Changeset 254e3bf

Timestamp:

04/13/2019 08:06:50 PM (5 years ago)

Author:

DJ Lucas <dj@…>

Branches:

10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 9.0, 9.1, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal

Children:

f759a25

Parents:

35c18794

Message:

Update to make-ca-1.4.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@21457 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:

• general.ent (modified) (2 diffs)
• introduction/welcome/changelog.xml (modified) (1 diff)
• packages.ent (modified) (1 diff)
• postlfs/security/make-ca.xml (modified) (7 diffs)
• postlfs/security/p11-kit.xml (modified) (1 diff)

general.ent

@@ -1 +1 @@
 <!-- $LastChangedBy$ $Date$ -->
 
-<!ENTITY day          "11">                   <!-- Always 2 digits -->
+<!ENTITY day          "13">                   <!-- Always 2 digits -->
 <!ENTITY month        "04">                   <!-- Always 2 digits -->
 <!ENTITY year         "2019">
@@ -7 +7 @@
 <!ENTITY copyholder   "The BLFS Development Team">
 <!ENTITY version      "&year;-&month;-&day;">
-<!ENTITY releasedate  "April 11th, &year;">
+<!ENTITY releasedate  "April 13th, &year;">
 <!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
 <!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->

introduction/welcome/changelog.xml

@@ -42 +42 @@
     </listitem>
 -->
+    <listitem>
+      <para>April 13th, 2019</para>
+      <itemizedlist>
+        <listitem>
+          <para>[dj] - Update to make-ca-1.4.</para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+
     <listitem>
       <para>April 11th, 2019</para>

packages.ent

@@ -25 +25 @@
 <!ENTITY linux-pam-docs-version       "1.2.0">
 <!ENTITY libpwquality-version         "1.4.0">
-<!ENTITY make-ca-version              "1.2">
+<!ENTITY make-ca-version              "1.4">
 <!ENTITY mitkrb-major-version         "1.17">
 <!ENTITY mitkrb-version               "1.17">

postlfs/security/make-ca.xml

@@ -12 +12 @@
   <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/releases/download/v&make-ca-version;/make-ca-&make-ca-version;.tar.xz">
   <!ENTITY make-ca-size          "28 KB">
-  <!ENTITY make-ca-md5sum        "5b68cf77b02d5681f8419b8acfd139c0">
+  <!ENTITY make-ca-md5sum        "995896ca8b4ee1f92a4a8fa46585d59d">
 ]>
 
@@ -104 +104 @@
     <filename>/etc/ssl/local</filename> will be imported to both the trust
     anchors and the generated certificate stores (overriding Mozilla's
-    trust).</para>
+    trust). Additionally, any modified trust values will be copied from the
+    trust anchors to <filename>/etc/ssl/local</filename> prior to any updates,
+    preserving custom trust values that differ from Mozilla when using the
+    <command>trust</command> utility from <application>p11-kit</application>
+    to operate on the trust store.</para>
 
     <para>To install the various certificate stores, first install the
@@ -110 +114 @@
     As the <systemitem class="username">root</systemitem> user:</para>
 
-<screen role="root"><userinput>make install</userinput></screen>
+<screen role="root"><userinput>make install &amp;&amp;
+install -vdm755 /etc/ssl/local</userinput></screen>
 
    <para>As the <systemitem class="username">root</systemitem> user, after
@@ -136 +141 @@
         /etc/ssl/ca-bundle.crt</userinput></screen>
 
-    <para>You should periodically update the store with the above command
+    <para>You should periodically update the store with the above command,
     either manually, or via a <phrase revision="sysv">cron job.</phrase>
     <phrase revision="systemd">systemd timer. A timer is installed at
@@ -215 +220 @@
     <xref linkend="wget"/> is installed):</para>
 
-<screen role="nodump"><userinput>install -vdm755 /etc/ssl/local &amp;&amp;
-wget http://www.cacert.org/certs/root.crt &amp;&amp;
+<screen role="nodump"><userinput>wget http://www.cacert.org/certs/root.crt &amp;&amp;
 wget http://www.cacert.org/certs/class3.crt &amp;&amp;
 openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \
@@ -223 +227 @@
 openssl x509 -in class3.crt -text -fingerprint -setalias "CAcert Class 3 root" \
         -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
-        > /etc/ssl/local/CAcert_Class_3_root.pem</userinput></screen>
+        > /etc/ssl/local/CAcert_Class_3_root.pem &amp;&amp;
+/usr/sbin/make-ca -r -f</userinput></screen>
 
     <bridgehead renderas="sect3">Overriding Mozilla Trust</bridgehead>
@@ -235 +240 @@
     file, run the following commands:</para>
 
-<screen role="nodump"><userinput>install -vdm755 /etc/ssl/local &amp;&amp;
-openssl x509 -in /etc/ssl/certs/Makebelieve_CA_Root.pem \
+<screen role="nodump"><userinput>openssl x509 -in /etc/ssl/certs/Makebelieve_CA_Root.pem \
              -text \
              -fingerprint 

postlfs/security/p11-kit.xml

@@ -229 +229 @@
             is a command line tool to both extract local certificates from an
             upadated anchor store, and regenerate all anchors and certificate
-            stores on the system.
+            stores on the system. This is done unconditionally on BLFS using
+            the <parameter>--force</parameter> and <parameter>--get</parameter>
+            flags to <command>make-ca</command> and should likely not be used
+            for automated updates.
           </para>
           <indexterm zone="p11-kit update-ca-certificates">
-            <primary sortas="b-trust">update-ca-certificates</primary>
+            <primary sortas="b-update-ca-certificates">update-ca-certificates</primary>
           </indexterm>
         </listitem>