[ca-certificates] * Fri Mar 08 2013 Kai Engert <kaie at redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSyste
Kai Engert
kengert at fedoraproject.org
Fri Mar 8 23:10:27 UTC 2013
commit d538ada99cda951da7da3a72dc5eea06f02be212
Author: Kai Engert <kaie at redhat.com>
Date: Sat Mar 9 00:09:26 2013 +0100
* Fri Mar 08 2013 Kai Engert <kaie at redhat.com> - 2012.87-9
- Major rework for the Fedora SharedSystemCertificates feature.
- Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
- Require the p11-kit package that contains tools to automatically create
other file format bundles.
- Convert old file locations to symbolic links that point to dynamically
generated files.
- Old files, which might have been locally modified, will be saved in backup
files with .rpmsave extension.
- Added a update-ca-certificates script which can be used to regenerate
the merged trusted output.
- Refer to the various README files that have been added for more detailed
explanation of the new system.
- No longer require rsc for building.
- Add explanation for the future version numbering scheme,
because the old numbering scheme was based on upstream using cvs,
which is no longer true, and therefore can no longer be used.
- Includes changes from rhbz#873369.
README.etc | 5 +
README.extr | 18 ++++
README.java | 29 ++++++
README.openssl | 27 ++++++
README.pem | 36 ++++++++
README.src | 27 ++++++
README.usr | 27 ++++++
ca-certificates.spec | 246 ++++++++++++++++++++++++++++++++++++++++----------
certdata2pem.py | 43 ++-------
update-ca-trust | 13 +++
10 files changed, 389 insertions(+), 82 deletions(-)
---
diff --git a/README.etc b/README.etc
new file mode 100644
index 0000000..9271dfe
--- /dev/null
+++ b/README.etc
@@ -0,0 +1,5 @@
+This directory /etc/pki/ca-trust is used by a system of consolidated
+CA certificates.
+
+Please refer to the separate README files in the subdirectories
+named "source" and "extracted".
diff --git a/README.extr b/README.extr
new file mode 100644
index 0000000..e4acc71
--- /dev/null
+++ b/README.extr
@@ -0,0 +1,18 @@
+This directory /etc/pki/ca-trust/extracted/ contains
+CA certificate bundle files which are automatically created.
+
+If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
+then you can use these files in your application to load a list of global
+root CA certificates.
+
+Please never manually edit the files stored in this directory,
+because your changes will be lost and the files automatically overwritten,
+each time the update-ca-trust command gets executed.
+
+In order to install new trusted or distrusted certificates,
+please rather install them in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+Please refer to the README files in those directories to learn
+how to install new files.
diff --git a/README.java b/README.java
new file mode 100644
index 0000000..4cef5a2
--- /dev/null
+++ b/README.java
@@ -0,0 +1,29 @@
+This directory /etc/pki/ca-trust/extracted/java/ contains
+CA certificate bundle files which are automatically created
+based on the information found in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+All files are in the java keystore file format.
+
+Distrust information cannot be represented in this file format,
+and distrusted certificates are missing from these files.
+
+File cacerts contains CA certificates
+trusted for TLS server authentication.
+
+If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
+then you can use these files in your application to load a list of global
+root CA certificates.
+
+Please never manually edit the files stored in this directory,
+because your changes will be lost and the files automatically overwritten,
+each time the update-ca-trust command gets executed.
+
+In order to install new trusted or distrusted certificates,
+please rather install them in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+Please refer to the README files in those directories to learn
+how to install new files.
diff --git a/README.openssl b/README.openssl
new file mode 100644
index 0000000..83cfaa6
--- /dev/null
+++ b/README.openssl
@@ -0,0 +1,27 @@
+This directory /etc/pki/ca-trust/extracted/openssl/ contains
+CA certificate bundle files which are automatically created
+based on the information found in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+All files are in the BEGIN/END TRUSTED CERTIFICATE file format,
+as described in the x509(1) manual page.
+
+File /ca-bundle.trust.crt contains the full set of all trusted
+or distrusted certificates, including the associated trust flags.
+
+If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
+then you can use these files in your application to load a list of global
+root CA certificates.
