Befator-Inc-Firmen-Netzwerk/MSYS2-packages
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

ca-certificates: Update to 1.97. Prepare to move system to real /usr

Browse Source
This commit is contained in:
Alexpux
2014-06-14 21:17:22 +04:00
parent aeb71156ea
commit e392c83f78
6 changed files with 796 additions and 696 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
ca-certificates/PKGBUILD
View File

@@ -1,14 +1,14 @@
# Maintainer: Alexey Pavlov <alexpux@gmail.com>
pkgname=ca-certificates
pkgver=1.96
pkgrel=3
pkgver=1.97
pkgrel=1
pkgdesc='Common CA certificates'
arch=('any')
url='http://www.mozilla.org/projects/security/certs/'
license=('MPL' 'GPL')
source=(blacklist.txt
certdata.txt
certdata.txt
nssckbi.h
trust-fixes
certdata2pem.py
@@ -25,8 +25,8 @@ depends=('bash' 'openssl' 'findutils' 'coreutils' 'sed' 'p11-kit')
makedepends=('asciidoc' 'python2' 'libxslt' 'sed' 'grep')
install='ca-certificates.install'
sha256sums=('e18ee0638a626a992a56332e1fb3657f22f9dd074f2b60beea5fef4be9774672'
'31ba3749ba4e7d473db5e31483b615e9d93d75e69d491ccb58d2cb52cac31736'
'7e8caeba9a41341675b96bb210857a91833ee2d9418e09af376ae61375a6af6b'
'37ee5e82b1d3358c68a50141f942303958ff182e05f1a1a24fe6756eb7b60a7e'
'ae450070c2bc5b24facf3f6c939ce8421bfa99e0f1580736a40d615ae17d6974'
'eeebba0de2635ba4115c05b2acc95d475d47aa58796bb0868203805212f50381'
'af13c30801a8a27623948206458432a4cf98061b75ff6e5b5e03912f93c034ee'
'893ca46a496fe65855d81849687283b6e9d5a287f05366bcbf94bf1fb4b59f9f'
@@ -116,7 +116,8 @@ EOF
package() {
cd $srcdir/$pkgname-$pkgver/
mkdir -p ${pkgdir}/usr/{etc,bin,lib,share}
mkdir -p ${pkgdir}/usr/{bin,lib,share}
mkdir -p ${pkgdir}/etc
mkdir -p ${pkgdir}/usr/share/man/man8
cp -f update-ca-trust ${pkgdir}/usr/bin/
@@ -134,26 +135,26 @@ package() {
cp -f README.usr ${D}/usr/share/pki/ca-trust-source/README
# touch all files overwritten by update-ca-trust for easy cleanup
mkdir -p ${pkgdir}/usr/etc/pki/ca-trust/{extracted,source}
mkdir -p ${pkgdir}/usr/etc/pki/ca-trust/source/{anchors,blacklist}
mkdir -p ${pkgdir}/usr/etc/pki/ca-trust/extracted/{openssl,pem,java}
mkdir -p ${pkgdir}/etc/pki/ca-trust/{extracted,source}
mkdir -p ${pkgdir}/etc/pki/ca-trust/source/{anchors,blacklist}
mkdir -p ${pkgdir}/etc/pki/ca-trust/extracted/{openssl,pem,java}
cp -f README.extr ${pkgdir}/usr/etc/pki/ca-trust/extracted/README
cp -f README.extr ${pkgdir}/etc/pki/ca-trust/extracted/README
cp -f README.openssl ${pkgdir}/usr/etc/pki/ca-trust/extracted/openssl/README
touch ${pkgdir}/usr/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
cp -f README.openssl ${pkgdir}/etc/pki/ca-trust/extracted/openssl/README
touch ${pkgdir}/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt
cp -f README.pem ${pkgdir}/usr/etc/pki/ca-trust/extracted/pem/README
touch ${pkgdir}/usr/etc/pki/ca-trust/extracted/pem/{tls,email,objsign}-ca-bundle.pem
cp -f README.pem ${pkgdir}/etc/pki/ca-trust/extracted/pem/README
touch ${pkgdir}/etc/pki/ca-trust/extracted/pem/{tls,email,objsign}-ca-bundle.pem
cp -f README.java ${pkgdir}/usr/etc/pki/ca-trust/extracted/java/README
touch ${pkgdir}/usr/etc/pki/ca-trust/extracted/java/cacerts
cp -f README.java ${pkgdir}/etc/pki/ca-trust/extracted/java/README
touch ${pkgdir}/etc/pki/ca-trust/extracted/java/cacerts
cp -f README.src ${pkgdir}/usr/etc/pki/ca-trust/source/README
cp -f README.src ${pkgdir}/etc/pki/ca-trust/source/README
# for OpenSSL and static ca-certificates consumers
mkdir -p ${pkgdir}/usr/ssl/certs
cp -f ${pkgdir}/usr/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ${pkgdir}/usr/ssl/certs/ca-bundle.crt
cp -f ${pkgdir}/usr/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ${pkgdir}/usr/ssl/cert.pem
cp -f ${pkgdir}/usr/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt ${pkgdir}/usr/ssl/certs/ca-bundle.trust.crt
cp -f ${pkgdir}/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ${pkgdir}/usr/ssl/certs/ca-bundle.crt
cp -f ${pkgdir}/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem ${pkgdir}/usr/ssl/cert.pem
cp -f ${pkgdir}/etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt ${pkgdir}/usr/ssl/certs/ca-bundle.trust.crt
}

28
ca-certificates/ca-certificates.install
View File

@@ -1,25 +1,25 @@
export LC_ALL=C
post_install() {
DEST=usr/etc/pki/ca-trust/extracted
DEST=etc/pki/ca-trust/extracted
# OpenSSL PEM bundle that includes trust flags
# (BEGIN TRUSTED CERTIFICATE)
usr/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite $DEST/openssl/ca-bundle.trust.crt
usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose server-auth $DEST/pem/tls-ca-bundle.pem
usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
# OpenSSL PEM bundle that includes trust flags
# (BEGIN TRUSTED CERTIFICATE)
usr/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite $DEST/openssl/ca-bundle.trust.crt
usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose server-auth $DEST/pem/tls-ca-bundle.pem
usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
mkdir -p usr/ssl/certs
cp -f $DEST/pem/tls-ca-bundle.pem usr/ssl/certs/ca-bundle.crt
cp -f $DEST/pem/tls-ca-bundle.pem usr/ssl/cert.pem
cp -f $DEST/openssl/ca-bundle.trust.crt usr/ssl/certs/ca-bundle.trust.crt
mkdir -p usr/ssl/certs
cp -f $DEST/pem/tls-ca-bundle.pem usr/ssl/certs/ca-bundle.crt
cp -f $DEST/pem/tls-ca-bundle.pem usr/ssl/cert.pem
cp -f $DEST/openssl/ca-bundle.trust.crt usr/ssl/certs/ca-bundle.trust.crt
#usr/bin/update-ca-trust >/dev/null 2>&1
#usr/bin/update-ca-trust >/dev/null 2>&1
}
post_upgrade() {
post_install
post_install
}

