Changeset 02e3bbc8


Ignore:
Timestamp:
01/02/2019 05:30:48 AM (5 years ago)
Author:
DJ Lucas <dj@…>
Branches:
10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 8.4, 9.0, 9.1, bdubbs/svn, kea, ken/inkscape-core-mods, lazarus, lxqt, plabs/python-mods, qt5new, trunk, upgradedb, xry111/intltool, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal
Children:
e130fead
Parents:
64be6a1
Message:

Update to make-ca-1.2 and adjust p11-kit configuration for new copy-trust-modifications script.
Correct weekly cron job commands for update-pciids.sh and update-usbids.sh, as well as add update-pki.sh.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@20905 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:
7 edited

Legend:

Unmodified
Added
Removed

  • general.ent

    r64be6a1 r02e3bbc8  
    11<!-- $LastChangedBy$ $Date$ -->
    22
    3 <!ENTITY day          "01">                   <!-- Always 2 digits -->
     3<!ENTITY day          "02">                   <!-- Always 2 digits -->
    44<!ENTITY month        "01">                   <!-- Always 2 digits -->
    55<!ENTITY year         "2019">
    … …  
    77<!ENTITY copyholder   "The BLFS Development Team">
    88<!ENTITY version      "&year;-&month;-&day;">
    9 <!ENTITY releasedate  "January 1st, &year;">
     9<!ENTITY releasedate  "January 2nd, &year;">
    1010<!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
    1111<!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->

  • general/sysutils/pciutils.xml

    r64be6a1 r02e3bbc8  
    163163/usr/sbin/update-pciids</literal>
    164164EOF
    165 chmod 754 /etc/cron.weekly/update-pciids</userinput></screen>
     165chmod 754 /etc/cron.weekly/update-pciids.sh</userinput></screen>
    166166
    167167<screen role="root" revision="systemd"><userinput>cat &gt; /lib/systemd/system/update-pciids.service &lt;&lt; "EOF" &amp;&amp;

  • general/sysutils/usbutils.xml

    r64be6a1 r02e3bbc8  
    168168/usr/bin/wget http://www.linux-usb.org/usb.ids -O /usr/share/hwdata/usb.ids</literal>
    169169EOF
    170 chmod 754 /etc/cron.weekly/update-usbids</userinput></screen>
     170chmod 754 /etc/cron.weekly/update-usbids.sh</userinput></screen>
    171171
    172172<screen role="root" revision="systemd"><userinput>cat &gt; /lib/systemd/system/update-usbids.service &lt;&lt; "EOF" &amp;&amp;

  • introduction/welcome/changelog.xml

    r64be6a1 r02e3bbc8  
    4343-->
    4444    <listitem>
     45      <para>January 2nd, 2019</para>
     46      <itemizedlist>
     47        <listitem>
     48          <para>[dj] - Update to make-ca-1.2 and adjust p11-kit configuration
     49          for new copy-trust-modifications script.</para>
     50        </listitem>
     51        <listitem>
     52          <para>[dj] - Correct weekly cron job commands for update-pciids.sh
     53          and update-usbids.sh, as well as add update-pki.sh.</para>
     54        </listitem>
     55      </itemizedlist>
     56    </listitem>
     57
     58    <listitem>
    4559      <para>January 1st, 2019</para>
    4660      <itemizedlist>

  • packages.ent

    r64be6a1 r02e3bbc8  
    2525<!ENTITY linux-pam-docs-version       "1.2.0">
    2626<!ENTITY libpwquality-version         "1.4.0">
    27 <!ENTITY make-ca-version              "1.1">
     27<!ENTITY make-ca-version              "1.2">
    2828<!ENTITY mitkrb-major-version         "1.16">
    2929<!ENTITY mitkrb-version               "1.16.2">

