* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9
- Major rework for the Fedora SharedSystemCertificates feature. - Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format. - Require the p11-kit package that contains tools to automatically create other file format bundles. - Convert old file locations to symbolic links that point to dynamically generated files. - Old files, which might have been locally modified, will be saved in backup files with .rpmsave extension. - Added a update-ca-certificates script which can be used to regenerate the merged trusted output. - Refer to the various README files that have been added for more detailed explanation of the new system. - No longer require rsc for building. - Add explanation for the future version numbering scheme, because the old numbering scheme was based on upstream using cvs, which is no longer true, and therefore can no longer be used. - Includes changes from rhbz#873369.
This commit is contained in:
Kai Engert
parent
0ecb427592
commit
d538ada99c
5
README.etc
Normal file
5
README.etc
Normal file
@ -0,0 +1,5 @@
|
||||
This directory /etc/pki/ca-trust is used by a system of consolidated
|
||||
CA certificates.
|
||||
|
||||
Please refer to the separate README files in the subdirectories
|
||||
named "source" and "extracted".
|
||||
18
README.extr
Normal file
18
README.extr
Normal file
@ -0,0 +1,18 @@
|
||||
This directory /etc/pki/ca-trust/extracted/ contains
|
||||
CA certificate bundle files which are automatically created.
|
||||
|
||||
If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
|
||||
then you can use these files in your application to load a list of global
|
||||
root CA certificates.
|
||||
|
||||
Please never manually edit the files stored in this directory,
|
||||
because your changes will be lost and the files automatically overwritten,
|
||||
each time the update-ca-trust command gets executed.
|
||||
|
||||
In order to install new trusted or distrusted certificates,
|
||||
please rather install them in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
Please refer to the README files in those directories to learn
|
||||
how to install new files.
|
||||
29
README.java
Normal file
29
README.java
Normal file
@ -0,0 +1,29 @@
|
||||
This directory /etc/pki/ca-trust/extracted/java/ contains
|
||||
CA certificate bundle files which are automatically created
|
||||
based on the information found in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
All files are in the java keystore file format.
|
||||
|
||||
Distrust information cannot be represented in this file format,
|
||||
and distrusted certificates are missing from these files.
|
||||
|
||||
File cacerts contains CA certificates
|
||||
trusted for TLS server authentication.
|
||||
|
||||
If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
|
||||
then you can use these files in your application to load a list of global
|
||||
root CA certificates.
|
||||
|
||||
Please never manually edit the files stored in this directory,
|
||||
because your changes will be lost and the files automatically overwritten,
|
||||
each time the update-ca-trust command gets executed.
|
||||
|
||||
In order to install new trusted or distrusted certificates,
|
||||
please rather install them in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
Please refer to the README files in those directories to learn
|
||||
how to install new files.
|
||||
27
README.openssl
Normal file
27
README.openssl
Normal file
@ -0,0 +1,27 @@
|
||||
This directory /etc/pki/ca-trust/extracted/openssl/ contains
|
||||
CA certificate bundle files which are automatically created
|
||||
based on the information found in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
All files are in the BEGIN/END TRUSTED CERTIFICATE file format,
|
||||
as described in the x509(1) manual page.
|
||||
|
||||
File /ca-bundle.trust.crt contains the full set of all trusted
|
||||
or distrusted certificates, including the associated trust flags.
|
||||
|
||||
If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
|
||||
then you can use these files in your application to load a list of global
|
||||
root CA certificates.
|
||||
|
||||
Please never manually edit the files stored in this directory,
|
||||
because your changes will be lost and the files automatically overwritten,
|
||||
each time the update-ca-trust command gets executed.
|
||||
|
||||
In order to install new trusted or distrusted certificates,
|
||||
please rather install them in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
Please refer to the README files in those directories to learn
|
||||
how to install new files.