+
+Please never manually edit the files stored in this directory,
+because your changes will be lost and the files automatically overwritten,
+each time the update-ca-trust command gets executed.
+
+In order to install new trusted or distrusted certificates,
+please rather install them in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+Please refer to the README files in those directories to learn
+how to install new files.
diff --git a/README.pem b/README.pem
new file mode 100644
index 0000000..abc18d2
--- /dev/null
+++ b/README.pem
@@ -0,0 +1,36 @@
+This directory /etc/pki/ca-trust/extracted/pem/ contains
+CA certificate bundle files which are automatically created
+based on the information found in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+All files are in the BEGIN/END CERTIFICATE file format,
+as decribed in the x509(1) manual page.
+
+Distrust information cannot be represented in this file format,
+and distrusted certificates are missing from these files.
+
+File tls-ca-bundle.pem contains CA certificates
+trusted for TLS server authentication.
+
+File email-ca-bundle.pem contains CA certificates
+trusted for E-Mail protection.
+
+File objsign-ca-bundle.pem contains CA certificates
+trusted for code signing.
+
+If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
+then you can use these files in your application to load a list of global
+root CA certificates.
+
+Please never manually edit the files stored in this directory,
+because your changes will be lost and the files automatically overwritten,
+each time the update-ca-trust command gets executed.
+
+In order to install new trusted or distrusted certificates,
+please rather install them in the
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+directories.
+
+Please refer to the README files in those directories to learn
+how to install new files.
diff --git a/README.src b/README.src
new file mode 100644
index 0000000..df32add
--- /dev/null
+++ b/README.src
@@ -0,0 +1,27 @@
+This directory /etc/pki/ca-trust/source/ contains CA certificates and
+trust settings in the PEM file format. The trust settings found here will be
+interpreted with a high priority, higher than the ones found in
+/usr/share/pki/ca-trust-source/.
+
+You may install additional certificates or bundles into this directory.
+
+Each file may contain one or many certificates and trust flags in a
+PEM file format, as documented in the x509(1) manual page.
+Allowed formats are:
+- The BEGIN/END CERTIFICATE file format.
+ Such certificates will be trusted for TLS server auth, only.
+- The BEGIN/END TRUSTED CERTIFICATE file format.
+ Such certificates will be trusted or distrusted according to the
+ trust settings contained in the PEM format data blocks.
+
+Applications that are able to use PKCS#11 modules can dynamically use
+the merged set of certificates from
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
+by loading p11-kit-trust.so
+
+Applications that rely on a static file for a list of trusted CAs
+may load one of the files found in the /etc/pki/ca-trust/extracted
+directory. After modifying the set of files stored in the
+/usr/share/pki/ca-trust-source/ or /etc/pki/ca-trust/source/
+are modified, it is required to run the ca-update-trust command,
+in order to update the merged files in /etc/pki/ca-trust/extracted/ .
diff --git a/README.usr b/README.usr
new file mode 100644
index 0000000..766b4e8
--- /dev/null
+++ b/README.usr
@@ -0,0 +1,27 @@
+This directory /usr/share/pki/ca-trust-source/ contains CA certificates and
+trust settings in the PEM file format. The trust settings found here will be
+interpreted with a low priority, lower than the ones found in
+/etc/pki/ca-trust/source.
+
+You may install additional certificates or bundles into this directory.
+
+Each file may contain one or many certificates and trust flags in a
+PEM file format, as documented in the x509(1) manual page.
+Allowed formats are:
+- The BEGIN/END CERTIFICATE file format.
+ Such certificates will be trusted for TLS server auth, only.
+- The BEGIN/END TRUSTED CERTIFICATE file format.
+ Such certificates will be trusted or distrusted according to the
+ trust settings contained in the PEM format data blocks.
