diff options
Diffstat (limited to 'meta/recipes-support/ca-certificates')
| -rw-r--r-- | meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch | 80 | ||||
| -rw-r--r-- | meta/recipes-support/ca-certificates/ca-certificates/0001-certdata2pem.py-use-python3.patch | 37 | ||||
| -rw-r--r-- | meta/recipes-support/ca-certificates/ca-certificates/sbindir.patch | 20 | ||||
| -rw-r--r-- | meta/recipes-support/ca-certificates/ca-certificates/update-ca-certificates-support-Toybox.patch | 34 | ||||
| -rw-r--r-- | meta/recipes-support/ca-certificates/ca-certificates_20211016.bb (renamed from meta/recipes-support/ca-certificates/ca-certificates_20190110.bb) | 37 |
5 files changed, 98 insertions, 110 deletions
diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch new file mode 100644 index 0000000000..5c4a32f526 --- /dev/null +++ b/meta/recipes-support/ca-certificates/ca-certificates/0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch @@ -0,0 +1,80 @@ +From cb43ec15b700b25f3c4fe44043a1a021aaf5b768 Mon Sep 17 00:00:00 2001 +From: Alexander Kanavin <alex@linutronix.de> +Date: Mon, 18 Oct 2021 12:05:49 +0200 +Subject: [PATCH] Revert "mozilla/certdata2pem.py: print a warning for expired + certificates." + +This avoids a dependency on python3-cryptography, and only checks +for expired certs (which is upstream concern, but not ours). + +Upstream-Status: Inappropriate [oe-core specific] +Signed-off-by: Alexander Kanavin <alex@linutronix.de> +--- + debian/changelog | 1 - + debian/control | 2 +- + mozilla/certdata2pem.py | 11 ----------- + 3 files changed, 1 insertion(+), 13 deletions(-) + +diff --git a/debian/changelog b/debian/changelog +index 531e4d0..4006509 100644 +--- a/debian/changelog ++++ b/debian/changelog +@@ -37,7 +37,6 @@ ca-certificates (20211004) unstable; urgency=low + - "Trustis FPS Root CA" + - "Staat der Nederlanden Root CA - G3" + * Blacklist expired root certificate "DST Root CA X3" (closes: #995432) +- * mozilla/certdata2pem.py: print a warning for expired certificates. + + -- Julien Cristau <jcristau@debian.org> Thu, 07 Oct 2021 17:12:47 +0200 + +diff --git a/debian/control b/debian/control +index 4434b7a..5c6ba24 100644 +--- a/debian/control ++++ b/debian/control +@@ -3,7 +3,7 @@ Section: misc + Priority: optional + Maintainer: Julien Cristau <jcristau@debian.org> + Build-Depends: debhelper-compat (= 13), po-debconf +-Build-Depends-Indep: python3, openssl, python3-cryptography ++Build-Depends-Indep: python3, openssl + Standards-Version: 4.5.0.2 + Vcs-Git: https://salsa.debian.org/debian/ca-certificates.git + Vcs-Browser: https://salsa.debian.org/debian/ca-certificates +diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py +index ede23d4..7d796f1 100644 +--- a/mozilla/certdata2pem.py ++++ b/mozilla/certdata2pem.py +@@ -21,16 +21,12 @@ + # USA. + + import base64 +-import datetime + import os.path + import re + import sys + import textwrap + import io + +-from cryptography import x509 +- +- + objects = [] + + # Dirty file parser. +@@ -121,13 +117,6 @@ for obj in objects: + if obj['CKA_CLASS'] == 'CKO_CERTIFICATE': + if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]: + continue +- +- cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) +- if cert.not_valid_after < datetime.datetime.now(): +- print('!'*74) +- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL']) +- print('!'