|
||||
36
README.pem
Normal file
36
README.pem
Normal file
@ -0,0 +1,36 @@
|
||||
This directory /etc/pki/ca-trust/extracted/pem/ contains
|
||||
CA certificate bundle files which are automatically created
|
||||
based on the information found in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
All files are in the BEGIN/END CERTIFICATE file format,
|
||||
as decribed in the x509(1) manual page.
|
||||
|
||||
Distrust information cannot be represented in this file format,
|
||||
and distrusted certificates are missing from these files.
|
||||
|
||||
File tls-ca-bundle.pem contains CA certificates
|
||||
trusted for TLS server authentication.
|
||||
|
||||
File email-ca-bundle.pem contains CA certificates
|
||||
trusted for E-Mail protection.
|
||||
|
||||
File objsign-ca-bundle.pem contains CA certificates
|
||||
trusted for code signing.
|
||||
|
||||
If your application isn't able to load the PKCS#11 module p11-kit-trust.so,
|
||||
then you can use these files in your application to load a list of global
|
||||
root CA certificates.
|
||||
|
||||
Please never manually edit the files stored in this directory,
|
||||
because your changes will be lost and the files automatically overwritten,
|
||||
each time the update-ca-trust command gets executed.
|
||||
|
||||
In order to install new trusted or distrusted certificates,
|
||||
please rather install them in the
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
directories.
|
||||
|
||||
Please refer to the README files in those directories to learn
|
||||
how to install new files.
|
||||
27
README.src
Normal file
27
README.src
Normal file
@ -0,0 +1,27 @@
|
||||
This directory /etc/pki/ca-trust/source/ contains CA certificates and
|
||||
trust settings in the PEM file format. The trust settings found here will be
|
||||
interpreted with a high priority, higher than the ones found in
|
||||
/usr/share/pki/ca-trust-source/.
|
||||
|
||||
You may install additional certificates or bundles into this directory.
|
||||
|
||||
Each file may contain one or many certificates and trust flags in a
|
||||
PEM file format, as documented in the x509(1) manual page.
|
||||
Allowed formats are:
|
||||
- The BEGIN/END CERTIFICATE file format.
|
||||
Such certificates will be trusted for TLS server auth, only.
|
||||
- The BEGIN/END TRUSTED CERTIFICATE file format.
|
||||
Such certificates will be trusted or distrusted according to the
|
||||
trust settings contained in the PEM format data blocks.
|
||||
|
||||
Applications that are able to use PKCS#11 modules can dynamically use
|
||||
the merged set of certificates from
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source/
|
||||
by loading p11-kit-trust.so
|
||||
|
||||
Applications that rely on a static file for a list of trusted CAs
|
||||
may load one of the files found in the /etc/pki/ca-trust/extracted
|
||||
directory. After modifying the set of files stored in the
|
||||
/usr/share/pki/ca-trust-source/ or /etc/pki/ca-trust/source/
|
||||
are modified, it is required to run the ca-update-trust command,
|
||||
in order to update the merged files in /etc/pki/ca-trust/extracted/ .
|
||||
27
README.usr
Normal file
27
README.usr
Normal file
@ -0,0 +1,27 @@
|
||||
This directory /usr/share/pki/ca-trust-source/ contains CA certificates and
|
||||
trust settings in the PEM file format. The trust settings found here will be
|
||||
interpreted with a low priority, lower than the ones found in
|
||||
/etc/pki/ca-trust/source.
|
||||
|
||||
You may install additional certificates or bundles into this directory.
|
||||
|
||||
Each file may contain one or many certificates and trust flags in a
|
||||
PEM file format, as documented in the x509(1) manual page.
|
||||
Allowed formats are:
|
||||
- The BEGIN/END CERTIFICATE file format.
|
||||
Such certificates will be trusted for TLS server auth, only.
|
||||
- The BEGIN/END TRUSTED CERTIFICATE file format.
|
||||
Such certificates will be trusted or distrusted according to the
|
||||
trust settings contained in the PEM format data blocks.