1067
ca-certificates/certdata.txt
View File

File diff suppressed because it is too large Load Diff

347
ca-certificates/generate-cacerts.pl
View File

@@ -1,347 +0,0 @@
#!/usr/bin/perl -w
use diagnostics;
use Fcntl;
# Copyright (C) 2007, 2008 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# generate-cacerts.pl generates a JKS keystore named 'cacerts' from
# OpenSSL's certificate bundle using OpenJDK's keytool.
# First extract each of OpenSSL's bundled certificates into its own
# aliased filename.
$file = $ARGV[1];
open(CERTS, $file);
@certs = <CERTS>;
close(CERTS);
$pem_file_count = 0;
$in_cert_block = 0;
$write_current_cert = 1;
foreach $cert (@certs)
{
if ($cert =~ "Certificate:\n")
{
print "New certificate...\n";
}
elsif ($cert =~ /Subject: /)
{
$_ = $cert;
if ($cert =~ /personal-freemail/)
{
$cert_alias = "thawtepersonalfreemailca";
}
elsif ($cert =~ /personal-basic/)
{
$cert_alias = "thawtepersonalbasicca";
}
elsif ($cert =~ /personal-premium/)
{
$cert_alias = "thawtepersonalpremiumca";
}
elsif ($cert =~ /server-certs/)
{
$cert_alias = "thawteserverca";
}
elsif ($cert =~ /premium-server/)
{
$cert_alias = "thawtepremiumserverca";
}
elsif ($cert =~ /Class 1 Public Primary Certification Authority$/)
{
$cert_alias = "verisignclass1ca";
}
elsif ($cert =~ /Class 1 Public Primary Certification Authority - G2/)
{
$cert_alias = "verisignclass1g2ca";
}
elsif ($cert =~
/VeriSign Class 1 Public Primary Certification Authority - G3/)
{
$cert_alias = "verisignclass1g3ca";
}
elsif ($cert =~ /Class 2 Public Primary Certification Authority$/)
{
$cert_alias = "verisignclass2ca";
}
elsif ($cert =~ /Class 2 Public Primary Certification Authority - G2/)
{
$cert_alias = "verisignclass2g2ca";
}
elsif ($cert =~
/VeriSign Class 2 Public Primary Certification Authority - G3/)
{
$cert_alias = "verisignclass2g3ca";
}
elsif ($cert =~ /Class 3 Public Primary Certification Authority$/)
{
$cert_alias = "verisignclass3ca";
}
# Version 1 of Class 3 Public Primary Certification Authority
# - G2 is added. Version 3 is excluded. See below.
elsif ($cert =~ /Class 3 Public Primary Certification Authority - G2.*1998/)
{
$cert_alias = "verisignclass3g2ca";
}
elsif ($cert =~
/VeriSign Class 3 Public Primary Certification Authority - G3/)
{
$cert_alias = "verisignclass3g3ca";
}
elsif ($cert =~
/RSA Data Security.*Secure Server Certification Authority/)
{
$cert_alias = "rsaserverca";
}
elsif ($cert =~ /GTE CyberTrust Global Root/)
{
$cert_alias = "gtecybertrustglobalca";
}
elsif ($cert =~ /Baltimore CyberTrust Root/)
{
$cert_alias = "baltimorecybertrustca";
}
elsif ($cert =~ /www.entrust.net\/Client_CA_Info\/CPS/)
{
$cert_alias = "entrustclientca";
}
elsif ($cert =~ /www.entrust.net\/GCCA_CPS/)
{
$cert_alias = "entrustglobalclientca";
}
elsif ($cert =~ /www.entrust.net\/CPS_2048/)
{
$cert_alias = "entrust2048ca";
}
elsif ($cert =~ /www.entrust.net\/CPS incorp /)
{
$cert_alias = "entrustsslca";
}
elsif ($cert =~ /www.entrust.net\/SSL_CPS/)
{
$cert_alias = "entrustgsslca";
}
elsif ($cert =~ /The Go Daddy Group/)
{
$cert_alias = "godaddyclass2ca";
}
elsif ($cert =~ /Starfield Class 2 Certification Authority/)
{
$cert_alias = "starfieldclass2ca";
}
elsif ($cert =~ /ValiCert Class 2 Policy Validation Authority/)
{
$cert_alias = "valicertclass2ca";
}
elsif ($cert =~ /GeoTrust Global CA$/)
{
$cert_alias = "geotrustglobalca";
}
elsif ($cert =~ /Equifax Secure Certificate Authority/)
{
$cert_alias = "equifaxsecureca";
}
elsif ($cert =~ /Equifax Secure eBusiness CA-1/)
{
$cert_alias = "equifaxsecureebusinessca1";
}
elsif ($cert =~ /Equifax Secure eBusiness CA-2/)
{
$cert_alias = "equifaxsecureebusinessca2";
}
elsif ($cert =~ /Equifax Secure Global eBusiness CA-1/)
{
$cert_alias = "equifaxsecureglobalebusinessca1";
}
elsif ($cert =~ /Sonera Class1 CA/)
{
$cert_alias = "soneraclass1ca";
}
elsif ($cert =~ /Sonera Class2 CA/)
{
$cert_alias = "soneraclass2ca";
}
elsif ($cert =~ /AAA Certificate Services/)
{
$cert_alias = "comodoaaaca";
}
elsif ($cert =~ /AddTrust Class 1 CA Root/)
{
$cert_alias = "addtrustclass1ca";
}
elsif ($cert =~ /AddTrust External CA Root/)
{
$cert_alias = "addtrustexternalca";
}
elsif ($cert =~ /AddTrust Qualified CA Root/)
{
$cert_alias = "addtrustqualifiedca";
}
elsif ($cert =~ /UTN-USERFirst-Hardware/)
{
$cert_alias = "utnuserfirsthardwareca";
}
elsif ($cert =~ /UTN-USERFirst-Client Authentication and Email/)
{
$cert_alias = "utnuserfirstclientauthemailca";
}
