From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 749111396D9 for ; Wed, 15 Nov 2017 18:51:30 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E2985E0F26; Wed, 15 Nov 2017 18:51:29 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id B4B9EE0F26 for ; Wed, 15 Nov 2017 18:51:29 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 97E0D340BEA for ; Wed, 15 Nov 2017 18:51:28 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 21B659BD0 for ; Wed, 15 Nov 2017 18:51:27 +0000 (UTC) From: "Lars Wendler" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Lars Wendler" Message-ID: <1510771850.24393c7fc7beed4e1e26555ba7f8ffccdd7ec327.polynomial-c@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: app-misc/ca-certificates/ X-VCS-Repository: repo/gentoo X-VCS-Files: app-misc/ca-certificates/Manifest app-misc/ca-certificates/ca-certificates-20170717.3.34.ebuild X-VCS-Directories: app-misc/ca-certificates/ X-VCS-Committer: polynomial-c X-VCS-Committer-Name: Lars Wendler X-VCS-Revision: 24393c7fc7beed4e1e26555ba7f8ffccdd7ec327 X-VCS-Branch: master Date: Wed, 15 Nov 2017 18:51:27 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 17d9a142-0d6b-4329-adbd-6c2b87264f8c X-Archives-Hash: 3c0ed00a7cd85a917753b41e48697d88 commit: 24393c7fc7beed4e1e26555ba7f8ffccdd7ec327 Author: Lars Wendler gentoo org> AuthorDate: Wed Nov 15 18:49:49 2017 +0000 Commit: Lars Wendler gentoo org> CommitDate: Wed Nov 15 18:50:50 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=24393c7f app-misc/ca-certificates: Bump to version 20170717.3.34 Package-Manager: Portage-2.3.14, Repoman-2.3.6 app-misc/ca-certificates/Manifest | 1 + .../ca-certificates-20170717.3.34.ebuild | 190 +++++++++++++++++++++ 2 files changed, 191 insertions(+) diff --git a/app-misc/ca-certificates/Manifest b/app-misc/ca-certificates/Manifest index eaaaa4492b8..6b9638311bf 100644 --- a/app-misc/ca-certificates/Manifest +++ b/app-misc/ca-certificates/Manifest @@ -4,4 +4,5 @@ DIST nss-3.30.2.tar.gz 9499119 SHA256 0d4a77ff26bcee79fa8afe0125e0df6ae9e798b6b3 DIST nss-3.30.tar.gz 9500552 SHA256 a8c0000dae5e992f6563972e26dbfefc50d006dd845c43b8ca24ea50169ff3a9 SHA512 c21e9b5e4b689ea8cbc6f4d7913df43e2a78c4435e0ce092f2ce00e46079ce2268e17ec8527b283ac69eff3d96ff0165a5b42b6579bfe0a720115ff2938260d3 WHIRLPOOL bc0a59484010a5771b515dde1440ccca8a63b167d3d8839b3606460fdf9d2dc3ab7d889173c88edb7d685d39ad3614c4cbc66284d0faced47cdcc01a69997d9a DIST nss-3.32.1.tar.gz 9494609 SHA256 4de59ca7f5bf4a56fbcfdbb4a054f254ba9f408f56476957404a091048624652 SHA512 b377aba822c2955d801022eba1636b71943a64f6e74d5611c2625910d230059383c4dbdedd65e70b356eaea33aeefdd24de3b31d7a4823d921ea475af3dd9da8 WHIRLPOOL 4c15b4ba85ce10787b9ee541d20a829a99aed5628b59f7e7e3045ec694d6d8a0a83bc730ae4d74148cf7c425f59debfd1574cb1b036c1407d1f9d4896647d9cf DIST nss-3.33.tar.gz 9578033 SHA256 98f0dabd36408e83dd3a11727336cc3cdfee4cbdd9aede2b2831eb2389c284e4 SHA512 82adc0b73805ba5e73b9bf350fffa383a8b4396c05f49edb360a53319b4ad26d928a135bee245f9da009d162129db4441a96ef05346dadac20922b21284468b0 WHIRLPOOL