- versioned Obsoletes

diff --git a/blacklist.patch b/blacklist.patch
new file mode 100644 (file)
index 0000000..8b087f2
--- /dev/null
+++ b/blacklist.patch
@@ -0,0 +1,7 @@
+--- ca-certificates/mozilla/blacklist.txt.orig 2023-03-11 09:37:33.000000000 +0100
++++ ca-certificates/mozilla/blacklist.txt      2023-03-12 18:49:47.285310067 +0100
+@@ -4,3 +4,4 @@
+ "Explicitly Distrust DigiNotar Root CA"
+ 
+ # Expired CAs
++"Security Communication Root CA"

diff --git a/ca-certificates-etc-certs.patch b/ca-certificates-etc-certs.patch
index 8d25f7c38d5c1ffc6ecdba82546232bb1445f8a4..6e30546aca8488f56cd1cce1011caba861318b4c 100644 (file)
--- a/ca-certificates-etc-certs.patch
+++ b/ca-certificates-etc-certs.patch
@@ -1,7 +1,7 @@
 --- ca-certificates-20140223/sbin/update-ca-certificates~      2014-03-14 12:55:24.000000000 +0200
 +++ ca-certificates-20140223/sbin/update-ca-certificates       2014-03-14 14:38:31.587876211 +0200
-@@ -37,7 +37,7 @@
- 
+@@ -37,8 +37,8 @@
+ default=0
  CERTSCONF=/etc/ca-certificates.conf
  CERTSDIR=/usr/share/ca-certificates
 -LOCALCERTSDIR=/usr/local/share/ca-certificates
@@ -9,15 +9,16 @@
 +LOCALCERTSDIR=/etc/certs
 +CERTBUNDLE=/etc/certs/ca-certificates.crt
  ETCCERTSDIR=@openssldir@
- cd $ETCCERTSDIR
+ HOOKSDIR=/etc/ca-certificates/update.d
+ 
 @@ -52,7 +52,7 @@
  
  # Helper files.  (Some of them are not simple arrays because we spawn
  # subshells later on.)
--TEMPBUNDLE="$(mktemp -t "${CERTBUNDLE}.tmp.XXXXXX")"
-+TEMPBUNDLE="$(mktemp "${CERTBUNDLE}.tmp.XXXXXX")"
- ADDED="$(mktemp -t "ca-certificates.tmp.XXXXXX")"
- REMOVED="$(mktemp -t "ca-certificates.tmp.XXXXXX")"
+-TEMPBUNDLE="${ETCCERTSDIR}/${CERTBUNDLE}.new"
++TEMPBUNDLE="${CERTBUNDLE}.new"
+ ADDED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
+ REMOVED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
  
 @@ -62,7 +62,7 @@
  # bundle.
@@ -39,7 +40,7 @@
      rm -f "$PEM"
 @@ -111,24 +111,18 @@
  
- sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $CERTSCONF | while read crt
+ sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read -r crt
  do
 -  if ! test -f "$CERTSDIR/$crt"
 +  if test -f "$CERTSDIR/$crt"
@@ -60,12 +61,12 @@
 -# administrator.
 -if [ -d "$LOCALCERTSDIR" ]
 -then
--  find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read crt
+-  find -L "$LOCALCERTSDIR" -type f -name '*.crt' | sort | while read -r crt
 -  do
 -    add "$crt"
 -  done
 -fi
 -
- rm -f "$CERTBUNDLE"
- 
  ADDED_CNT=$(wc -l < "$ADDED")
+ REMOVED_CNT=$(wc -l < "$REMOVED")
+ 