+
+Applications that are able to use PKCS#11 modules can dynamically use
+the merged set of certificates from
+/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source
+by loading p11-kit-trust.so
+
+Applications that rely on a static file for a list of trusted CAs
+may load one of the files found in the /etc/pki/ca-trust/extracted
+directory. After modifying the set of files stored in the
+/usr/share/pki/ca-trust-source/ or /etc/pki/ca-trust/source
+are modified, it is required to run the ca-update-trust command,
+in order to update the merged files in /etc/pki/ca-trust/extracted .
diff --git a/ca-certificates.spec b/ca-certificates.spec
index 354e47e..677b22c 100644
--- a/ca-certificates.spec
+++ b/ca-certificates.spec
@@ -12,33 +12,72 @@
# release branch for the certdata.txt version.
%define pkidir %{_sysconfdir}/pki
+%define catrustdir %{_sysconfdir}/pki/ca-trust
+%define classic_tls_bundle ca-bundle.crt
+%define trusted_all_bundle ca-bundle.trust.crt
+%define java_bundle java/cacerts
Summary: The Mozilla CA root certificate bundle
Name: ca-certificates
+
+# For the package version number, we use: year.{upstream version}
+#
+# The {upstream version} can be found as symbol NSS_BUILTINS_LIBRARY_VERSION at
+# http://hg.mozilla.org/projects/nss/file/default/lib/ckfw/builtins/nssckbi.h
+# which corresponds to
+# http://hg.mozilla.org/projects/nss/file/default/lib/ckfw/builtins/certdata.txt
+# (these revisions are the tip of development and might be unreleased).
+# For the latest release used in RTM versions of Mozilla Firefox, check:
+# https://hg.mozilla.org/releases/mozilla-release/file/default/security/nss/lib/ckfw/builtins/nssckbi.h
+# https://hg.mozilla.org/releases/mozilla-release/file/default/security/nss/lib/ckfw/builtins/certdata.txt
+#
+# (until 2012.87 the version was based on the cvs revision ID of certdata.txt,
+# but in 2013 the NSS projected was migrated to HG. Old version 2012.87 is
+# equivalent to new version 2012.1.93, which would break the requirement
+# to have increasing version numbers. However, the new scheme will work,
+# because all future versions will start with 2013 or larger.)
+
Version: 2012.87
-Release: 2%{?dist}.1
+Release: 9%{?dist}
License: Public Domain
+
Group: System Environment/Base
URL: http://www.mozilla.org/
+
Source0: certdata.txt
-Source1: blacklist.txt
+Source1: update-ca-trust
Source2: generate-cacerts.pl
Source3: certdata2pem.py
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
-BuildRequires: perl, java-openjdk, python, rcs, openssl
+Source11: README.usr
+Source12: README.etc
+Source13: README.extr
+Source14: README.java
+Source15: README.openssl
+Source16: README.pem
+Source17: README.src
+
BuildArch: noarch
+Requires: p11-kit >= 0.16.3
+Requires: p11-kit-trust >= 0.16.3
+BuildRequires: perl
+BuildRequires: java-openjdk
+BuildRequires: python
+BuildRequires: openssl
+
%description
This package contains the set of CA certificates chosen by the
Mozilla Foundation for use with the Internet PKI.
%prep
rm -rf %{name}
-mkdir %{name} %{name}/certs %{name}/java
+mkdir %{name}
+mkdir %{name}/certs
+mkdir %{name}/java
%build
pushd %{name}/certs
- cp %{SOURCE0} %{SOURCE1} .
+ cp %{SOURCE0} .
python %{SOURCE3}
popd
pushd %{name}
@@ -46,18 +85,6 @@ pushd %{name}
cat <<EOF
# This is a bundle of X.509 certificates of public Certificate
# Authorities. It was generated from the Mozilla root CA list.
-#
-# Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt
-#
-# Generated from:
-EOF
- ident -q %{SOURCE0} | sed '1d;s/^/#/';
- echo '#';
- ) > ca-bundle.crt
- (
- cat <<EOF
-# This is a bundle of X.509 certificates of public Certificate
-# Authorities. It was generated from the Mozilla root CA list.