c11129bce97990a41a3118e62d79481fbd38cad51356a6b6c1b0af7efe2f27b3d5d51a8e987287c1cdff77ccee14a3e96d5bbb76e92f9a81b2f50988de250dea +DIST nss-3.34.tar.gz 9586315 SHA256 0d45954181373023c7cfc33e77c8c636d394ec7e55b93e059149ed7888652af5 SHA512 72388b596151499850546a68d9a20d82434c59f159564fb7170980f110d43d7026f174f93660d3bb6da79b618fd7d4f1f16246fc80ba568aa555df99ebbaea21 WHIRLPOOL ae6784022aa74671c62141023e40e5dfce51bc90b49c6520ad46307eb3b84246c1557bbcc0b63554d6aef42940a2667f46cebfe57f9962342f176e79fe9384e0 DIST nss-cacert-class1-class3.patch 22950 SHA256 6bba29cee34276e2ca6436dabedfeba2b61fb46668c5d5ceabf0c871574649bf SHA512 a5aa740bf110a3f0262e3f1ef2fc739ac2b44f042e220039d48aee8e97cd764d5c10718220364f4098aba955882bd02cadb5481512388971a8290312f88a7df0 WHIRLPOOL 1246223b01292604e5609bb9c580f092dc5937bf8c98f6891b099e8bab960e03612b6617e30a55d6ff8817d88f190e03812fe8f89f84f25c20970493dc2f7700 diff --git a/app-misc/ca-certificates/ca-certificates-20170717.3.34.ebuild b/app-misc/ca-certificates/ca-certificates-20170717.3.34.ebuild new file mode 100644 index 00000000000..7778372001e --- /dev/null +++ b/app-misc/ca-certificates/ca-certificates-20170717.3.34.ebuild @@ -0,0 +1,190 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +# The Debian ca-certificates package merely takes the CA database as it exists +# in the nss package and repackages it for use by openssl. +# +# The issue with using the compiled debs directly is two fold: +# - they do not update frequently enough for us to rely on them +# - they pull the CA database from nss tip of tree rather than the release +# +# So we take the Debian source tools and combine them with the latest nss +# release to produce (largely) the same end result. The difference is that +# now we know our cert database is kept in sync with nss and, if need be, +# can be sync with nss tip of tree more frequently to respond to bugs. + +# When triaging bugs from users, here's some handy tips: +# - To see what cert is hitting errors, use openssl: +# openssl s_client -port 443 -CApath /etc/ssl/certs/ -host $HOSTNAME +# Focus on the errors written to stderr. +# +# - Look at the upstream log as to why certs were added/removed: +# https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt +# +# - If people want to add/remove certs, tell them to file w/mozilla: +# https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS&component=CA%20Certificates&version=trunk + +EAPI=6 + +PYTHON_COMPAT=( python{2_7,3_4,3_5,3_6} ) + +inherit eutils python-any-r1 + +if [[ ${PV} == *.* ]] ; then + # Compile from source ourselves. + PRECOMPILED=false + inherit versionator + + DEB_VER=$(get_version_component_range 1) + NSS_VER=$(get_version_component_range 2-) + RTM_NAME="NSS_${NSS_VER//./_}_RTM" +else + # Debian precompiled version. + PRECOMPILED=true + inherit unpacker +fi + +DESCRIPTION="Common CA Certificates PEM files" +HOMEPAGE="https://packages.debian.org/sid/ca-certificates" +NMU_PR="" +if ${PRECOMPILED} ; then + SRC_URI="mirror://debian/pool/main/c/${PN}/${PN}_${PV}${NMU_PR:++nmu}${NMU_PR}_all.deb" +else + SRC_URI="mirror://debian/pool/main/c/${PN}/${PN}_${DEB_VER}${NMU_PR:++nmu}${NMU_PR}.tar.xz + https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/nss-${NSS_VER}.tar.gz + cacert? ( + https://dev.gentoo.org/~axs/distfiles/nss-cacert-class1-class3.patch + )" +fi + +LICENSE="MPL-1.1" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt" +IUSE="insecure_certs" +${PRECOMPILED} || IUSE+=" cacert" + +DEPEND="" +if ${PRECOMPILED} ; then + DEPEND+=" !