X-Git-Url: http://git.pld-linux.org/?a=blobdiff_plain;f=ca-certificates.spec;h=7da43aab7b7c633c5ddef84a0daf67be098b8fdd;hb=b9b07ae7fcb838c911a506b994414acb9bfab8b0;hp=939e6421e20c54177a1018cf6ea9e3e49508ce46;hpb=f1df9d4810de1dfc9221c7238f128330eba0f04a;p=packages%2Fca-certificates.git

diff --git a/ca-certificates.spec b/ca-certificates.spec
index 939e642..7da43aa 100644
--- a/ca-certificates.spec
+++ b/ca-certificates.spec
@@ -1,5 +1,4 @@
 # TODO
-# - cleanup dead links from /etc/openssl/certs after -update uninstall
 # - https://bugzilla.mozilla.org/show_bug.cgi?id=549701 and
 #   http://groups.google.com/group/mozilla.dev.security.policy/browse_thread/thread/b6493a285ba79998#
 # - make amsn use system certs
@@ -12,37 +11,15 @@
 Summary:	Common CA Certificates PEM files
 Summary(pl.UTF-8):	Pliki PEM popularnych certyfikatów CA
 Name:		ca-certificates
-%define	ver_date	20180409
+%define	ver_date	20210119
 Version:	%{ver_date}
-Release:	3
+Release:	1
 License:	GPL v2 (scripts), MPL v2 (mozilla certs), distributable (other certs)
 Group:		Base
 Source0:	http://ftp.debian.org/debian/pool/main/c/ca-certificates/%{name}_%{version}.tar.xz
-# Source0-md5:	8425f4b1219e4e528db2de764e4c6586
+# Source0-md5:	c02582bf9ae338e558617291897615eb
 Source2:	http://www.certum.pl/keys/CA.pem
 # Source2-md5:	35610177afc9c64e70f1ce62c1885496
-Source3:	http://www.certum.pl/keys/level1.pem
-# Source3-md5:	ba2d2e234ef9cfd2e6e5f810c964862e
-Source4:	http://www.certum.pl/keys/level2.pem
-# Source4-md5:	d06578a04e8cb23071f3870430ea0cf0
-Source5:	http://www.certum.pl/keys/level3.pem
-# Source5-md5:	47b67c63a52236576fc0d1150327c962
-Source6:	http://www.certum.pl/keys/level4.pem
-# Source6-md5:	f1f8a65d177745311a1e99f029ae5d71
-Source7:	http://www.certum.pl/keys/vs.pem
-# Source7-md5:	8da19ffc48c5dcc2868b1aa55f1d5983
-Source8:	http://www.certum.pl/keys/na.pem
-# Source8-md5:	ba571cb35e7672ff7ae95132ac1bfec4
-Source9:	http://www.certum.pl/keys/tsa.pem
-# Source9-md5:	1a7b3faf8ed00f4d80297de74862e102
-Source10:	http://www.certum.pl/keys/class1.pem
-# Source10-md5:	058436b132ea2df6972821f546104a16
-Source11:	http://www.certum.pl/keys/class2.pem
-# Source11-md5:	5caf7fe99b1fc6e63c40b3d081711d1b
-Source12:	http://www.certum.pl/keys/class3.pem
-# Source12-md5:	07bc97e21da092ba53535c7379e1b58b
-Source13:	http://www.certum.pl/keys/class4.pem
-# Source13-md5:	99ef61d509539af89f1c025b67245965
 Source14:	http://www.certum.pl/CTNCA.pem
 # Source14-md5:	231b5b8bf05c5e93a9b2ebc4186eb6f7
 Source15:	http://repository.certum.pl/class1casha2.pem
@@ -57,22 +34,10 @@ Source18:	http://repository.certum.pl/evcasha2.pem
 ## Source19-md5:	88ce64a84375c95ab6f7c8515dd2a117
 Source20:	http://repository.certum.pl/gscasha2.pem
 # Source20-md5:	a29d37f95dafc08cef36015922e3b0d3
-Source21:	http://crt.tcs.terena.org/TERENASSLCA.crt
-# Source21-md5:	f62cd1546a8ef14e31ba1ce8eecd234a
-Source22:	http://crt.tcs.terena.org/TERENAeScienceSSLCA.crt
-# Source22-md5:	5feea35ab01a373f115219706f1f57bd
 Source23:	http://crt.tcs.terena.org/TERENAPersonalCA.crt
 # Source23-md5:	53eaa497c8fb0b79f14fe9f69693689a
 Source24:	http://crt.tcs.terena.org/TERENAeSciencePersonalCA.crt
 # Source24-md5:	e25cc655d3ebe920ca9c187e3dde9191
-Source25:	http://crt.tcs.terena.org/TERENACodeSigningCA.crt
-# Source25-md5:	74c9f511ab03a4e6b7462e310abfa89b
-Source26:	http://www.sk.ee/upload/files/JUUR-SK.PEM.cer
-# Source26-md5:	805784c06c9eff3771a4b9bd631cd3f5
-Source27:	http://www.sk.ee/upload/files/ESTEID-SK.PEM.cer
-# Source27-md5:	387beee5b8539ab7d91628f486295899
-Source28:	http://www.sk.ee/upload/files/ESTEID-SK%202007.PEM.cer?/ESTEID-SK_2007.PEM.cer
-# Source28-md5:	2b1a2a77f565d68fdf5f19f6cc3a5600
 Source29:	http://www.sk.ee/upload/files/ESTEID-SK%202011.pem.cer?/ESTEID-SK_2011.pem.cer
 # Source29-md5:	cfcc1e592cb0ff305158a7e32730546c
 Source30:	http://www.terena.org/activities/tcs/repository/sha2/TERENA_SSL_CA_2.pem
@@ -137,7 +102,8 @@ Script and data for updating CA Certificates database.
 Skrypt i dane do odświeżania bazy certyfikatów CA.
 