|
||||
|
||||
Applications that are able to use PKCS#11 modules can dynamically use
|
||||
the merged set of certificates from
|
||||
/usr/share/pki/ca-trust-source/ and /etc/pki/ca-trust/source
|
||||
by loading p11-kit-trust.so
|
||||
|
||||
Applications that rely on a static file for a list of trusted CAs
|
||||
may load one of the files found in the /etc/pki/ca-trust/extracted
|
||||
directory. After modifying the set of files stored in the
|
||||
/usr/share/pki/ca-trust-source/ or /etc/pki/ca-trust/source
|
||||
are modified, it is required to run the ca-update-trust command,
|
||||
in order to update the merged files in /etc/pki/ca-trust/extracted .
|
||||
@ -12,33 +12,72 @@
|
||||
# release branch for the certdata.txt version.
|
||||
|
||||
%define pkidir %{_sysconfdir}/pki
|
||||
%define catrustdir %{_sysconfdir}/pki/ca-trust
|
||||
%define classic_tls_bundle ca-bundle.crt
|
||||
%define trusted_all_bundle ca-bundle.trust.crt
|
||||
%define java_bundle java/cacerts
|
||||
|
||||
Summary: The Mozilla CA root certificate bundle
|
||||
Name: ca-certificates
|
||||
|
||||
# For the package version number, we use: year.{upstream version}
|
||||
#
|
||||
# The {upstream version} can be found as symbol NSS_BUILTINS_LIBRARY_VERSION at
|
||||
# http://hg.mozilla.org/projects/nss/file/default/lib/ckfw/builtins/nssckbi.h
|
||||
# which corresponds to
|
||||
# http://hg.mozilla.org/projects/nss/file/default/lib/ckfw/builtins/certdata.txt
|
||||
# (these revisions are the tip of development and might be unreleased).
|
||||
# For the latest release used in RTM versions of Mozilla Firefox, check:
|
||||
# https://hg.mozilla.org/releases/mozilla-release/file/default/security/nss/lib/ckfw/builtins/nssckbi.h
|
||||
# https://hg.mozilla.org/releases/mozilla-release/file/default/security/nss/lib/ckfw/builtins/certdata.txt
|
||||
#
|
||||
# (until 2012.87 the version was based on the cvs revision ID of certdata.txt,
|
||||
# but in 2013 the NSS projected was migrated to HG. Old version 2012.87 is
|
||||
# equivalent to new version 2012.1.93, which would break the requirement
|
||||
# to have increasing version numbers. However, the new scheme will work,
|
||||
# because all future versions will start with 2013 or larger.)
|
||||
|
||||
Version: 2012.87
|
||||
Release: 2%{?dist}.1
|
||||
Release: 9%{?dist}
|
||||
License: Public Domain
|
||||
|
||||
Group: System Environment/Base
|
||||
URL: http://www.mozilla.org/
|
||||
|
||||
Source0: certdata.txt
|
||||
Source1: blacklist.txt
|
||||
Source1: update-ca-trust
|
||||
Source2: generate-cacerts.pl
|
||||
Source3: certdata2pem.py
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
||||
BuildRequires: perl, java-openjdk, python, rcs, openssl
|
||||
Source11: README.usr
|
||||
Source12: README.etc
|
||||
Source13: README.extr
|
||||
Source14: README.java
|
||||
Source15: README.openssl
|
||||
Source16: README.pem
|
||||
Source17: README.src
|
||||
|
||||
BuildArch: noarch
|
||||
|
||||
Requires: p11-kit >= 0.16.3
|
||||
Requires: p11-kit-trust >= 0.16.3
|
||||
BuildRequires: perl
|
||||
BuildRequires: java-openjdk
|
||||
BuildRequires: python
|
||||
BuildRequires: openssl
|
||||
|
||||
%description
|
||||
This package contains the set of CA certificates chosen by the
|
||||
Mozilla Foundation for use with the Internet PKI.
|
||||
|
||||
%prep
|
||||
rm -rf %{name}
|
||||
mkdir %{name} %{name}/certs %{name}/java
|
||||
mkdir %{name}
|
||||
mkdir %{name}/certs
|
||||
mkdir %{name}/java
|
||||
|
||||
%build
|
||||
pushd %{name}/certs
|
||||
cp %{SOURCE0} %{SOURCE1} .
