Changeset 462878e4

Timestamp:

04/09/2009 06:01:57 AM (15 years ago)

Author:

DJ Lucas <dj@…>

Branches:

10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 7.10, 7.4, 7.5, 7.6, 7.6-blfs, 7.6-systemd, 7.7, 7.8, 7.9, 8.0, 8.1, 8.2, 8.3, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, gnome, kde5-13430, kde5-14269, kde5-14686, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, krejzi/svn, lazarus, lxqt, nosym, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, systemd-11177, systemd-13485, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal

Children:

2f5c01ff

Parents:

fe9bce8

Message:

Moved root certificates handling to OpenSSL page.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@7816 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:

• general.ent (modified) (2 diffs)
• introduction/welcome/changelog.xml (modified) (1 diff)
• postlfs/security/openssl.xml (modified) (6 diffs)
• postlfs/security/rootcerts.xml (deleted)
• postlfs/security/security.xml (modified) (1 diff)

general.ent

@@ -4 +4 @@
 -->
 
-<!ENTITY day          "26">                   <!-- Always 2 digits -->
-<!ENTITY month        "03">                   <!-- Always 2 digits -->
+<!ENTITY day          "09">                   <!-- Always 2 digits -->
+<!ENTITY month        "04">                   <!-- Always 2 digits -->
 <!ENTITY year         "2009">
 <!ENTITY copyrightdate "2001-&year;">
 <!ENTITY copyholder   "The BLFS Development Team">
 <!ENTITY version      "svn-&year;&month;&day;">
-<!ENTITY releasedate  "March &day;th, &year;">
+<!ENTITY releasedate  "April &day;th, &year;">
 <!ENTITY pubdate      "&year;-&month;-&day;"> <!-- metadata req. by TLDP -->
 <!ENTITY blfs-version "svn">                  <!-- svn|[release #] -->
@@ -61 +61 @@
 
 <!ENTITY openssl-version              "0.9.8j">
+<!ENTITY ca-bundle-version            "20090409">
 <!ENTITY gnutls-version               "1.6.3">
 <!ENTITY cracklib-version             "2.8.13">

introduction/welcome/changelog.xml

@@ -42 +42 @@
 -->
     <listitem>
+      <para>April 9th, 2009</para>
+      <itemizedlist>
+        <listitem>
+          <para>[dj] - Removed Root Certificates page and added ca-bundle
+          instructions to OpenSSL page.</para>
+        </listitem>
+      </itemizedlist>
+    </listitem>
+
+    <listitem>
       <para>March 26th, 2009</para>
       <itemizedlist>

postlfs/security/openssl.xml

@@ -9 +9 @@
   <!ENTITY openssl-md5sum        "a5cb5f6c3d11affb387ecf7a997cac0c">
   <!ENTITY openssl-size          "3.7 MB">
-  <!ENTITY openssl-buildsize     "45 MB">
-  <!ENTITY openssl-time          "1.2 SBU (additional 0.3 SBU to run the test suite)">
+  <!ENTITY ca-bundle-download    "http://anduin.linuxfromscratch.org/files/BLFS/BLFS-ca-bundle-&ca-bundle-version;.tar.bz2">
+  <!ENTITY ca-bundle-size        "192 KB">
+  <!ENTITY ca-bundle-md5sum      "a5e85c3df9ef9a192eb5e5cdf94ebb72">
+  <!ENTITY openssl-buildsize     "47 MB">
+  <!ENTITY openssl-time          "1.3 SBU (additional 0.3 SBU to run the test suite)">
 ]>
 
@@ -51 +54 @@
       </listitem>
       <listitem>
+        <para>CA Bundle Download: <ulink url="&ca-bundle-download;"/></para>
+      </listitem>
+      <listitem>
+        <para>CA Bundle size: &ca-bundle-size;</para>
+      </listitem>
+      <listitem>
+        <para>CA Bundle MD5 sum: &ca-bundle-md5sum;</para>
+      </listitem>
+      <listitem>
         <para>Estimated disk space required: &openssl-buildsize;</para>
       </listitem>
@@ -70 +82 @@
     <bridgehead renderas="sect4">Recommended</bridgehead>
     <para role="recommended"><xref linkend="bc"/>(if you run the test suite
-    during the build) and <xref linkend="rootcerts"/></para>
+    during the build)</para>
 
     <bridgehead renderas="sect4">Optional</bridgehead>
@@ -88 +100 @@
 
 <screen><userinput>patch -Np1 -i ../openssl-&openssl-version;-fix_manpages-1.patch &amp;&amp;
+tar -vxf ../BLFS-ca-bundle-&ca-bundle-version;.tar.bz2 &amp;&amp;
 ./config --prefix=/usr         \
          --openssldir=/etc/ssl \
@@ -115 +128 @@
     /usr/share/doc/openssl-&openssl-version;</userinput></screen>
 
+    <para>While still the <systemitem class="username">root</systemitem> user,
+    create a single file that contains all of the installed certificates:</para>
+
+<screen role="root"><userinput>for pem in /etc/ssl/certs/*.pem
+do
+   cat $pem
+   echo ""
+done &gt; /etc/ssl/ca-bundle.crt</userinput></screen>
+
   </sect2>
 
   <sect2 role="commands">
     <title>Command Explanations</title>
+
+    <para>
+    <command>tar -vxf ../BLFS-ca-bundle-&ca-bundle-version;.tar.bz2</command>:
+    OpenSSL no longer includes any root certificates.  This package adds root
+    certificates as provided by mozilla.org.</para>
 
     <para><parameter>shared</parameter>: This parameter forces the creation of
@@ -148 +175 @@
     use of <filename>libz.so</filename> for compression/decompression.</para> -->
 
-    <para><command>cp -v -r certs /etc/ssl</command>: This package no longer
-    ships CA certificates. This commands installs documentation and sample
-    certificates as examples should one want to create/install their own
-    certificates.</para>
+    <para><command>cp -v -r certs /etc/ssl</command>: This installs both the
+    sample certificates and documentation included with OpenSSL, and the
+    certificates that were extrated from the BLFS-ca-bundle-&ca-bundle-version;
+    package.</para>
+
+    <para><command>for pem in /etc/ssl/certs/*.pem...</command>: This group of
+    commands creates a single-file certificate bundle 
+    (<filename>/etc/ssl/ca-bundle.crt</filename>) that is usable by many
+    other software packages.  <filename>ca-bundle.crt</filename> should be
+    recreated anytime that a certificate is added to
+    <filename class="directory">/etc/ssl/certs</filename>.</para>
 
   </sect2>

postlfs/security/security.xml

@@ -40 +40 @@
   "signatures" and compares for files that have been changed.</para>
 
-  <xi:include xmlns:xi="http://www.w3.org/2003/XInclude" href="rootcerts.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2003/XInclude" href="openssl.xml"/>
   <xi:include xmlns:xi="http://www.w3.org/2003/XInclude" href="gnutls.xml"/>