Gentoo Archives: gentoo-commits

From: Lars Wendler <polynomial-c@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] repo/gentoo:master commit in: app-misc/ca-certificates/
Date: Wed, 29 Nov 2017 17:28:01
Message-Id: 1511976473.386e4fab89046a9b6ceedb08ffa780c092e52b13.polynomial-c@gentoo
1 commit: 386e4fab89046a9b6ceedb08ffa780c092e52b13
2 Author: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
3 AuthorDate: Wed Nov 29 17:27:37 2017 +0000
4 Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org>
5 CommitDate: Wed Nov 29 17:27:53 2017 +0000
6 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=386e4fab
7
8 app-misc/ca-certificates: Removed old.
9
10 Package-Manager: Portage-2.3.16, Repoman-2.3.6
11
12 app-misc/ca-certificates/Manifest | 1 -
13 .../ca-certificates-20170717.3.33.ebuild | 190 ---------------------
14 2 files changed, 191 deletions(-)
15
16 diff --git a/app-misc/ca-certificates/Manifest b/app-misc/ca-certificates/Manifest
17 index a11eb1e216a..2d809a4f6bc 100644
18 --- a/app-misc/ca-certificates/Manifest
19 +++ b/app-misc/ca-certificates/Manifest
20 @@ -3,7 +3,6 @@ DIST ca-certificates_20170717.tar.xz 293028 SHA256 e487639b641fa75445174734dd6e9
21 DIST nss-3.30.2.tar.gz 9499119 SHA256 0d4a77ff26bcee79fa8afe0125e0df6ae9e798b6b36782fa29e28febf7cfce24 SHA512 02f14bc000cbde42268c4b6f42df80680b010d1491643ef9b11e0bac31a286a2e7fa251c40cb4ac70b64883a1b90efc64440ef9d797357f8a47cd37195fc5500 WHIRLPOOL b1039f227a55ed9ab592b7e1ea0856c8cf91b8d298ef07d9d0f56d1956319b15c12224f023a100d106101c49dafb16e8231680667d2c7d0b8f8b2bbf6ad3ec8e
22 DIST nss-3.30.tar.gz 9500552 SHA256 a8c0000dae5e992f6563972e26dbfefc50d006dd845c43b8ca24ea50169ff3a9 SHA512 c21e9b5e4b689ea8cbc6f4d7913df43e2a78c4435e0ce092f2ce00e46079ce2268e17ec8527b283ac69eff3d96ff0165a5b42b6579bfe0a720115ff2938260d3 WHIRLPOOL bc0a59484010a5771b515dde1440ccca8a63b167d3d8839b3606460fdf9d2dc3ab7d889173c88edb7d685d39ad3614c4cbc66284d0faced47cdcc01a69997d9a
23 DIST nss-3.32.1.tar.gz 9494609 SHA256 4de59ca7f5bf4a56fbcfdbb4a054f254ba9f408f56476957404a091048624652 SHA512 b377aba822c2955d801022eba1636b71943a64f6e74d5611c2625910d230059383c4dbdedd65e70b356eaea33aeefdd24de3b31d7a4823d921ea475af3dd9da8 WHIRLPOOL 4c15b4ba85ce10787b9ee541d20a829a99aed5628b59f7e7e3045ec694d6d8a0a83bc730ae4d74148cf7c425f59debfd1574cb1b036c1407d1f9d4896647d9cf
24 -DIST nss-3.33.tar.gz 9578033 SHA256 98f0dabd36408e83dd3a11727336cc3cdfee4cbdd9aede2b2831eb2389c284e4 SHA512 82adc0b73805ba5e73b9bf350fffa383a8b4396c05f49edb360a53319b4ad26d928a135bee245f9da009d162129db4441a96ef05346dadac20922b21284468b0 WHIRLPOOL c11129bce97990a41a3118e62d79481fbd38cad51356a6b6c1b0af7efe2f27b3d5d51a8e987287c1cdff77ccee14a3e96d5bbb76e92f9a81b2f50988de250dea
25 DIST nss-3.34.1.tar.gz 9562876 BLAKE2B 645fe06435dffa1a0dec688c7c10854dbd664e719889b36027dc2e52c4f585c2ce7bdcd947dcf5d938013246405c04e1b9dbd802b229e0acc96fc07f321bb51a SHA512 6cc4826df4202e865e903a2ed05b49f708a047347b7b4d58f9b83ed097115a128239c4596a033ddeb9ee3fbfe6345a024e11eacb6149bce2d71fbe82c0a41c63
26 DIST nss-3.34.tar.gz 9586315 BLAKE2B d04fcd46a7bf318b4bab14f316ae53145f415b5abb637205eeedb72f5847d43b76ea5e77485c56e4eaa3d90b850ee4bb18b6d0e42422f94ea0a9f12559263e02 SHA512 72388b596151499850546a68d9a20d82434c59f159564fb7170980f110d43d7026f174f93660d3bb6da79b618fd7d4f1f16246fc80ba568aa555df99ebbaea21
27 DIST nss-cacert-class1-class3.patch 22950 SHA256 6bba29cee34276e2ca6436dabedfeba2b61fb46668c5d5ceabf0c871574649bf SHA512 a5aa740bf110a3f0262e3f1ef2fc739ac2b44f042e220039d48aee8e97cd764d5c10718220364f4098aba955882bd02cadb5481512388971a8290312f88a7df0 WHIRLPOOL 1246223b01292604e5609bb9c580f092dc5937bf8c98f6891b099e8bab960e03612b6617e30a55d6ff8817d88f190e03812fe8f89f84f25c20970493dc2f7700
28
29 diff --git a/app-misc/ca-certificates/ca-certificates-20170717.3.33.ebuild b/app-misc/ca-certificates/ca-certificates-20170717.3.33.ebuild
30 deleted file mode 100644
31 index 7778372001e..00000000000
32 --- a/app-misc/ca-certificates/ca-certificates-20170717.3.33.ebuild
33 +++ /dev/null
34 @@ -1,190 +0,0 @@
35 -# Copyright 1999-2017 Gentoo Foundation
36 -# Distributed under the terms of the GNU General Public License v2
37 -
38 -# The Debian ca-certificates package merely takes the CA database as it exists
39 -# in the nss package and repackages it for use by openssl.
