ f.write("# alias=%s\n"%tobj['CKA_LABEL'])
+ f.write("# trust=" + " ".join(legacy_trustbits) + "\n")
+ if legacy_openssl_trustflags:
+ f.write("# openssl-trust=" + " ".join(legacy_openssl_trustflags) + "\n")
+ f.write("-----BEGIN CERTIFICATE-----\n")
+ f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64)))
+ f.write("\n-----END CERTIFICATE-----\n")
+ f.close()
+ if tobj.has_key('CKA_TRUST_SERVER_AUTH') or tobj.has_key('CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('CKA_TRUST_CODE_SIGNING'):
+ fname = "legacy-disable/" + fname
+ else:
+ continue
+ f = open(fname, 'w')
+ if obj != None:
@@ -194,4 +237,5 @@
+ if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'):
+ f.write("x-distrusted: true\n")
+ f.write("\n\n")
+ f.close()
+ print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)

1838
ca-certificates/diff-from-upstream-2.2.patch Normal file
View File

File diff suppressed because it is too large Load Diff