diff --git a/ca-certificates-undebianize.patch b/ca-certificates-undebianize.patch
index 125661e6bcad8a55ebe654c9c927e83bb0a4d2de..6013e8846179aa4bde2fd9a9beb468771b313b0d 100644 (file)
--- a/ca-certificates-undebianize.patch
+++ b/ca-certificates-undebianize.patch
@@ -19,7 +19,7 @@
 -  echo "Running hooks in $HOOKSDIR..."
 -  VERBOSE_ARG=
 -  [ "$verbose" = 0 ] || VERBOSE_ARG="--verbose"
--  eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read hook
+-  eval run-parts "$VERBOSE_ARG" --test -- "$HOOKSDIR" | while read -r hook
 -  do
 -    ( cat "$ADDED"
 -      cat "$REMOVED" ) | "$hook" || echo "E: $hook exited with code $?."
@@ -40,19 +40,10 @@
  .SH SYNOPSIS
  .B update-ca-certificates
  .RI [ options ]
-@@ -26,7 +26,7 @@ This manual page documents briefly the
- command.
- .PP
- \fBupdate-ca-certificates\fP is a program that updates the directory
--/etc/ssl/certs to hold SSL certificates and generates ca-certificates.crt,
-+@openssldir@ to hold SSL certificates and generates ca-certificates.crt,
- a concatenated single-file list of certificates.
- .PP
- It reads the file /etc/ca-certificates.conf. Each line gives a pathname of
 @@ -38,11 +38,6 @@
- .PP
- Furthermore all certificates with a .crt extension found below
- /usr/local/share/ca-certificates are also included as implicitly trusted.
+ should be one certificate per file, and not multiple certificates in a single
+ file. Then run update-ca-certificates to merge the new certificates into the
+ existing machine store at /etc/ssl/certs.
 -.PP
 -Before terminating, \fBupdate-ca-certificates\fP invokes
 -\fBrun-parts\fP on /etc/ca-certificates/update.d and calls each hook with
@@ -61,19 +52,21 @@
  .SH OPTIONS
  A summary of options is included below.
  .TP
-@@ -53,13 +48,13 @@
- Be verbose. Output \fBc_rehash\fP.
+@@ -61,7 +61,7 @@
+ Be verbose. Output \fBopenssl rehash\fP.
  .TP
  .B \-f, \-\-fresh
 -Fresh updates.  Remove symlinks in /etc/ssl/certs directory.
 +Fresh updates.  Remove symlinks in @openssldir@ directory.
- .SH FILES
  .TP
+ .B \-\-certsconf
+ Change the configuration file. By default, the file
+@@ -84,7 +84,7 @@
  .I /etc/ca-certificates.conf
  A configuration file.
  .TP
 -.I /etc/ssl/certs/ca-certificates.crt
 +.I /etc/openssl/ca-certificates.crt
- A single-file version of CA certificates.  This holds
- all CA certificates that you activated in /etc/ca-certificates.conf.
+ A single-file version of CA certificates. This holds all CA certificates
+ that were activated in /etc/ca-certificates.conf.
  .TP

diff --git a/ca-certificates.d.patch b/ca-certificates.d.patch
index c8b9d3af3f1c368ca091cc73b744f92ecd555177..2c91adb2ed0cea2c0808258c9ed9bb78de88f2fd 100644 (file)
--- a/ca-certificates.d.patch
+++ b/ca-certificates.d.patch
@@ -17,12 +17,12 @@
  LOCALCERTSDIR=${DESTDIR}${LOCALCERTSDIR}
  CERTBUNDLE=${DESTDIR}${CERTBUNDLE}
 @@ -105,25 +106,30 @@
- 
- echo -n "Updating certificates in $ETCCERTSDIR... "
+   done
+ fi
  
 -# Handle certificates that should be removed.  This is an explicit act
 -# by prefixing lines in the configuration files with exclamation marks (!).
--sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read crt
+-sed -n -e '/^$/d' -e 's/^!//p' "$CERTSCONF" | while read -r crt
 -do
 -  remove "$CERTSDIR/$crt"
 -done
@@ -32,12 +32,12 @@
 +
 +  # Handle certificates that should be removed.  This is an explicit act
 +  # by prefixing lines in the configuration files with exclamation marks (!).
-+  sed -n -e '/^$/d' -e 's/^!//p' $conf | while read crt
++  sed -n -e '/^$/d' -e 's/^!//p' $conf | while read -r crt
 +  do
 +    remove "$CERTSDIR/$crt"
 +  done
  
--sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read crt
+-sed -e '/^$/d' -e '/^#/d' -e '/^!/d' "$CERTSCONF" | while read -r crt
 -do
 -  if test -f "$CERTSDIR/$crt"
 -   then
@@ -49,7 +49,7 @@
 -    echo "W: $CERTSDIR/$crt or $LOCALCERTSDIR/$crt not found, but listed in $CERTSCONF." >&2
 -    continue
 -  fi
-+  sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $conf | while read crt
++  sed -e '/^$/d' -e '/^#/d' -e '/^!/d' $conf | while read -r crt
 +  do
 +    if test -f "$CERTSDIR/$crt"
 +    then
@@ -64,4 +64,4 @@
 +  done
  done
  