40 -#
41 -# The issue with using the compiled debs directly is two fold:
42 -# - they do not update frequently enough for us to rely on them
43 -# - they pull the CA database from nss tip of tree rather than the release
44 -#
45 -# So we take the Debian source tools and combine them with the latest nss
46 -# release to produce (largely) the same end result. The difference is that
47 -# now we know our cert database is kept in sync with nss and, if need be,
48 -# can be sync with nss tip of tree more frequently to respond to bugs.
49 -
50 -# When triaging bugs from users, here's some handy tips:
51 -# - To see what cert is hitting errors, use openssl:
52 -# openssl s_client -port 443 -CApath /etc/ssl/certs/ -host $HOSTNAME
53 -# Focus on the errors written to stderr.
54 -#
55 -# - Look at the upstream log as to why certs were added/removed:
56 -# https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt
57 -#
58 -# - If people want to add/remove certs, tell them to file w/mozilla:
59 -# https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS&component=CA%20Certificates&version=trunk
60 -
61 -EAPI=6
62 -
63 -PYTHON_COMPAT=( python{2_7,3_4,3_5,3_6} )
64 -
65 -inherit eutils python-any-r1
66 -
67 -if [[ ${PV} == *.* ]] ; then
68 - # Compile from source ourselves.
69 - PRECOMPILED=false
70 - inherit versionator
71 -
72 - DEB_VER=$(get_version_component_range 1)
73 - NSS_VER=$(get_version_component_range 2-)
74 - RTM_NAME="NSS_${NSS_VER//./_}_RTM"
75 -else
76 - # Debian precompiled version.
77 - PRECOMPILED=true
78 - inherit unpacker
79 -fi
80 -
81 -DESCRIPTION="Common CA Certificates PEM files"
82 -HOMEPAGE="https://packages.debian.org/sid/ca-certificates"
83 -NMU_PR=""
84 -if ${PRECOMPILED} ; then
85 - SRC_URI="mirror://debian/pool/main/c/${PN}/${PN}_${PV}${NMU_PR:++nmu}${NMU_PR}_all.deb"
86 -else
87 - SRC_URI="mirror://debian/pool/main/c/${PN}/${PN}_${DEB_VER}${NMU_PR:++nmu}${NMU_PR}.tar.xz
88 - https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/nss-${NSS_VER}.tar.gz
89 - cacert? (
90 - https://dev.gentoo.org/~axs/distfiles/nss-cacert-class1-class3.patch
91 - )"
92 -fi
93 -
94 -LICENSE="MPL-1.1"
95 -SLOT="0"
96 -KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
97 -IUSE="insecure_certs"
98 -${PRECOMPILED} || IUSE+=" cacert"
99 -
100 -DEPEND=""
101 -if ${PRECOMPILED} ; then
102 - DEPEND+=" !<sys-apps/portage-2.1.10.41"
103 -fi
104 -# c_rehash: we run `c_rehash`
105 -# debianutils: we run `run-parts`
106 -RDEPEND="${DEPEND}
107 - app-misc/c_rehash
108 - sys-apps/debianutils"
109 -
110 -if ! ${PRECOMPILED}; then
111 - DEPEND+=" ${PYTHON_DEPS}"
112 -fi
113 -
114 -S=${WORKDIR}
115 -
116 -pkg_setup() {
117 - # For the conversion to having it in CONFIG_PROTECT_MASK,
118 - # we need to tell users about it once manually first.