|
||||
cp %{SOURCE0} .
|
||||
python %{SOURCE3}
|
||||
popd
|
||||
pushd %{name}
|
||||
@ -46,18 +85,6 @@ pushd %{name}
|
||||
cat <<EOF
|
||||
# This is a bundle of X.509 certificates of public Certificate
|
||||
# Authorities. It was generated from the Mozilla root CA list.
|
||||
#
|
||||
# Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt
|
||||
#
|
||||
# Generated from:
|
||||
EOF
|
||||
ident -q %{SOURCE0} | sed '1d;s/^/#/';
|
||||
echo '#';
|
||||
) > ca-bundle.crt
|
||||
(
|
||||
cat <<EOF
|
||||
# This is a bundle of X.509 certificates of public Certificate
|
||||
# Authorities. It was generated from the Mozilla root CA list.
|
||||
# These certificates are in the OpenSSL "TRUSTED CERTIFICATE"
|
||||
# format and have trust bits set accordingly.
|
||||
#
|
||||
@ -67,67 +94,188 @@ EOF
|
||||
EOF
|
||||
ident -q %{SOURCE0} | sed '1d;s/^/#/';
|
||||
echo '#';
|
||||
) > ca-bundle.trust.crt
|
||||
) > %{trusted_all_bundle}
|
||||
for f in certs/*.crt; do
|
||||
tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
|
||||
case $tbits in
|
||||
*serverAuth*) openssl x509 -text -in "$f" >> ca-bundle.crt ;;
|
||||
esac
|
||||
distbits=`sed -n '/^# openssl-distrust/{s/^.*=//;p;}' $f`
|
||||
targs=""
|
||||
if [ -n "$tbits" ]; then
|
||||
targs=""
|
||||
for t in $tbits; do
|
||||
targs="${targs} -addtrust $t"
|
||||
done
|
||||
openssl x509 -text -in "$f" -trustout $targs >> ca-bundle.trust.crt
|
||||
fi
|
||||
if [ -n "$distbits" ]; then
|
||||
for t in $distbits; do
|
||||
targs="${targs} -addreject $t"
|
||||
done
|
||||
fi
|
||||
if [ -n "$targs" ]; then
|
||||
openssl x509 -text -in "$f" -trustout $targs >> %{trusted_all_bundle}
|
||||
fi
|
||||
done
|
||||
popd
|
||||
pushd %{name}/java
|
||||
test -s ../ca-bundle.crt || exit 1
|
||||
%{__perl} %{SOURCE2} %{_bindir}/keytool ../ca-bundle.crt
|
||||
touch -r %{SOURCE0} cacerts
|
||||
popd
|
||||
|
||||
|
||||
%install
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT{%{pkidir}/tls/certs,%{pkidir}/java}
|
||||
|
||||
install -p -m 644 %{name}/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt
|
||||
install -p -m 644 %{name}/ca-bundle.trust.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt
|
||||
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/tls/certs
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/java
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/java
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source
|
||||
install -p -m 644 %{name}/ca-bundle.trust.crt $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/ca-bundle.trust.crt
|
||||
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/ca-bundle.trust.crt
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{_bindir}
|
||||
|
||||
ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
|
||||
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt
|
||||
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt
|
||||
install -p -m 644 %{SOURCE11} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/README
|
||||
install -p -m 644 %{SOURCE12} $RPM_BUILD_ROOT%{catrustdir}/README
|
||||
install -p -m 644 %{SOURCE13} $RPM_BUILD_ROOT%{catrustdir}/extracted/README
|
||||
install -p -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{catrustdir}/extracted/java/README