# These certificates are in the OpenSSL "TRUSTED CERTIFICATE"
# format and have trust bits set accordingly.
#
@@ -67,67 +94,188 @@ EOF
EOF
ident -q %{SOURCE0} | sed '1d;s/^/#/';
echo '#';
- ) > ca-bundle.trust.crt
+ ) > %{trusted_all_bundle}
for f in certs/*.crt; do
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
- case $tbits in
- *serverAuth*) openssl x509 -text -in "$f" >> ca-bundle.crt ;;
- esac
+ distbits=`sed -n '/^# openssl-distrust/{s/^.*=//;p;}' $f`
+ targs=""
if [ -n "$tbits" ]; then
- targs=""
for t in $tbits; do
targs="${targs} -addtrust $t"
done
- openssl x509 -text -in "$f" -trustout $targs >> ca-bundle.trust.crt
+ fi
+ if [ -n "$distbits" ]; then
+ for t in $distbits; do
+ targs="${targs} -addreject $t"
+ done
+ fi
+ if [ -n "$targs" ]; then
+ openssl x509 -text -in "$f" -trustout $targs >> %{trusted_all_bundle}
fi
done
popd
-pushd %{name}/java
- test -s ../ca-bundle.crt || exit 1
- %{__perl} %{SOURCE2} %{_bindir}/keytool ../ca-bundle.crt
- touch -r %{SOURCE0} cacerts
-popd
+
%install
rm -rf $RPM_BUILD_ROOT
-
-mkdir -p $RPM_BUILD_ROOT{%{pkidir}/tls/certs,%{pkidir}/java}
-
-install -p -m 644 %{name}/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt
-install -p -m 644 %{name}/ca-bundle.trust.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt
-
+mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/tls/certs
+mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/java
+mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl
+mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source
+mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted
+mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem
+mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl
+mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/java
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source
-install -p -m 644 %{name}/ca-bundle.trust.crt $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/ca-bundle.trust.crt
-touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/ca-bundle.trust.crt
-
-ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
-touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt
-touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt
-
-# Install Java cacerts file.
-mkdir -p -m 700 $RPM_BUILD_ROOT%{pkidir}/java
-install -p -m 644 %{name}/java/cacerts $RPM_BUILD_ROOT%{pkidir}/java/
+mkdir -p -m 755 $RPM_BUILD_ROOT%{_bindir}
+
+install -p -m 644 %{SOURCE11} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/README
+install -p -m 644 %{SOURCE12} $RPM_BUILD_ROOT%{catrustdir}/README
+install -p -m 644 %{SOURCE13} $RPM_BUILD_ROOT%{catrustdir}/extracted/README
+install -p -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{catrustdir}/extracted/java/README
+install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/README
+install -p -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/README
+install -p -m 644 %{SOURCE17} $RPM_BUILD_ROOT%{catrustdir}/source/README
+
+install -p -m 644 %{name}/%{trusted_all_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
+touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
+
+# TODO: consider to dynamically create the update-ca-trust script from within
+# this .spec file, in order to have the output file+directory names at once place only.
+install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_bindir}/update-ca-trust
+
+# touch ghosted files that will be extracted dynamically
+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{trusted_all_bundle}
+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
# /etc/ssl/certs symlink for 3rd-party tools
-mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl
-ln -s ../pki/tls/certs $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs
+ln -s ../pki/tls/certs \
+ $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs
+# legacy filenames
+ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
+ $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
+ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
+ $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{classic_tls_bundle}
+ln -s %{catrustdir}/extracted/openssl/%{trusted_all_bundle} \
+ $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{trusted_all_bundle}
+ln -s %{catrustdir}/extracted/%{java_bundle} \
+ $RPM_BUILD_ROOT%{pkidir}/%{java_bundle}
+
%clean
rm -rf $RPM_BUILD_ROOT
+
+%pre
+if [ $1 -gt 1 ] ; then
+ # Upgrade or Downgrade.
+ # If the classic filename is a regular file, then we are upgrading
+ # from an old package and we will move it to an .rpmsave backup file.
+ # If the filename is a symbolic link, then we are good already.
+ # If the system will later be downgraded to an old package with regular
+ # files, and afterwards updated again to a newer package with symlinks,
+ # and the old .rpmsave backup file didn't get cleaned up,
+ # then we don't backup again. We keep the older backup file.
