2013-03-08 23:09:26 +00:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
#set -vx
|
2023-09-29 13:48:28 +00:00
|
|
|
set -eu
|
2013-03-08 23:09:26 +00:00
|
|
|
|
2023-09-29 13:48:28 +00:00
|
|
|
# For backwards compatibility reasons, future versions of this script must
|
|
|
|
# support the syntax "update-ca-trust extract" trigger the generation of output
|
2013-07-08 22:59:15 +00:00
|
|
|
# files in $DEST.
|
|
|
|
|
2013-03-08 23:09:26 +00:00
|
|
|
DEST=/etc/pki/ca-trust/extracted
|
|
|
|
|
2017-08-15 13:39:45 +00:00
|
|
|
# Prevent p11-kit from reading user configuration files.
|
|
|
|
export P11_KIT_NO_USER_CONFIG=1
|
|
|
|
|
2023-09-29 13:48:28 +00:00
|
|
|
usage() {
|
|
|
|
fold -s -w 76 >&2 <<-EOF
|
|
|
|
Usage: $0 [extract] [-o DIR|--output=DIR]
|
2021-12-06 23:49:38 +00:00
|
|
|
|
2023-09-29 13:48:28 +00:00
|
|
|
Update the system trust store in $DEST.
|
|
|
|
|
|
|
|
COMMANDS
|
|
|
|
(absent/empty command): Same as the extract command described below.
|
|
|
|
|
|
|
|
extract: Instruct update-ca-trust to scan the source configuration in
|
|
|
|
/usr/share/pki/ca-trust-source and /etc/pki/ca-trust/source and produce
|
|
|
|
updated versions of the consolidated configuration files stored below
|
|
|
|
the $DEST directory hierarchy.
|
|
|
|
|
|
|
|
EXTRACT OPTIONS
|
|
|
|
-o DIR, --output=DIR: Write the extracted trust store into the given
|
|
|
|
directory instead of updating $DEST.
|
|
|
|
EOF
|
|
|
|
}
|
|
|
|
|
|
|
|
extract() {
|
|
|
|
USER_DEST=
|
|
|
|
|
2023-10-10 00:23:28 +00:00
|
|
|
# can't use getopt here. ca-certificates can't depend on a lot
|
|
|
|
# of other libraries since openssl depends on ca-certificates
|
|
|
|
# just fail when we hand parse
|
|
|
|
|
|
|
|
while [ $# -ne 0 ]; do
|
|
|
|
case "$1" in
|
|
|
|
"-o"|"--output")
|
|
|
|
USER_DEST=$2
|
|
|
|
shift 2
|
|
|
|
continue
|
|
|
|
;;
|
|
|
|
"--")
|
|
|
|
shift
|
|
|
|
break
|
|
|
|
;;
|
|
|
|
*)
|
|
|
|
usage
|
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|
2023-09-29 13:48:28 +00:00
|
|
|
done
|
|
|
|
|
|
|
|
if [ -n "$USER_DEST" ]; then
|
|
|
|
DEST=$USER_DEST
|
2023-10-10 00:23:28 +00:00
|
|
|
# Attempt to create the directories if they do not exist
|
|
|
|
# yet (rhbz#2241240)
|
|
|
|
/usr/bin/mkdir -p \
|
|
|
|
"$DEST"/openssl \
|
|
|
|
"$DEST"/pem \
|
|
|
|
"$DEST"/java \
|
|
|
|
"$DEST"/edk2
|
2023-09-29 13:48:28 +00:00
|
|
|
fi
|
|
|
|
|
|
|
|
# OpenSSL PEM bundle that includes trust flags
|
|
|
|
# (BEGIN TRUSTED CERTIFICATE)
|
2024-07-25 11:47:29 +00:00
|
|
|
/usr/bin/trust extract --format=openssl-bundle --filter=certificates --overwrite --comment "$DEST/openssl/ca-bundle.trust.crt"
|
|
|
|
/usr/bin/trust extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth "$DEST/pem/tls-ca-bundle.pem"
|
|
|
|
/usr/bin/trust extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email "$DEST/pem/email-ca-bundle.pem"
|
|
|
|
/usr/bin/trust extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing "$DEST/pem/objsign-ca-bundle.pem"
|
|
|
|
/usr/bin/trust extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth "$DEST/java/cacerts"
|
|
|
|
/usr/bin/trust extract --format=edk2-cacerts --filter=ca-anchors --overwrite --purpose=server-auth "$DEST/edk2/cacerts.bin"
|
2023-09-29 13:48:28 +00:00
|
|
|
# Hashed directory of BEGIN TRUSTED-style certs (usable as OpenSSL CApath and
|
|
|
|
# by GnuTLS)
|
2024-07-25 11:47:29 +00:00
|
|
|
/usr/bin/trust extract --format=pem-directory-hash --filter=ca-anchors --overwrite --purpose server-auth "$DEST/pem/directory-hash"
|
2023-09-29 13:48:28 +00:00
|
|
|
|
|
|
|
# p11-kit extract will have made this directory unwritable; when run with
|
|
|
|
# CAP_DAC_OVERRIDE this does not matter, but in container use cases that may
|
|
|
|
# not be the case. See rhbz#2241240.
|
2023-10-10 00:23:28 +00:00
|
|
|
if [ -n "$USER_DEST" ]; then
|
|
|
|
/usr/bin/chmod u+w "$DEST/pem/directory-hash"
|
|
|
|
fi
|
2023-09-29 13:48:28 +00:00
|
|
|
|
|
|
|
# Debian compatibility: their /etc/ssl/certs has this bundle
|
|
|
|
/usr/bin/ln -s ../tls-ca-bundle.pem "$DEST/pem/directory-hash/ca-certificates.crt"
|
|
|
|
# Backwards compatibility: RHEL/Fedora provided a /etc/ssl/certs/ca-bundle.crt
|
|
|
|
# since https://bugzilla.redhat.com/show_bug.cgi?id=572725
|
|
|
|
/usr/bin/ln -s ../tls-ca-bundle.pem "$DEST/pem/directory-hash/ca-bundle.crt"
|
|
|
|
|
|
|
|
# Remove write permissions again
|
2023-10-10 00:23:28 +00:00
|
|
|
if [ -n "$USER_DEST" ]; then
|
|
|
|
/usr/bin/chmod u-w "$DEST/pem/directory-hash"
|
|
|
|
fi
|
2023-09-29 13:48:28 +00:00
|
|
|
}
|
2023-10-10 00:23:28 +00:00
|
|
|
if [ $# -lt 1 ]; then
|
|
|
|
set -- extract
|
2023-09-29 13:48:28 +00:00
|
|
|
fi
|
2023-10-10 00:23:28 +00:00
|
|
|
|
2023-09-29 13:48:28 +00:00
|
|
|
case "$1" in
|
|
|
|
"extract")
|
|
|
|
shift
|
2023-10-10 00:23:28 +00:00
|
|
|
extract $@
|
2023-09-29 13:48:28 +00:00
|
|
|
;;
|
|
|
|
"--"*|"-"*)
|
|
|
|
# First parameter seems to be an option, assume the command is 'extract'
|
2023-10-10 00:23:28 +00:00
|
|
|
extract $@
|
2023-09-29 13:48:28 +00:00
|
|
|
;;
|
|
|
|
*)
|
|
|
|
echo >&2 "Error: Unknown command: $1"
|
|
|
|
echo >&2
|
|
|
|
usage
|
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|