|
||||
install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/README
|
||||
install -p -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/README
|
||||
install -p -m 644 %{SOURCE17} $RPM_BUILD_ROOT%{catrustdir}/source/README
|
||||
|
||||
# Install Java cacerts file.
|
||||
mkdir -p -m 700 $RPM_BUILD_ROOT%{pkidir}/java
|
||||
install -p -m 644 %{name}/java/cacerts $RPM_BUILD_ROOT%{pkidir}/java/
|
||||
install -p -m 644 %{name}/%{trusted_all_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
|
||||
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
|
||||
|
||||
# TODO: consider to dynamically create the update-ca-trust script from within
|
||||
# this .spec file, in order to have the output file+directory names at once place only.
|
||||
install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_bindir}/update-ca-trust
|
||||
|
||||
# touch ghosted files that will be extracted dynamically
|
||||
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
|
||||
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
|
||||
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
|
||||
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{trusted_all_bundle}
|
||||
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
|
||||
|
||||
# /etc/ssl/certs symlink for 3rd-party tools
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl
|
||||
ln -s ../pki/tls/certs $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs
|
||||
ln -s ../pki/tls/certs \
|
||||
$RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs
|
||||
# legacy filenames
|
||||
ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
|
||||
$RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
|
||||
ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
|
||||
$RPM_BUILD_ROOT%{pkidir}/tls/certs/%{classic_tls_bundle}
|
||||
ln -s %{catrustdir}/extracted/openssl/%{trusted_all_bundle} \
|
||||
$RPM_BUILD_ROOT%{pkidir}/tls/certs/%{trusted_all_bundle}
|
||||
ln -s %{catrustdir}/extracted/%{java_bundle} \
|
||||
$RPM_BUILD_ROOT%{pkidir}/%{java_bundle}
|
||||
|
||||
|
||||
%clean
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
|
||||
|
||||
%pre
|
||||
if [ $1 -gt 1 ] ; then
|
||||
# Upgrade or Downgrade.
|
||||
# If the classic filename is a regular file, then we are upgrading
|
||||
# from an old package and we will move it to an .rpmsave backup file.
|
||||
# If the filename is a symbolic link, then we are good already.
|
||||
# If the system will later be downgraded to an old package with regular
|
||||
# files, and afterwards updated again to a newer package with symlinks,
|
||||
# and the old .rpmsave backup file didn't get cleaned up,
|
||||
# then we don't backup again. We keep the older backup file.
|
||||
# In other words, if an .rpmsave file already exists, we don't overwrite it.
|
||||
#
|
||||
if ! test -e %{pkidir}/%{java_bundle}.rpmsave; then
|
||||
# no backup yet
|
||||
if ! test -L %{pkidir}/%{java_bundle}; then
|
||||
# it's an old regular file, not a link
|
||||
mv -f %{pkidir}/%{java_bundle} %{pkidir}/%{java_bundle}.rpmsave
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! test -e %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave; then
|
||||
# no backup yet
|
||||
if ! test -L %{pkidir}/tls/certs/%{classic_tls_bundle}; then
|
||||
# it's an old regular file, not a link
|
||||
mv -f %{pkidir}/tls/certs/%{classic_tls_bundle} %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave
|
||||
fi
|
||||
fi
|
||||
|
||||
if ! test -e %{pkidir}/tls/certs/%{trusted_all_bundle}.rpmsave; then