+ # In other words, if an .rpmsave file already exists, we don't overwrite it.
+ #
+ if ! test -e %{pkidir}/%{java_bundle}.rpmsave; then
+ # no backup yet
+ if ! test -L %{pkidir}/%{java_bundle}; then
+ # it's an old regular file, not a link
+ mv -f %{pkidir}/%{java_bundle} %{pkidir}/%{java_bundle}.rpmsave
+ fi
+ fi
+
+ if ! test -e %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave; then
+ # no backup yet
+ if ! test -L %{pkidir}/tls/certs/%{classic_tls_bundle}; then
+ # it's an old regular file, not a link
+ mv -f %{pkidir}/tls/certs/%{classic_tls_bundle} %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave
+ fi
+ fi
+
+ if ! test -e %{pkidir}/tls/certs/%{trusted_all_bundle}.rpmsave; then
+ # no backup yet
+ if ! test -L %{pkidir}/tls/certs/%{trusted_all_bundle}; then
+ # it's an old regular file, not a link
+ mv -f %{pkidir}/tls/certs/%{trusted_all_bundle} %{pkidir}/tls/certs/%{trusted_all_bundle}.rpmsave
+ fi
+ fi
+fi
+
+
+%post
+#if [ $1 -gt 1 ] ; then
+# # when upgrading or downgrading
+#fi
+%{_bindir}/update-ca-trust
+
+
%files
%defattr(-,root,root,-)
-%dir %{pkidir}/java
-%config(noreplace) %{pkidir}/java/cacerts
+
+%dir %{_sysconfdir}/ssl
%dir %{pkidir}/tls
%dir %{pkidir}/tls/certs
-%config(noreplace) %{pkidir}/tls/certs/ca-bundle.*crt
+%dir %{pkidir}/java
+%dir %{catrustdir}
+%dir %{catrustdir}/source
+%dir %{catrustdir}/extracted
+%dir %{catrustdir}/extracted/pem
+%dir %{catrustdir}/extracted/openssl
+%dir %{catrustdir}/extracted/java
+%dir %{_datadir}/pki/ca-trust-source/
+
+%{_datadir}/pki/ca-trust-source/README
+%{catrustdir}/README
+%{catrustdir}/extracted/README
+%{catrustdir}/extracted/java/README
+%{catrustdir}/extracted/openssl/README
+%{catrustdir}/extracted/pem/README
+%{catrustdir}/source/README
+
+# symlinks for old locations
%{pkidir}/tls/cert.pem
-%dir %{_sysconfdir}/ssl
+%{pkidir}/tls/certs/%{classic_tls_bundle}
+%{pkidir}/tls/certs/%{trusted_all_bundle}
+%{pkidir}/%{java_bundle}
+# symlink directory
%{_sysconfdir}/ssl/certs
-%{_datadir}/pki/ca-trust-source/ca-bundle.trust.crt
+# master bundle file with trust
+%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
+# update/extract tool
+%{_bindir}/update-ca-trust
+# files extracted files
+%ghost %{catrustdir}/extracted/pem/tls-ca-bundle.pem
+%ghost %{catrustdir}/extracted/pem/email-ca-bundle.pem
+%ghost %{catrustdir}/extracted/pem/objsign-ca-bundle.pem
+%ghost %{catrustdir}/extracted/openssl/%{trusted_all_bundle}
+%ghost %{catrustdir}/extracted/%{java_bundle}
+
%changelog
+* Fri Mar 08 2013 Kai Engert <kaie at redhat.com> - 2012.87-9
+- Major rework for the Fedora SharedSystemCertificates feature.
+- Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
+- Require the p11-kit package that contains tools to automatically create
+ other file format bundles.
+- Convert old file locations to symbolic links that point to dynamically
+ generated files.
+- Old files, which might have been locally modified, will be saved in backup
+ files with .rpmsave extension.
+- Added a update-ca-certificates script which can be used to regenerate
+ the merged trusted output.
+- Refer to the various README files that have been added for more detailed
+ explanation of the new system.
+- No longer require rsc for building.
