ca-certificates/update-ca-trust

#!/bin/sh

#set -vx

# At this time, while this script is trivial, we ignore any parameters given.
# However, for backwards compatibility reasons, future versions of this script must 
# support the syntax "update-ca-trust extract" trigger the generation of output 
# files in $DEST.

DEST=/etc/pki/ca-trust/extracted

# Prevent p11-kit from reading user configuration files.
export P11_KIT_NO_USER_CONFIG=1

# OpenSSL PEM bundle that includes trust flags
# (BEGIN TRUSTED CERTIFICATE)
/usr/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
/usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
/usr/bin/p11-kit extract --format=edk2-cacerts --filter=ca-anchors --overwrite --purpose=server-auth $DEST/edk2/cacerts.bin
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369. 2013-03-08 23:09:26 +00:00			`#!/bin/sh`

			`#set -vx`

- added a manual page and related build requirements - simplify the README files now that we have a manual page - set a certificate alias in trusted bundle (thanks to Ludwig Nussel) 2013-07-08 22:59:15 +00:00			`# At this time, while this script is trivial, we ignore any parameters given.`
			`# However, for backwards compatibility reasons, future versions of this script must`
			`# support the syntax "update-ca-trust extract" trigger the generation of output`
			`# files in $DEST.`

* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369. 2013-03-08 23:09:26 +00:00			`DEST=/etc/pki/ca-trust/extracted`

- Set P11_KIT_NO_USER_CONFIG=1 to prevent p11-kit from reading user configuration files (rhbz#1478172). 2017-08-15 13:39:45 +00:00			`# Prevent p11-kit from reading user configuration files.`
			`export P11_KIT_NO_USER_CONFIG=1`

* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369. 2013-03-08 23:09:26 +00:00			`# OpenSSL PEM bundle that includes trust flags`
			`# (BEGIN TRUSTED CERTIFICATE)`
- Changed the packaged bundle to use the flexible p11-kit-object-v1 file format, as a preparation to fix bugs in the interaction between p11-kit-trust and Mozilla applications, such as Firefox, Thunderbird etc. - Changed update-ca-trust to add comments to extracted PEM format files. - Added an utility to help with comparing output of the trust dump command. 2017-02-13 20:04:08 +00:00			`/usr/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite --comment $DEST/openssl/ca-bundle.trust.crt`
			`/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose server-auth $DEST/pem/tls-ca-bundle.pem`
			`/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose email $DEST/pem/email-ca-bundle.pem`
			`/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --comment --purpose code-signing $DEST/pem/objsign-ca-bundle.pem`
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9 - Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369. 2013-03-08 23:09:26 +00:00			`/usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts`
Extract certificate bundle in EDK2 format 2018-06-11 11:57:17 +00:00			`/usr/bin/p11-kit extract --format=edk2-cacerts --filter=ca-anchors --overwrite --purpose=server-auth $DEST/edk2/cacerts.bin`