|
||||
# no backup yet
|
||||
if ! test -L %{pkidir}/tls/certs/%{trusted_all_bundle}; then
|
||||
# it's an old regular file, not a link
|
||||
mv -f %{pkidir}/tls/certs/%{trusted_all_bundle} %{pkidir}/tls/certs/%{trusted_all_bundle}.rpmsave
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
%post
|
||||
#if [ $1 -gt 1 ] ; then
|
||||
# # when upgrading or downgrading
|
||||
#fi
|
||||
%{_bindir}/update-ca-trust
|
||||
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
%dir %{pkidir}/java
|
||||
%config(noreplace) %{pkidir}/java/cacerts
|
||||
|
||||
%dir %{_sysconfdir}/ssl
|
||||
%dir %{pkidir}/tls
|
||||
%dir %{pkidir}/tls/certs
|
||||
%config(noreplace) %{pkidir}/tls/certs/ca-bundle.*crt
|
||||
%dir %{pkidir}/java
|
||||
%dir %{catrustdir}
|
||||
%dir %{catrustdir}/source
|
||||
%dir %{catrustdir}/extracted
|
||||
%dir %{catrustdir}/extracted/pem
|
||||
%dir %{catrustdir}/extracted/openssl
|
||||
%dir %{catrustdir}/extracted/java
|
||||
%dir %{_datadir}/pki/ca-trust-source/
|
||||
|
||||
%{_datadir}/pki/ca-trust-source/README
|
||||
%{catrustdir}/README
|
||||
%{catrustdir}/extracted/README
|
||||
%{catrustdir}/extracted/java/README
|
||||
%{catrustdir}/extracted/openssl/README
|
||||
%{catrustdir}/extracted/pem/README
|
||||
%{catrustdir}/source/README
|
||||
|
||||
# symlinks for old locations
|
||||
%{pkidir}/tls/cert.pem
|
||||
%dir %{_sysconfdir}/ssl
|
||||
%{pkidir}/tls/certs/%{classic_tls_bundle}
|
||||
%{pkidir}/tls/certs/%{trusted_all_bundle}
|
||||
%{pkidir}/%{java_bundle}
|
||||
# symlink directory
|
||||
%{_sysconfdir}/ssl/certs
|
||||
%{_datadir}/pki/ca-trust-source/ca-bundle.trust.crt
|
||||
# master bundle file with trust
|
||||
%{_datadir}/pki/ca-trust-source/%{trusted_all_bundle}
|
||||
# update/extract tool
|
||||
%{_bindir}/update-ca-trust
|
||||
# files extracted files
|
||||
%ghost %{catrustdir}/extracted/pem/tls-ca-bundle.pem
|
||||
%ghost %{catrustdir}/extracted/pem/email-ca-bundle.pem
|
||||
%ghost %{catrustdir}/extracted/pem/objsign-ca-bundle.pem
|
||||
%ghost %{catrustdir}/extracted/openssl/%{trusted_all_bundle}
|
||||
%ghost %{catrustdir}/extracted/%{java_bundle}
|
||||
|
||||
|
||||
%changelog
|
||||
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9
|
||||
- Major rework for the Fedora SharedSystemCertificates feature.
|
||||
- Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
|
||||
- Require the p11-kit package that contains tools to automatically create
|
||||
other file format bundles.
|
||||
- Convert old file locations to symbolic links that point to dynamically
|
||||
generated files.
|
||||
- Old files, which might have been locally modified, will be saved in backup
|
||||
files with .rpmsave extension.
|
||||
- Added a update-ca-certificates script which can be used to regenerate
|
||||
the merged trusted output.
|
||||
- Refer to the various README files that have been added for more detailed
|
||||
explanation of the new system.
|
||||
- No longer require rsc for building.
|
||||
- Add explanation for the future version numbering scheme,
|
||||
because the old numbering scheme was based on upstream using cvs,
|
||||
which is no longer true, and therefore can no longer be used.
|
||||
- Includes changes from rhbz#873369.
|
||||
|
||||
* Thu Mar 07 2013 Kai Engert <kaie@redhat.com> - 2012.87-2.fc19.1
|
||||
- Ship trust bundle file in /usr/share/pki/ca-trust-source/, temporarily in addition.
|
||||
This location will soon become the only place containing this file.