*74) +- + bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\ + .replace(' ', '_')\ + .replace('(', '=')\ +-- +2.20.1 + diff --git a/meta/recipes-support/ca-certificates/ca-certificates/0001-certdata2pem.py-use-python3.patch b/meta/recipes-support/ca-certificates/ca-certificates/0001-certdata2pem.py-use-python3.patch deleted file mode 100644 index aa2c85ff43..0000000000 --- a/meta/recipes-support/ca-certificates/ca-certificates/0001-certdata2pem.py-use-python3.patch +++ /dev/null @@ -1,37 +0,0 @@ -From b6d18ca77f131cdcaa10d0eaa9d303399767edf6 Mon Sep 17 00:00:00 2001 -From: Alexander Kanavin <alex.kanavin@gmail.com> -Date: Wed, 28 Aug 2019 19:18:14 +0200 -Subject: [PATCH] certdata2pem.py: use python3 - -Comments in that file imply it is already py3 compatible. - -Upstream-Status: Pending -Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> ---- - mozilla/Makefile | 2 +- - mozilla/certdata2pem.py | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/mozilla/Makefile b/mozilla/Makefile -index 6f46118..f98877c 100644 ---- a/mozilla/Makefile -+++ b/mozilla/Makefile -@@ -3,7 +3,7 @@ - # - - all: -- python certdata2pem.py -+ python3 certdata2pem.py - - clean: - -rm -f *.crt -diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py -index 0b02b2a..7d796f1 100644 ---- a/mozilla/certdata2pem.py -+++ b/mozilla/certdata2pem.py -@@ -1,4 +1,4 @@ --#!/usr/bin/python -+#!/usr/bin/python3 - # vim:set et sw=4: - # - # certdata2pem.py - splits certdata.txt into multiple files diff --git a/meta/recipes-support/ca-certificates/ca-certificates/sbindir.patch b/meta/recipes-support/ca-certificates/ca-certificates/sbindir.patch deleted file mode 100644 index a113fa8b15..0000000000 --- a/meta/recipes-support/ca-certificates/ca-certificates/sbindir.patch +++ /dev/null @@ -1,20 +0,0 @@ -Upstream-Status: Pending - -Let us alter the install destination of the script via SBINDIR - ---- ca-certificates-20130119.orig/sbin/Makefile -+++ ca-certificates-20130119/sbin/Makefile -@@ -3,9 +3,12 @@ - # - # - -+SBINDIR = /usr/sbin -+ - all: - - clean: - - install: -- install -m755 update-ca-certificates $(DESTDIR)/usr/sbin/ -+ install -d $(DESTDIR)$(SBINDIR) -+ install -m755 update-ca-certificates $(DESTDIR)$(SBINDIR)/ diff --git a/meta/recipes-support/ca-certificates/ca-certificates/update-ca-certificates-support-Toybox.patch b/meta/recipes-support/ca-certificates/ca-certificates/update-ca-certificates-support-Toybox.patch deleted file mode 100644 index 6e2171f758..0000000000 --- a/meta/recipes-support/ca-certificates/ca-certificates/update-ca-certificates-support-Toybox.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 30378026d136efa779732e3f6664e2ecf461e458 Mon Sep 17 00:00:00 2001 -From: Patrick Ohly <patrick.ohly@intel.com> -Date: Thu, 17 Mar 2016 12:38:09 +0100 -Subject: [PATCH] update-ca-certificates: support Toybox - -"mktemp -t" is deprecated and does not work when using Toybox. Replace -with something that works also with Toybox. - -Upstream-Status: Pending - -Signed-off-by: Patrick Ohly <patrick.ohly@intel.com> ---- - sbin/update-ca-certificates | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates -index 79c41bb..ae9e3f1 100755 ---- a/sbin/update-ca-certificates -+++ b/sbin/update-ca-certificates -@@ -113,9 +113,9 @@ trap cleanup 0 - - # Helper files. (Some of them are not simple arrays because we spawn - # subshells later on.) --TEMPBUNDLE="$(mktemp -t "${CERTBUNDLE}.tmp.XXXXXX")" --ADDED="$(mktemp -t "ca-certificates.tmp.XXXXXX")" --REMOVED="$(mktemp -t "ca-certificates.tmp.XXXXXX")" -+TEMPBUNDLE="$(mktemp -p${TMPDIR:-/tmp} "${CERTBUNDLE}.tmp.XXXXXX")" -+ADDED="$(mktemp -p${TMPDIR:-/tmp} "ca-certificates.tmp.XXXXXX")" -+REMOVED="$(mktemp -p${TMPDIR:-/tmp} "ca-certificates.tmp.XXXXXX")" - - # Adds a certificate to the list of trusted ones. This includes a symlink - # in /etc/ssl/certs to the certificate file and its inclusion into the --- -2.1.4 diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20190110.bb b/meta/recipes-support/ca-certificates/ca-certificates_20211016.bb index ce3cb217a1..99abe60613 100644 --- a/meta/recipes-support/ca-certificates/ca-certificates_20190110.bb +++ b/meta/recipes-support/ca-certificates/ca-certificates_20211016.bb @@ -4,27 +4,26 @@ SSL-based applications to check for the authenticity of SSL connections. \ This derived from Debian's CA Certificates." HOMEPAGE = "http://packages.debian.org/sid/ca-certificates" SECTION = "misc" -LICENSE = "GPL-2.0+ & MPL-2.0" -LIC_FILES_CHKSUM = "file://debian/copyright;md5=aeb420429b1659507e0a5a1b123e8308" +LICENSE = "GPL-2.0-or-later & MPL-2.0" +LIC_FILES_CHKSUM = "file://debian/copyright;md5=ae5b36b514e3f12ce1aa8e2ee67f3d7e" # This is needed to ensure we can run the postinst at image creation time DEPENDS = "" -DEPENDS_class-native = "openssl-native" -DEPENDS_class-nativesdk = "openssl-native" +DEPENDS:class-native = "openssl-native" +DEPENDS:class-nativesdk = "openssl-native" # Need rehash from openssl and run-parts from debianutils PACKAGE_WRITE_DEPS += "openssl-native debianutils-native" -SRCREV = "c28799b138b044c963d24c4a69659b6e5486e3be" +SRCREV = "07de54fdcc5806bde549e1edf60738c6bccf50e8" -SRC_URI = "git://salsa.debian.org/debian/ca-certificates.git;protocol=https \ +SRC_URI = "git://salsa.debian.org/debian/ca-certificates.git;protocol=https;branch=master \ file://0002-update-ca-certificates-use-SYSROOT.patch \ file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \ - file://update-ca-certificates-support-Toybox.patch \ file://default-sysroot.patch \ - file://sbindir.patch \ file://0003-update-ca-certificates-use-relative-symlinks-from-ET.patch \ - file://0001-certdata2pem.py-use-python3.patch \ + file://0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch \ " +UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+)" S = "${WORKDIR}/git" @@ -35,7 +34,7 @@ EXTRA_OEMAKE = "\ 'SBINDIR=${sbindir}' \ " -do_compile_prepend() { +do_compile:prepend() { oe_runmake clean } @@ -58,7 +57,7 @@ do_install () { } >${D}${sysconfdir}/ca-certificates.conf } -do_install_append_class-target () { +do_install:append:class-target () { sed -i -e 's,/etc/,${sysconfdir}/,' \ -e 's,/usr/share/,${datadir}/,' \ -e 's,/usr/local,${prefix}/local,' \ @@ -66,25 +65,25 @@ do_install_append_class-target () { ${D}${mandir}/man8/update-ca-certificates.8 } -pkg_postinst_${PN}_class-target () { +pkg_postinst:${PN}:class-target () { SYSROOT="$D" $D${sbindir}/update-ca-certificates } -CONFFILES_${PN} += "${sysconfdir}/ca-certificates.conf" +CONFFILES:${PN} += "${sysconfdir}/ca-certificates.conf" # Rather than make a postinst script that works for both target and nativesdk, # we just run update-ca-certificate from do_install() for nativesdk. -CONFFILES_${PN}_append_class-nativesdk = " ${sysconfdir}/ssl/certs/ca-certificates.crt" -do_install_append_class-nativesdk () { +CONFFILES:${PN}:append:class-nativesdk = " ${sysconfdir}/ssl/certs/ca-certificates.crt" +do_install:append:class-nativesdk () { SYSROOT="${D}${SDKPATHNATIVE}" ${D}${sbindir}/update-ca-certificates } -do_install_append_class-native () { +do_install:append:class-native () { SYSROOT="${D}${base_prefix}" ${D}${sbindir}/update-ca-certificates } -RDEPENDS_${PN}_class-target = "openssl-bin" -RDEPENDS_${PN}_class-native = "openssl-native" -RDEPENDS_${PN}_class-nativesdk = "nativesdk-openssl-bin" +RDEPENDS:${PN}:append:class-target = " openssl-bin openssl" +RDEPENDS:${PN}:append:class-native = " openssl-native" +RDEPENDS:${PN}:append:class-nativesdk = " nativesdk-openssl-bin nativesdk-openssl" BBCLASSEXTEND = "native nativesdk" |