- rm -f "$CERTBUNDLE"
+ ADDED_CNT=$(wc -l < "$ADDED")

diff --git a/ca-certificates.spec b/ca-certificates.spec
index 619d69f06f31fc4c92982fbb46a140097fe35d4e..6c24859dff8c080b8211996dd40003693b05a86a 100644 (file)
--- a/ca-certificates.spec
+++ b/ca-certificates.spec
@@ -1,5 +1,4 @@
 # TODO
-# - cleanup dead links from /etc/openssl/certs after -update uninstall
 # - https://bugzilla.mozilla.org/show_bug.cgi?id=549701 and
 #   http://groups.google.com/group/mozilla.dev.security.policy/browse_thread/thread/b6493a285ba79998#
 # - make amsn use system certs
@@ -12,37 +11,15 @@
 Summary:       Common CA Certificates PEM files
 Summary(pl.UTF-8):     Pliki PEM popularnych certyfikatów CA
 Name:          ca-certificates
-%define        ver_date        20200601
+%define        ver_date        20240203
 Version:       %{ver_date}
 Release:       1
 License:       GPL v2 (scripts), MPL v2 (mozilla certs), distributable (other certs)
 Group:         Base
 Source0:       http://ftp.debian.org/debian/pool/main/c/ca-certificates/%{name}_%{version}.tar.xz
-# Source0-md5: 9b37bd1bc002d9f041c0a811667cb65a
+# Source0-md5: 228129ccf8cd99b991d771c44dd4052c
 Source2:       http://www.certum.pl/keys/CA.pem
 # Source2-md5: 35610177afc9c64e70f1ce62c1885496
-Source3:       http://www.certum.pl/keys/level1.pem
-# Source3-md5: ba2d2e234ef9cfd2e6e5f810c964862e
-Source4:       http://www.certum.pl/keys/level2.pem
-# Source4-md5: d06578a04e8cb23071f3870430ea0cf0
-Source5:       http://www.certum.pl/keys/level3.pem
-# Source5-md5: 47b67c63a52236576fc0d1150327c962
-Source6:       http://www.certum.pl/keys/level4.pem
-# Source6-md5: f1f8a65d177745311a1e99f029ae5d71
-Source7:       http://www.certum.pl/keys/vs.pem
-# Source7-md5: 8da19ffc48c5dcc2868b1aa55f1d5983
-Source8:       http://www.certum.pl/keys/na.pem
-# Source8-md5: ba571cb35e7672ff7ae95132ac1bfec4
-Source9:       http://www.certum.pl/keys/tsa.pem
-# Source9-md5: 1a7b3faf8ed00f4d80297de74862e102
-Source10:      http://www.certum.pl/keys/class1.pem
-# Source10-md5:        058436b132ea2df6972821f546104a16
-Source11:      http://www.certum.pl/keys/class2.pem
-# Source11-md5:        5caf7fe99b1fc6e63c40b3d081711d1b
-Source12:      http://www.certum.pl/keys/class3.pem
-# Source12-md5:        07bc97e21da092ba53535c7379e1b58b
-Source13:      http://www.certum.pl/keys/class4.pem
-# Source13-md5:        99ef61d509539af89f1c025b67245965
 Source14:      http://www.certum.pl/CTNCA.pem
 # Source14-md5:        231b5b8bf05c5e93a9b2ebc4186eb6f7
 Source15:      http://repository.certum.pl/class1casha2.pem
@@ -57,22 +34,10 @@ Source18:   http://repository.certum.pl/evcasha2.pem
 ## Source19-md5:       88ce64a84375c95ab6f7c8515dd2a117
 Source20:      http://repository.certum.pl/gscasha2.pem
 # Source20-md5:        a29d37f95dafc08cef36015922e3b0d3
-Source21:      http://crt.tcs.terena.org/TERENASSLCA.crt
-# Source21-md5:        f62cd1546a8ef14e31ba1ce8eecd234a
-Source22:      http://crt.tcs.terena.org/TERENAeScienceSSLCA.crt
-# Source22-md5:        5feea35ab01a373f115219706f1f57bd
 Source23:      http://crt.tcs.terena.org/TERENAPersonalCA.crt
 # Source23-md5:        53eaa497c8fb0b79f14fe9f69693689a
 Source24:      http://crt.tcs.terena.org/TERENAeSciencePersonalCA.crt
 # Source24-md5:        e25cc655d3ebe920ca9c187e3dde9191
-Source25:      http://crt.tcs.terena.org/TERENACodeSigningCA.crt
-# Source25-md5:        74c9f511ab03a4e6b7462e310abfa89b
-Source26:      http://www.sk.ee/upload/files/JUUR-SK.PEM.cer
-# Source26-md5:        805784c06c9eff3771a4b9bd631cd3f5
-Source27:      http://www.sk.ee/upload/files/ESTEID-SK.PEM.cer
-# Source27-md5:        387beee5b8539ab7d91628f486295899
-Source28:      http://www.sk.ee/upload/files/ESTEID-SK%202007.PEM.cer?/ESTEID-SK_2007.PEM.cer
-# Source28-md5:        2b1a2a77f565d68fdf5f19f6cc3a5600
 Source29:      http://www.sk.ee/upload/files/ESTEID-SK%202011.pem.cer?/ESTEID-SK_2011.pem.cer
 # Source29-md5:        cfcc1e592cb0ff305158a7e32730546c
 Source30:      http://www.terena.org/activities/tcs/repository/sha2/TERENA_SSL_CA_2.pem
@@ -92,20 +57,22 @@ Source36:   http://www.terena.org/activities/tcs/repository-g3/TERENA_SSL_High_Ass
 Patch0:                %{name}-undebianize.patch
 Patch1:                %{name}-more-certs.patch
 Patch2:                %{name}-etc-certs.patch
-
-Patch5:                %{name}-DESTDIR.patch
-Patch6:                %{name}.d.patch
-Patch7:                no-openssl-rehash.patch
+Patch3:                %{name}-DESTDIR.patch
+Patch4:                %{name}.d.patch
+Patch5:                no-openssl-rehash.patch
+Patch6:                blacklist.patch
 URL:           https://packages.debian.org/sid/ca-certificates
 BuildRequires: openssl-tools
-BuildRequires: python >= 1:2.6
-BuildRequires: python-modules
+BuildRequires: python3
+BuildRequires: python3-cryptography
+BuildRequires: python3-packaging
+BuildRequires: python3-modules
 BuildRequires: rpm >= 4.4.9-56
 BuildRequires: sed >= 4.0
 BuildRequires: tar >= 1:1.22
 BuildRequires: unzip
 BuildRequires: xz
-Obsoletes:     certificates
+Obsoletes:     certificates < 1.2
 BuildArch:     noarch
 BuildRoot:     %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
 