|
||||
|
||||
@ -79,41 +79,12 @@ for line in open('certdata.txt', 'r'):
|
||||
if len(obj.items()) > 0:
|
||||
objects.append(obj)
|
||||
|
||||
# Read blacklist.
|
||||
blacklist = []
|
||||
if os.path.exists('blacklist.txt'):
|
||||
for line in open('blacklist.txt', 'r'):
|
||||
line = line.strip()
|
||||
if line.startswith('#') or len(line) == 0:
|
||||
continue
|
||||
item = line.split('#', 1)[0].strip()
|
||||
blacklist.append(item)
|
||||
|
||||
# Build up trust database.
|
||||
trust = dict()
|
||||
trustmap = dict()
|
||||
for obj in objects:
|
||||
|
||||
if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
|
||||
continue
|
||||
if obj['CKA_LABEL'] in blacklist:
|
||||
print "Certificate %s blacklisted, ignoring." % obj['CKA_LABEL']
|
||||
elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
|
||||
trust[obj['CKA_LABEL']] = True
|
||||
elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR':
|
||||
trust[obj['CKA_LABEL']] = True
|
||||
elif obj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR':
|
||||
trust[obj['CKA_LABEL']] = True
|
||||
# NSS recently changed CKT_NSS_UNTRUSTED to CKT_NSS_NOT_TRUSTED
|
||||
elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_UNTRUSTED' or obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED':
|
||||
print '!'*74
|
||||
print "UNTRUSTED BUT NOT BLACKLISTED CERTIFICATE FOUND: %s" % obj['CKA_LABEL']
|
||||
print '!'*74
|
||||
sys.exit(1)
|
||||
else:
|
||||
print "Ignoring certificate %s. SAUTH=%s, EPROT=%s" % \
|
||||
(obj['CKA_LABEL'], obj['CKA_TRUST_SERVER_AUTH'],
|
||||
obj['CKA_TRUST_EMAIL_PROTECTION'])
|
||||
label = obj['CKA_LABEL']
|
||||
trustmap[label] = obj
|
||||
print " added cert", label
|
||||
@ -158,26 +129,32 @@ openssl_trust = {
|
||||
for obj in objects:
|
||||
if obj['CKA_CLASS'] == 'CKO_CERTIFICATE':
|
||||
print "producing cert file for " + obj['CKA_LABEL']
|
||||
if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
|
||||
print " -> untrusted, ignoring"
|
||||
continue
|
||||
fname = obj_to_filename(obj)
|
||||
f = open(fname, 'w')
|
||||
trustbits = []
|
||||
distrustbits = []
|
||||
openssl_trustflags = []
|
||||
openssl_distrustflags = []
|
||||
tobj = trustmap[obj['CKA_LABEL']]
|
||||
for t in trust_types.keys():
|
||||
if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR':
|
||||
trustbits.append(t)
|
||||
if t in openssl_trust:
|
||||
openssl_trustflags.append(openssl_trust[t])
|
||||
if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED':
|
||||
distrustbits.append(t)
|
||||
if t in openssl_trust:
|
||||
openssl_distrustflags.append(openssl_trust[t])
|
||||
f.write("# trust=" + " ".join(trustbits) + "\n")
|
||||
f.write("# distrust=" + " ".join(distrustbits) + "\n")
|
||||
if openssl_trustflags:
|
||||
f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n")
|
||||
if openssl_distrustflags:
|
||||
f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n")
|
||||
f.write("-----BEGIN CERTIFICATE-----\n")
|
||||
f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64)))
|
||||
f.write("\n-----END CERTIFICATE-----\n")
|
||||
print " -> written as '%s', trust = %s, openssl-trust = %s" % (fname, trustbits, openssl_trustflags)
|
||||
print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)
|
||||
|
||||
|
||||
|
||||
|
||||
13
update-ca-trust
Normal file
13
update-ca-trust
Normal file
@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
|
||||
#set -vx
|
||||
|
||||
DEST=/etc/pki/ca-trust/extracted
|
||||
|
||||
# OpenSSL PEM bundle that includes trust flags
|
||||
# (BEGIN TRUSTED CERTIFICATE)
|
||||
/usr/bin/p11-kit extract --format=openssl-bundle --filter=certificates --overwrite $DEST/openssl/ca-bundle.trust.crt
|
||||
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose server-auth $DEST/pem/tls-ca-bundle.pem
|
||||
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
|
||||
/usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
|
||||
/usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
|
||||
Loading…
Reference in New Issue
Block a user