 %prep
-%setup -q -n %{name}
+%setup -qc
+cd work
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
@@ -150,17 +116,6 @@ Skrypt i dane do odświeżania bazy certyfikatów CA.
 
 install -d certum
 cp -pi %{SOURCE2} certum
-cp -pi %{SOURCE3} certum
-cp -pi %{SOURCE4} certum
-cp -pi %{SOURCE5} certum
-cp -pi %{SOURCE6} certum
-cp -pi %{SOURCE7} certum
-cp -pi %{SOURCE8} certum
-cp -pi %{SOURCE9} certum
-cp -pi %{SOURCE10} certum
-cp -pi %{SOURCE11} certum
-cp -pi %{SOURCE12} certum
-cp -pi %{SOURCE13} certum
 cp -pi %{SOURCE14} certum
 cp -pi %{SOURCE15} certum
 cp -pi %{SOURCE16} certum
@@ -173,23 +128,15 @@ for a in certum/*.pem; do
 done
 
 # http://www.sk.ee/en/Repository/certs/rootcertificates
-# JUUR-SK, ESTEID-SK and ESTEID-SK 2007, ESTEID-SK 2011
+# ESTEID-SK 2011
 install -d esteid
-cp -pi %{SOURCE26} esteid
-cp -pi %{SOURCE27} esteid
-cp -pi %{SOURCE28} esteid/ESTEID-SK_2007.crt
 cp -pi %{SOURCE29} esteid/ESTEID-SK_2011.crt
-for a in esteid/*.PEM.cer; do
-	mv -i "$a" "${a%.PEM.cer}.crt"
-done
 
 %build
+cd work
 install -d terena
-openssl x509 -inform DER -in %{SOURCE21} -outform PEM -out terena/$(basename %{SOURCE21})
-openssl x509 -inform DER -in %{SOURCE22} -outform PEM -out terena/$(basename %{SOURCE22})
 openssl x509 -inform DER -in %{SOURCE23} -outform PEM -out terena/$(basename %{SOURCE23})
 openssl x509 -inform DER -in %{SOURCE24} -outform PEM -out terena/$(basename %{SOURCE24})
-openssl x509 -inform DER -in %{SOURCE25} -outform PEM -out terena/$(basename %{SOURCE25})
 cp %{SOURCE30} terena/$(basename %{SOURCE30} .pem).crt
 cp %{SOURCE31} terena/$(basename %{SOURCE31} .pem).crt
 cp %{SOURCE32} terena/$(basename %{SOURCE32} .pem).crt
@@ -201,13 +148,14 @@ sed 's/\r//' %{SOURCE36} > terena/$(basename %{SOURCE36} .pem).crt
 %{__make}
 
 # We have those and more in specific dirs
-%{__rm} mozilla/{Certum,Deutsche_Telekom_Root_CA_2}*.crt
+%{__rm} mozilla/Certum*.crt
 
 # See TODO
 # %{__rm} mozilla/RSA_Security_1024_v3.crt
 
 %install
 rm -rf $RPM_BUILD_ROOT
+cd work
 install -d $RPM_BUILD_ROOT{%{_datadir}/%{name},%{_sbindir},%{certsdir},/etc/pki/tls/certs,%{_sysconfdir}/ca-certificates.d}
 %{__make} install \
 	DESTDIR=$RPM_BUILD_ROOT
@@ -231,7 +179,7 @@ install -d pld-tests
 cd pld-tests
 
 # check for duplicates (to avoid X509_STORE_add_cert "cert already in hash table" problem)
-cat $RPM_BUILD_ROOT%{certsdir}/ca-certificates.crt | awk '/BEGIN/ { i++; } /BEGIN/, /END/ { print > i ".extracted.crt" }'
+cat $RPM_BUILD_ROOT%{certsdir}/ca-certificates.crt | awk '/^-+BEGIN/ { i++; } /^-+BEGIN/, /^-+END/ { print > i ".extracted.crt" }'
 for cert in *.extracted.crt; do
 	openssl x509 -in "$cert" -noout -sha1 -fingerprint > "$cert.fingerprint"
 done
@@ -245,8 +193,8 @@ cd ..
 
 # The Debian path might be hard-coded in some binaries we cannot fix
 # like the Steam client
-install -d $RPM_BUILD_ROOT/etc/ssl
-ln -s %{certsdir} $RPM_BUILD_ROOT/etc/ssl/certs
+install -d $RPM_BUILD_ROOT/etc/ssl/certs
+ln -s %{certsdir}/ca-certificates.crt $RPM_BUILD_ROOT/etc/ssl/certs
 
 %clean
 rm -rf $RPM_BUILD_ROOT
@@ -254,13 +202,17 @@ rm -rf $RPM_BUILD_ROOT
 %post update
 %{_sbindir}/update-ca-certificates --fresh || :
 
+%postun update
+/usr/bin/find "%{openssldir}" -xtype l -delete || :
+
 %files
 %defattr(644,root,root,755)
-%doc debian/README.Debian debian/changelog
+%doc work/debian/{README.Debian,changelog}
 %dir /etc/pki/tls
 %dir /etc/pki/tls/certs
 %dir /etc/ssl
-/etc/ssl/certs
+%dir /etc/ssl/certs
+/etc/ssl/certs/ca-certificates.crt
 %config(noreplace) %verify(not md5 mtime size) /etc/pki/tls/certs/ca-bundle.crt
 %config(noreplace) %verify(not md5 mtime size) %{certsdir}/ca-certificates.crt