@@ -138,30 +105,19 @@ Skrypt i dane do odświeżania bazy certyfikatów CA.
 
 %prep
 %setup -qc
-cd work
+cd ca-certificates
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
-
+%patch3 -p1
+%patch4 -p1
 %patch5 -p1
 %patch6 -p1
-%patch7 -p1
 
 %{__sed} -i -e 's,@openssldir@,%{openssldir},' sbin/update-ca-certificates*
 
 install -d certum
 cp -pi %{SOURCE2} certum
-cp -pi %{SOURCE3} certum
-cp -pi %{SOURCE4} certum
-cp -pi %{SOURCE5} certum
-cp -pi %{SOURCE6} certum
-cp -pi %{SOURCE7} certum
-cp -pi %{SOURCE8} certum
-cp -pi %{SOURCE9} certum
-cp -pi %{SOURCE10} certum
-cp -pi %{SOURCE11} certum
-cp -pi %{SOURCE12} certum
-cp -pi %{SOURCE13} certum
 cp -pi %{SOURCE14} certum
 cp -pi %{SOURCE15} certum
 cp -pi %{SOURCE16} certum
@@ -174,24 +130,15 @@ for a in certum/*.pem; do
 done
 
 # http://www.sk.ee/en/Repository/certs/rootcertificates
-# JUUR-SK, ESTEID-SK and ESTEID-SK 2007, ESTEID-SK 2011
+# ESTEID-SK 2011
 install -d esteid
-cp -pi %{SOURCE26} esteid
-cp -pi %{SOURCE27} esteid
-cp -pi %{SOURCE28} esteid/ESTEID-SK_2007.crt
 cp -pi %{SOURCE29} esteid/ESTEID-SK_2011.crt
-for a in esteid/*.PEM.cer; do
-       mv -i "$a" "${a%.PEM.cer}.crt"
-done
 
 %build
-cd work
+cd ca-certificates
 install -d terena
-openssl x509 -inform DER -in %{SOURCE21} -outform PEM -out terena/$(basename %{SOURCE21})
-openssl x509 -inform DER -in %{SOURCE22} -outform PEM -out terena/$(basename %{SOURCE22})
 openssl x509 -inform DER -in %{SOURCE23} -outform PEM -out terena/$(basename %{SOURCE23})
 openssl x509 -inform DER -in %{SOURCE24} -outform PEM -out terena/$(basename %{SOURCE24})
-openssl x509 -inform DER -in %{SOURCE25} -outform PEM -out terena/$(basename %{SOURCE25})
 cp %{SOURCE30} terena/$(basename %{SOURCE30} .pem).crt
 cp %{SOURCE31} terena/$(basename %{SOURCE31} .pem).crt
 cp %{SOURCE32} terena/$(basename %{SOURCE32} .pem).crt
@@ -205,12 +152,33 @@ sed 's/\r//' %{SOURCE36} > terena/$(basename %{SOURCE36} .pem).crt
 # We have those and more in specific dirs
 %{__rm} mozilla/Certum*.crt
 