  • postlfs/security/make-ca.xml

    r64be6a1 r02e3bbc8  
    1212  <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/releases/download/v&make-ca-version;/make-ca-&make-ca-version;.tar.xz">
    1313  <!ENTITY make-ca-size          "28 KB">
    14   <!ENTITY make-ca-md5sum        "417a8ebfb3d6ac4821c1e508a0a3981f">
     14  <!ENTITY make-ca-md5sum        "5b68cf77b02d5681f8419b8acfd139c0">
    1515]>
    1616
    … …  
    174174    either manually, or via a <phrase revision="sysv">cron job.</phrase>
    175175    <phrase revision="systemd">systemd timer. A timer is installed at
    176     <filename>/etc/systemd/system/update-pki.timer</filename> that, if enabled,
    177     will check for updates weekly.</phrase></para>
     176    <filename>/usr/lib/systemd/system/update-pki.timer</filename> that, if
     177    enabled, will check for updates weekly. </phrase><phrase revision="sysv">If
     178    you've installed <xref linkend="fcron"/> and completed the section on
     179    periodic jobs, execute</phrase><phrase revision="systemd">Execute</phrase>
     180    the following commands, as the
     181    <systemitem class="username">root</systemitem> user, to
     182    <phrase revision="sysv">create a weekly cron job:</phrase>
     183    <phrase revision="systemd">enable the systemd timer:</phrase>
     184    </para>
     185
     186<screen role="root" revision="sysv"><userinput>cat &gt; /etc/cron.weekly/update-pki.sh &lt;&lt; "EOF" &amp;&amp;
     187<literal>#!/bin/bash
     188/usr/sbin/make-ca -g</literal>
     189EOF
     190chmod 754 /etc/cron.weekly/update-pki.sh</userinput></screen>
     191
     192<screen role="root" revision="systemd"><userinput>systemctl enable update-pki.timer</userinput></screen>
    178193
    179194  </sect2>

  • postlfs/security/p11-kit.xml

    r64be6a1 r02e3bbc8  
    9898<screen><userinput>sed '20,$ d' -i trust/trust-extract-compat.in &amp;&amp;
    9999cat &gt;&gt; trust/trust-extract-compat.in &lt;&lt; "EOF"
    100 <literal># LFS uses make-ca to manage certificates
    101 if [ -f /etc/make-ca.conf ]; then
    102     . /etc/make-ca.conf
    103 else
    104     #Use defaults if make-ca.conf does not exist
    105     ANCHORDIR="/etc/pki/anchors"
    106     ANCHORLIST="/etc/pki/anchors.txt"
    107     LOCALDIR="/etc/ssl/local"
    108     CERTLIST=""
    109 fi
    110 
    111 # Create a list of certificates not present at previous run
    112 for ca in `/bin/ls -1 --color=none "${ANCHORDIR}"` ; do
    113     /bin/grep "${ca}" "${ANCHORLIST}" 2>&amp;1>/dev/null || CERTLIST="${CERTLIST} ${ca}"
    114 done
    115 
    116 # Dump to a temporary directory
    117 TEMPDIR=`mktemp -d`
    118 /usr/bin/trust extract --filter=certificates --format=openssl-directory --overwrite \
    119     "${TEMPDIR}"
    120 
    121 # Copy new certificates to LOCALDIR
    122 for certificate in `echo "${CERTLIST}"` ; do
    123     LABEL=`/bin/grep -m 1 "label:" "${ANCHORDIR}/${certificate}"`
    124     LABELNEW=`echo "${LABEL}" | /bin/sed -e 's@^label: @@' -e 's@"@@g' -e 's@ @_@g'`
    125     cp -v "${TEMPDIR}/${LABELNEW}.pem" "${LOCALDIR}"
    126     unset LABEL LABELNEW
    127 done
    128 
    129 # Clean up
    130 rm -rf "${TEMPDIR}"
    131 unset ANCHORDIR ANCHORLIST LOCALDIR CERTLIST TEMPDIR
     100<literal># Copy existing anchor modifications to /etc/ssl/local
     101/usr/libexec/make-ca/copy-trust-modifications
    132102
    133103# Generate a new trust store
    134 /usr/sbin/make-ca -f</literal>
     104/usr/sbin/make-ca -f -g</literal>
    135105EOF</userinput></screen>
    136106
Note: See TracChangeset for help on using the changeset viewer.