- update to certdata.txt r1.53

ca-certificates.spec

@@ -6,8 +6,8 @@
 
 Summary: The Mozilla CA root certificate bundle
 Name: ca-certificates
-Version: 2008
-Release: 8
+Version: 2009
+Release: 1%{?dist}
 License: Public Domain
 Group: System Environment/Base
 URL: http://www.mozilla.org/
@@ -57,6 +57,9 @@ rm -rf $RPM_BUILD_ROOT
 %{pkidir}/tls/cert.pem
 
 %changelog
+* Wed Jul 22 2009 Joe Orton <jorton@redhat.com> 2009-1
+- update to certdata.txt r1.53
+
 * Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2008-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
 

mkcabundle.pl

@@ -11,6 +11,7 @@ open(IN, "cvs -d $cvsroot co -p $certdata|")
     || die "could not check out certdata.txt";
 
 my $incert = 0;
+my $skipcert = 0;
 
 print<<EOH;
 # This is a bundle of X.509 certificates of public Certificate
@@ -23,13 +24,18 @@ EOH
 while (<IN>) {
     if (/^CKA_VALUE MULTILINE_OCTAL/) {
         $incert = 1;
-        open(OUT, "|openssl x509 -text -inform DER -fingerprint")
-            || die "could not pipe to openssl x509";
+        if (!$skipcert) {
+            open(OUT, "|openssl x509 -text -inform DER -fingerprint")
+                || die "could not pipe to openssl x509";
+        }
     } elsif (/^END/ && $incert) {
-        close(OUT);
+        if (!$skipcert) {
+            close(OUT);
+            print "\n\n";
+        }
         $incert = 0;
-        print "\n\n";
-    } elsif ($incert) {
+        $skipcert = 0;
+    } elsif ($incert && !$skipcert) {
         my @bs = split(/\\/);
         foreach my $b (@bs) {
             chomp $b;
@@ -37,5 +43,8 @@ while (<IN>) {
         }
     } elsif (/^CVS_ID.*Revision: ([^ ]*).*/) {
         print "# Generated from certdata.txt RCS revision $1\n#\n";
+    } elsif (/^CKA_LABEL.*ECC.*/) {
+        # Ugly hack to avoid picking up ECC certs.
+        $skipcert = 1;
     }
 }