119 - [[ -f "${EPREFIX}"/etc/env.d/98ca-certificates ]] \
120 - || ewarn "You should run update-ca-certificates manually after etc-update"
121 -}
122 -
123 -src_unpack() {
124 - ${PRECOMPILED} || default
125 -
126 - # Do all the work in the image subdir to avoid conflicting with source
127 - # dirs in $WORKDIR. Need to perform everything in the offset #381937
128 - mkdir -p "image/${EPREFIX}"
129 - cd "image/${EPREFIX}" || die
130 -
131 - ${PRECOMPILED} && unpacker_src_unpack
132 -}
133 -
134 -src_prepare() {
135 - cd "image/${EPREFIX}" || die
136 - if ! ${PRECOMPILED} ; then
137 - mkdir -p usr/sbin
138 - cp -p "${S}"/${PN}/sbin/update-ca-certificates usr/sbin/ || die
139 -
140 - if use cacert ; then
141 - pushd "${S}"/nss-${NSS_VER} >/dev/null
142 - epatch "${DISTDIR}"/nss-cacert-class1-class3.patch
143 - popd >/dev/null
144 - fi
145 - fi
146 -
147 - default
148 - eapply -p2 "${FILESDIR}"/${PN}-20150426-root.patch
149 - local relp=$(echo "${EPREFIX}" | sed -e 's:[^/]\+:..:g')
150 - sed -i \
151 - -e '/="$ROOT/s:ROOT:ROOT'"${EPREFIX}"':' \
152 - -e '/RELPATH="\.\./s:"$:'"${relp}"'":' \
153 - usr/sbin/update-ca-certificates || die
154 -}
155 -
156 -src_compile() {
157 - cd "image/${EPREFIX}" || die
158 - if ! ${PRECOMPILED} ; then
159 - python_setup
160 - local d="${S}/${PN}/mozilla" c="usr/share/${PN}"
161 - # Grab the database from the nss sources.
162 - cp "${S}"/nss-${NSS_VER}/nss/lib/ckfw/builtins/{certdata.txt,nssckbi.h} "${d}" || die
163 - emake -C "${d}"
164 -
165 - # Now move the files to the same places that the precompiled would.
166 - mkdir -p etc/ssl/certs etc/ca-certificates/update.d "${c}"/mozilla
167 - if use cacert ; then
168 - mkdir -p "${c}"/cacert.org
169 - mv "${d}"/CAcert_Inc..crt "${c}"/cacert.org/cacert.org_root.crt || die
170 - fi
171 - mv "${d}"/*.crt "${c}"/mozilla/ || die
172 - else
173 - mv usr/share/doc/{ca-certificates,${PF}} || die
174 - fi
175 -
176 - if ! use insecure_certs ; then
177 - elog "To prevent applications relying on system's trusted root certificate store"
178 - elog "from using CAs where at least one major browser vendor Gentoo is following"
179 - elog "has decided to apply trust level restrictions, the following"
180 - elog "certificate(s) were removed:"
181 - # Remove untrusted certs from StartCom and WoSign (bug #598072)
182 - elog "$(find "${c}" -type f \( \
183 - -iname '*startcom*' \
184 - -o -iname '*wosign*' \
185 - \) -printf '%P removed; see https://bugs.gentoo.org/598072 for details\n' -delete)"
186 - fi
187 -
188 - (
189 - echo "# Automatically generated by ${CATEGORY}/${PF}"
190 - echo "# $(date -u)"
191 - echo "# Do not edit."
192 - cd "${c}"
193 - find * -name '*.crt' | LC_ALL=C sort
194 - ) > etc/ca-certificates.conf
195 -
196 - sh usr/sbin/update-ca-certificates --root "${S}/image" || die
197 -}
198 -
199 -src_install() {
200 - cp -pPR image/* "${D}"/ || die
201 - if ! ${PRECOMPILED} ; then
202 - cd ca-certificates
203 - doman sbin/*.8
204 - dodoc debian/README.* examples/ca-certificates-local/README
205 - fi
206 -
207 - echo 'CONFIG_PROTECT_MASK="/etc/ca-certificates.conf"' > 98ca-certificates
208 - doenvd 98ca-certificates
209 -}
210 -
211 -pkg_postinst() {
212 - if [ -d "${EROOT}/usr/local/share/ca-certificates" ] ; then
213 - # if the user has local certs, we need to rebuild again
214 - # to include their stuff in the db.
215 - # However it's too overzealous when the user has custom certs in place.
216 - # --fresh is to clean up dangling symlinks
217 - "${EROOT}"/usr/sbin/update-ca-certificates --root "${ROOT}"
218 - fi
219 -
220 - if [ -n "$(find -L "${EROOT}"etc/ssl/certs/ -type l)" ] ; then
221 - ewarn "Removing the following broken symlinks:"
222 - ewarn "$(find -L "${EROOT}"/etc/ssl/certs/ -type l -printf '%p -> %l\n' -delete)"
223 - fi
224 -}