/dev/null + epatch "${DISTDIR}"/nss-cacert-class1-class3.patch + popd >/dev/null + fi + fi + + default + eapply -p2 "${FILESDIR}"/${PN}-20150426-root.patch + local relp=$(echo "${EPREFIX}" | sed -e 's:[^/]\+:..:g') + sed -i \ + -e '/="$ROOT/s:ROOT:ROOT'"${EPREFIX}"':' \ + -e '/RELPATH="\.\./s:"$:'"${relp}"'":' \ + usr/sbin/update-ca-certificates || die +} + +src_compile() { + cd "image/${EPREFIX}" || die + if ! ${PRECOMPILED} ; then + python_setup + local d="${S}/${PN}/mozilla" c="usr/share/${PN}" + # Grab the database from the nss sources. + cp "${S}"/nss-${NSS_VER}/nss/lib/ckfw/builtins/{certdata.txt,nssckbi.h} "${d}" || die + emake -C "${d}" + + # Now move the files to the same places that the precompiled would. + mkdir -p etc/ssl/certs etc/ca-certificates/update.d "${c}"/mozilla + if use cacert ; then + mkdir -p "${c}"/cacert.org + mv "${d}"/CAcert_Inc..crt "${c}"/cacert.org/cacert.org_root.crt || die + fi + mv "${d}"/*.crt "${c}"/mozilla/ || die + else + mv usr/share/doc/{ca-certificates,${PF}} || die + fi + + if ! use insecure_certs ; then + elog "To prevent applications relying on system's trusted root certificate store" + elog "from using CAs where at least one major browser vendor Gentoo is following" + elog "has decided to apply trust level restrictions, the following" + elog "certificate(s) were removed:" + # Remove untrusted certs from StartCom and WoSign (bug #598072) + elog "$(find "${c}" -type f \( \ + -iname '*startcom*' \ + -o -iname '*wosign*' \ + \) -printf '%P removed; see https://bugs.gentoo.org/598072 for details\n' -delete)" + fi + + ( + echo "# Automatically generated by ${CATEGORY}/${PF}" + echo "# $(date -u)" + echo "# Do not edit." + cd "${c}" + find * -name '*.crt' | LC_ALL=C sort + ) > etc/ca-certificates.conf + + sh usr/sbin/update-ca-certificates --root "${S}/image" || die +} + +src_install() { + cp -pPR image/* "${D}"/ || die + if ! ${PRECOMPILED} ; then + cd ca-certificates + doman sbin/*.8 + dodoc debian/README.* examples/ca-certificates-local/README + fi + + echo 'CONFIG_PROTECT_MASK="/etc/ca-certificates.conf"' > 98ca-certificates + doenvd 98ca-certificates +} + +pkg_postinst() { + if [ -d "${EROOT}/usr/local/share/ca-certificates" ] ; then + # if the user has local certs, we need to rebuild again + # to include their stuff in the db. + # However it's too overzealous when the user has custom certs in place. + # --fresh is to clean up dangling symlinks + "${EROOT}"/usr/sbin/update-ca-certificates --root "${ROOT}" + fi + + if [ -n "$(find -L "${EROOT}"etc/ssl/certs/ -type l)" ] ; then + ewarn "Removing the following broken symlinks:" + ewarn "$(find -L "${EROOT}"/etc/ssl/certs/ -type l -printf '%p -> %l\n' -delete)" + fi +}