+- Add explanation for the future version numbering scheme,
+ because the old numbering scheme was based on upstream using cvs,
+ which is no longer true, and therefore can no longer be used.
+- Includes changes from rhbz#873369.
+
* Thu Mar 07 2013 Kai Engert <kaie at redhat.com> - 2012.87-2.fc19.1
- Ship trust bundle file in /usr/share/pki/ca-trust-source/, temporarily in addition.
This location will soon become the only place containing this file.
diff --git a/certdata2pem.py b/certdata2pem.py
index 00e24ea..08a6f25 100644
--- a/certdata2pem.py
+++ b/certdata2pem.py
@@ -79,41 +79,12 @@ for line in open('certdata.txt', 'r'):
if len(obj.items()) > 0:
objects.append(obj)
-# Read blacklist.
-blacklist = []
-if os.path.exists('blacklist.txt'):
- for line in open('blacklist.txt', 'r'):
- line = line.strip()
- if line.startswith('#') or len(line) == 0:
- continue
- item = line.split('#', 1)[0].strip()
- blacklist.append(item)
-
# Build up trust database.
-trust = dict()
trustmap = dict()
for obj in objects:
if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
continue
- if obj['CKA_LABEL'] in blacklist:
- print "Certificate %s blacklisted, ignoring." % obj['CKA_LABEL']
- elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
- trust[obj['CKA_LABEL']] = True
- elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR':
- trust[obj['CKA_LABEL']] = True
- elif obj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR':
- trust[obj['CKA_LABEL']] = True
- # NSS recently changed CKT_NSS_UNTRUSTED to CKT_NSS_NOT_TRUSTED
- elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_UNTRUSTED' or obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED':
- print '!'*74
- print "UNTRUSTED BUT NOT BLACKLISTED CERTIFICATE FOUND: %s" % obj['CKA_LABEL']
- print '!'*74
- sys.exit(1)
- else:
- print "Ignoring certificate %s. SAUTH=%s, EPROT=%s" % \
- (obj['CKA_LABEL'], obj['CKA_TRUST_SERVER_AUTH'],
- obj['CKA_TRUST_EMAIL_PROTECTION'])
label = obj['CKA_LABEL']
trustmap[label] = obj
print " added cert", label
@@ -158,26 +129,32 @@ openssl_trust = {
for obj in objects:
if obj['CKA_CLASS'] == 'CKO_CERTIFICATE':
print "producing cert file for " + obj['CKA_LABEL']
- if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
- print " -> untrusted, ignoring"
- continue
fname = obj_to_filename(obj)
f = open(fname, 'w')
trustbits = []
+ distrustbits = []
openssl_trustflags = []
+ openssl_distrustflags = []
tobj = trustmap[obj['CKA_LABEL']]
for t in trust_types.keys():
if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR':
trustbits.append(t)
if t in openssl_trust:
openssl_trustflags.append(openssl_trust[t])
+ if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED':
+ distrustbits.append(t)
+ if t in openssl_trust:
+ openssl_distrustflags.append(openssl_trust[t])
f.write("# trust=" + " ".join(trustbits) + "\n")
+ f.write("# distrust=" + " ".join(distrustbits) + "\n")
if openssl_trustflags:
f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n")
+ if openssl_distrustflags:
+ f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n")
f.write("-----BEGIN CERTIFICATE-----\n")
f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64)))
f.write("\n-----END CERTIFICATE-----\n")
- print " -> written as '%s', trust = %s, openssl-trust = %s" % (fname, trustbits, openssl_trustflags)
+ print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)
diff --git a/update-ca-trust b/update-ca-trust
new file mode 100644
index 0000000..410c138
--- /dev/null
+++ b/update-ca-trust
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+#set -vx
+
+DEST=/etc/pki/ca-trust/extracted
+
+# OpenSSL PEM bundle that includes trust flags
+# (BEGIN TRUSTED CERTIFICATE)
+/usr/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite $DEST/openssl/ca-bundle.trust.crt
+/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose server-auth $DEST/pem/tls-ca-bundle.pem
+/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
+/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
+/usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
More information about the scm-commits
mailing list