+make_sure_expired_and_rm() {
+       cert="$1"
+       rm -rf pld-tests
+       install -d pld-tests
+       cat "$cert" |  awk '/^-+BEGIN/ { i++; } /^-+BEGIN/, /^-+END/ { print > "pld-tests/" i ".extracted.crt" }'
+       for tmpcert in pld-tests/*.extracted.crt; do
+               # check expiration date
+               EXPDATE=$(openssl x509 -enddate -noout -in "$tmpcert")
+               EXPDATE=${EXPDATE#notAfter=}
+               EXPDATETIMESTAMP=$(date +"%s" -d "$EXPDATE")
+               NOWTIMESTAMP=$(date +"%s")
+               # mksh is 32bit only
+               if /usr/bin/test "$EXPDATETIMESTAMP" -ge "$NOWTIMESTAMP"; then
+                       echo "$cert ($tmpcert): not expired! ${EXPDATE}"
+                       return 1
+               fi
+       done
+       rm "$cert"
+       return 0
+}
+
 # See TODO
 # %{__rm} mozilla/RSA_Security_1024_v3.crt
 
 %install
 rm -rf $RPM_BUILD_ROOT
-cd work
+cd ca-certificates
 install -d $RPM_BUILD_ROOT{%{_datadir}/%{name},%{_sbindir},%{certsdir},/etc/pki/tls/certs,%{_sysconfdir}/ca-certificates.d}
 %{__make} install \
        DESTDIR=$RPM_BUILD_ROOT
@@ -237,7 +205,23 @@ cd pld-tests
 cat $RPM_BUILD_ROOT%{certsdir}/ca-certificates.crt | awk '/^-+BEGIN/ { i++; } /^-+BEGIN/, /^-+END/ { print > i ".extracted.crt" }'
 for cert in *.extracted.crt; do
        openssl x509 -in "$cert" -noout -sha1 -fingerprint > "$cert.fingerprint"
+
+
+       # check expiration date
+       EXPDATE=$(openssl x509 -enddate -noout -in "$cert")
+       EXPDATE=${EXPDATE#notAfter=}
+       EXPDATETIMESTAMP=$(date +"%s" -d "$EXPDATE")
+       NOWTIMESTAMP=$(date +"%s")
+       # mksh is 32bit only
+       if /usr/bin/test "$EXPDATETIMESTAMP" -lt "$NOWTIMESTAMP"; then
+               echo "!!! Expired certificate: $cert"
+               openssl x509 -subject -issuer -startdate -enddate -email -alias -noout -in "$cert"
+               echo "Fingerprint: $(cat "$cert.fingerprint")"
+               echo "\n\n"
+               exit 1
+       fi
 done
+
 DUPLICATES=$(sort *.fingerprint | uniq -c | sort -nr | awk ' { if ($1 != 1) { print $0; } } ')
 if [ -n "$DUPLICATES" ]; then
        echo -e "\n\nFound duplicates for certificates (count, type, fingerprint):\n\n$DUPLICATES\n\nFailing..."
@@ -257,16 +241,25 @@ rm -rf $RPM_BUILD_ROOT
 %post update
 %{_sbindir}/update-ca-certificates --fresh || :
 
+%postun update
+/usr/bin/find "%{openssldir}" -xtype l -delete || :
+
+%pretrans -p <lua>
+local mode = posix.stat("/etc/ssl/certs")
+if mode and mode["type"] == "link" then
+       posix.unlink("/etc/ssl/certs")
+end
+
 %files
 %defattr(644,root,root,755)
-%doc work/debian/{README.Debian,changelog}
+%doc ca-certificates/debian/{README.Debian,changelog}
 %dir /etc/pki/tls
 %dir /etc/pki/tls/certs
 %dir /etc/ssl
 %dir /etc/ssl/certs
 /etc/ssl/certs/ca-certificates.crt
 %config(noreplace) %verify(not md5 mtime size) /etc/pki/tls/certs/ca-bundle.crt
-%config(noreplace) %verify(not md5 mtime size) %{certsdir}/ca-certificates.crt
+%verify(not md5 mtime size) %{certsdir}/ca-certificates.crt
 
 %files update
 %defattr(644,root,root,755)