elsif ($cert =~ /UTN - DATACorp SGC/)
{
$cert_alias = "utndatacorpsgcca";
}
elsif ($cert =~ /UTN-USERFirst-Object/)
{
$cert_alias = "utnuserfirstobjectca";
}
elsif ($cert =~ /America Online Root Certification Authority 1/)
{
$cert_alias = "aolrootca1";
}
elsif ($cert =~ /DigiCert Assured ID Root CA/)
{
$cert_alias = "digicertassuredidrootca";
}
elsif ($cert =~ /DigiCert Global Root CA/)
{
$cert_alias = "digicertglobalrootca";
}
elsif ($cert =~ /DigiCert High Assurance EV Root CA/)
{
$cert_alias = "digicerthighassuranceevrootca";
}
elsif ($cert =~ /GlobalSign Root CA$/)
{
$cert_alias = "globalsignca";
}
elsif ($cert =~ /GlobalSign Root CA - R2/)
{
$cert_alias = "globalsignr2ca";
}
elsif ($cert =~ /Elektronik.*Kas.*2005/)
{
$cert_alias = "extra-elektronikkas2005";
}
elsif ($cert =~ /Muntaner 244 Barcelona.*Firmaprofesional/)
{
$cert_alias = "extra-oldfirmaprofesional";
}
# Mozilla does not provide these certificates:
# baltimorecodesigningca
# gtecybertrust5ca
# trustcenterclass2caii
# trustcenterclass4caii
# trustcenteruniversalcai
else
{
# Generate an alias using the OU and CN attributes of the
# Subject field if both are present, otherwise use only the
# CN attribute. The Subject field must have either the OU
# or the CN attribute.
$_ = $cert;
if ($cert =~ /OU=/)
{
s/Subject:.*?OU=//;
# Remove other occurrences of OU=.
s/OU=.*CN=//;
# Remove CN= if there were not other occurrences of OU=.
s/CN=//;
s/\/emailAddress.*//;
s/Certificate Authority/ca/g;
s/Certification Authority/ca/g;
}
elsif ($cert =~ /CN=/)
{
s/Subject:.*CN=//;
s/\/emailAddress.*//;
s/Certificate Authority/ca/g;
s/Certification Authority/ca/g;
}
s/\W//g;
tr/A-Z/a-z/;
$cert_alias = "extra-$_";
}
print "$cert => alias $cert_alias\n";
}
elsif ($cert =~ "Signature Algorithm: ecdsa")
{
# Ignore ECC certs since keytool rejects them
$write_current_cert = 0;
print " => ignoring ECC certificate\n";
}
elsif ($cert eq "-----BEGIN CERTIFICATE-----\n")
{
if ($in_cert_block != 0)
{
die "FAIL: $file is malformed.";
}
$in_cert_block = 1;
if ($write_current_cert == 1)
{
$pem_file_count++;
if (!sysopen(PEM, "$cert_alias.pem", O_WRONLY|O_CREAT|O_EXCL)) {
$cert_alias = "$cert_alias.1";
sysopen(PEM, "$cert_alias.1.pem", O_WRONLY|O_CREAT|O_EXCL)
|| die("FAIL: could not open file for $cert_alias.pem: $!");
}
print PEM $cert;
print " => writing $cert_alias.pem...\n";
}
}
elsif ($cert eq "-----END CERTIFICATE-----\n")
{
$in_cert_block = 0;
if ($write_current_cert == 1)
{
print PEM $cert;
close(PEM);
}
$write_current_cert = 1
}
else
{
if ($in_cert_block == 1 && $write_current_cert == 1)
{
print PEM $cert;
}
}
}
# Check that the correct number of .pem files were produced.
@pem_files = <*.pem>;
if (@pem_files != $pem_file_count)
{
print "$pem_file_count != ".@pem_files."\n";
die "FAIL: Number of .pem files produced does not match".
" number of certs read from $file.";
}
# Now store each cert in the 'cacerts' file using keytool.
$certs_written_count = 0;
foreach $pem_file (@pem_files)
{
print "+ Adding $pem_file...\n";
if (system("$ARGV[0] -import".
" -alias `basename $pem_file .pem`".
" -keystore cacerts -noprompt -storepass 'changeit' -file $pem_file") == 0) {
$certs_written_count++;
} else {
print "FAILED\n";
}
}
# Check that the correct number of certs were added to the keystore.
if ($certs_written_count != $pem_file_count)
{
die "FAIL: Number of certs added to keystore does not match".
" number of certs read from $file.";
}

4
ca-certificates/nssckbi.h
View File

@@ -45,8 +45,8 @@
* of the comment in the CK_VERSION type definition.
*/
#define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 1
#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 96
#define NSS_BUILTINS_LIBRARY_VERSION "1.96"
#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 97
#define NSS_BUILTINS_LIBRARY_VERSION "1.97"
/* These version numbers detail the semantic changes to the ckfw engine. */
#define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1

5
ca-certificates/update-ca-trust
View File

@@ -16,8 +16,3 @@ DEST=/etc/pki/ca-trust/extracted
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
/usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
mkdir -p /usr/ssl/certs
cp -f /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /usr/ssl/certs/ca-bundle.crt
cp -f /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /usr/ssl/cert.pem
cp -f /etc/pki/ca-trust/extracted/openssl/ca-bundle.trust.crt /usr/ssl/certs/ca-bundle.trust.crt