Revert to the unmodified upstream CA list, changing the legacy trust to an empty list. Keeping the ca-legacy tool and existing config, however, the configuration has no effect after this change.

This commit is contained in:
Kai Engert 2016-08-18 14:11:51 +02:00
parent 02204a071d
commit 552fa4a6d3
3 changed files with 44 additions and 2889 deletions

View File

@ -39,7 +39,7 @@ Name: ca-certificates
Version: 2016.2.9
# for Rawhide, please always use release >= 2
# for Fedora release branches, please use release < 2 (1.0, 1.1, ...)
Release: 2%{?dist}
Release: 3%{?dist}
License: Public Domain
Group: System Environment/Base
@ -141,6 +141,9 @@ EOF
fi
done
touch %{legacy_default_bundle}
NUM_LEGACY_DEFAULT=`find certs/legacy-default -type f | wc -l`
if [ $NUM_LEGACY_DEFAULT -ne 0 ]; then
for f in certs/legacy-default/*.crt; do
echo "processing $f"
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
@ -156,7 +159,11 @@ EOF
openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_default_bundle}
fi
done
fi
touch %{legacy_disable_bundle}
NUM_LEGACY_DISABLE=`find certs/legacy-disable -type f | wc -l`
if [ $NUM_LEGACY_DISABLE -ne 0 ]; then
for f in certs/legacy-disable/*.crt; do
echo "processing $f"
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
@ -172,6 +179,7 @@ EOF
openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_disable_bundle}
fi
done
fi
P11FILES=`find certs -name *.p11-kit | wc -l`
if [ $P11FILES -ne 0 ]; then
@ -382,6 +390,11 @@ fi
%changelog
* Tue Aug 16 2016 Kai Engert <kaie@redhat.com> - 2016.2.9-3
- Revert to the unmodified upstream CA list, changing the legacy trust
to an empty list. Keeping the ca-legacy tool and existing config,
however, the configuration has no effect after this change.
* Tue Aug 16 2016 Kai Engert <kaie@redhat.com> - 2016.2.9-2
- Update to CKBI 2.9 from NSS 3.26 with legacy modifications

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff