Changeset c1cd435e for postlfs/security/make-ca.xml

Timestamp:

09/06/2018 12:36:36 AM (6 years ago)

Author:

DJ Lucas <dj@…>

Branches:

10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 8.4, 9.0, 9.1, basic, bdubbs/svn, elogind, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, perl-modules, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/test-20220226, xry111/xf86-video-removal

Children:

11759d2

Parents:

4d7d99d

Message:

Update to make-ca-0.9. Fixes #11114.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@20462 af4574ff-66df-0310-9fd7-8a98e5e911e0

File:

• postlfs/security/make-ca.xml (modified) (5 diffs)

postlfs/security/make-ca.xml

@@ -8 +8 @@
   <!ENTITY certpath              "/lib/ckfw/builtins/certdata.txt">
   <!ENTITY make-ca-buildsize     "6.6 MB (with all runtime deps)">
-  <!ENTITY make-ca-time          "0.3 SBU (with all runtime deps)">
+  <!ENTITY make-ca-time          "0.1 SBU (with all runtime deps)">
 
   <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/archive/v&make-ca-version;/make-ca-&make-ca-version;.tar.gz">
   <!ENTITY make-ca-size          "36 KB">
-  <!ENTITY make-ca-md5sum        "1f0176c4fa89274971b2826a97f303f7">
+  <!ENTITY make-ca-md5sum        "0eeaf712eedeae4fa55d8bfa37f4ca32">
 ]>
 
@@ -75 +75 @@
 
     <bridgehead renderas="sect3">make-ca Dependencies</bridgehead>
-<!--
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required"><xref linkend="openssl"/></para>
--->
+
+    <bridgehead renderas="sect4">Recommended</bridgehead>
+    <para role="recommended"><xref linkend="p11-kit"/> (required at runtime to
+    generate certificate stores from trust anchors)</para>
+
    <bridgehead renderas="sect4">Optional (runtime)</bridgehead>
     <para role="optional">
       <xref role="runtime" linkend="java"/> or
-      <xref role="runtime" linkend="openjdk"/>,
-      <xref role="runtime" linkend="nss"/>, and
-      <xref role="runtime" linkend="p11-kit"/>
+      <xref role="runtime" linkend="openjdk"/> (to generate a java PKCS#12
+      store), and <xref role="runtime" linkend="nss"/> (to generate a shared
+      NSSDB)
     </para>
 
@@ -96 +97 @@
     <para>The <application>make-ca</application> script will download and
     process the certificates included in the <filename>certdata.txt</filename>
-    file for use in multiple certificate stores (if the associated applications
-    are present on the system). Additionally, any local certificates stored in
-    <filename>/etc/ssl/local</filename> will be imported to the certificate
-    stores. Certificates in this directory should be stored as PEM encoded
+    file for use as trust anchors for the <xref linkend="p11-kit"/> trust
+    module. Additionally, it will generate system certificate stores used by
+    BLFS applications (if the recommended and optional applications are present
+    on the system). Any local certificates stored in
+    <filename>/etc/ssl/local</filename> will be imported to both the trust
+    anchors and the generated certificate stores (overriding Mozilla's trust).
+    Certificates in this directory should be stored as PEM encoded
     <application>OpenSSL</application> trusted certificates.</para>
 
@@ -141 +145 @@
 <screen role="root"><userinput>make install</userinput></screen>
 
-   <para>As the <systemitem class="username">root</systemitem> user, download
-   and update the certificate stores with the following command:</para>
+   <para>As the <systemitem class="username">root</systemitem> user, after
+   installing <xref linkend="p11-kit"/>, download the certificate source and
+   prepare for system use with the following command:</para>
 
     <note>
       <para>If running the script a second time with the same version of
       <filename>certdata.txt</filename>, for instance, to add additional stores
-      as the requisite software is installed, add the <parameter>-f</parameter>
+      as the requisite software is installed, add the <parameter>-r</parameter>
       switch to the command line. If packaging, run <command>make-ca
       --help</command> to see all available command line options.</para>
@@ -224 +229 @@
           <para>is a shell script that adapts a current version of
           <filename>certdata.txt</filename>, and prepares it for use
-          as the system certificate store.</para>
+          as the system trust store.</para>
           <indexterm zone="make-ca make-ca">
             <primary sortas="b-make-ca">make-ca</primary>