Changeset d973faf

Timestamp:

01/01/2019 10:18:07 AM (6 years ago)

Author:

DJ Lucas <dj@…>

Branches:

10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 12.0, 12.1, 12.2, 8.4, 9.0, 9.1, bdubbs/svn, gimp3, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/for-12.3, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/spidermonkey128, xry111/test-20220226, xry111/xf86-video-removal

Children:

979dcbd5

Parents:

f2eaeaa

Message:

Update to make-ca-1.1. Complete configuration of P11-Kit trust-extract-compat to utilize both P11-kit and make-ca.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@20900 af4574ff-66df-0310-9fd7-8a98e5e911e0

Files:

• introduction/welcome/changelog.xml (modified) (1 diff)
• packages.ent (modified) (1 diff)
• postlfs/security/make-ca.xml (modified) (1 diff)
• postlfs/security/p11-kit.xml (modified) (3 diffs)

introduction/welcome/changelog.xml

@@ -46 +46 @@
       <itemizedlist>
         <listitem>
+          <para>[dj] - Update to make-ca-1.1. Complete configuration of P11-Kit
+          trust-extract-compat to utilize both P11-kit and make-ca.</para>
+        </listitem> 
+        <listitem>
           <para>[bdubbs] - Update to nasm-2.14.02. Fixes
           <ulink url="&blfs-ticket-root;11476">#11476</ulink>.</para>

packages.ent

@@ -25 +25 @@
 <!ENTITY linux-pam-docs-version       "1.2.0">
 <!ENTITY libpwquality-version         "1.4.0">
-<!ENTITY make-ca-version              "1.0">
+<!ENTITY make-ca-version              "1.1">
 <!ENTITY mitkrb-major-version         "1.16">
 <!ENTITY mitkrb-version               "1.16.2">

postlfs/security/make-ca.xml

@@ -12 +12 @@
   <!ENTITY make-ca-download      "https://github.com/djlucas/make-ca/releases/download/v&make-ca-version;/make-ca-&make-ca-version;.tar.xz">
   <!ENTITY make-ca-size          "28 KB">
-  <!ENTITY make-ca-md5sum        "b038d38233f970aad60c29dfc0502021">
+  <!ENTITY make-ca-md5sum        "417a8ebfb3d6ac4821c1e508a0a3981f">
 ]>
 

postlfs/security/p11-kit.xml

@@ -98 +98 @@
 <screen><userinput>sed '20,$ d' -i trust/trust-extract-compat.in &amp;&amp;
 cat &gt;&gt; trust/trust-extract-compat.in &lt;&lt; "EOF"
-echo "Please create an OpenSSL Trusted Certificate with appropriate"
-echo "trust arguments in /etc/ssl/local/ and run '/usr/sbin/make-ca -f'"
-echo "as the root user."
-exit 1
+<literal># LFS uses make-ca to manage certificates
+if [ -f /etc/make-ca.conf ]; then
+    . /etc/make-ca.conf
+else
+    #Use defaults if make-ca.conf does not exist
+    ANCHORDIR="/etc/pki/anchors"
+    ANCHORLIST="/etc/pki/anchors.txt"
+    LOCALDIR="/etc/ssl/local"
+    CERTLIST=""
+fi
+
+# Create a list of certificates not present at previous run
+for ca in `/bin/ls -1 --color=none "${ANCHORDIR}"` ; do
+    /bin/grep "${ca}" "${ANCHORLIST}" 2>&amp;1>/dev/null || CERTLIST="${CERTLIST} ${ca}"
+done
+
+# Dump to a temporary directory
+TEMPDIR=`mktemp -d`
+/usr/bin/trust extract --filter=certificates --format=openssl-directory --overwrite \
+    "${TEMPDIR}"
+
+# Copy new certificates to LOCALDIR
+for certificate in `echo "${CERTLIST}"` ; do
+    LABEL=`/bin/grep -m 1 "label:" "${ANCHORDIR}/${certificate}"`
+    LABELNEW=`echo "${LABEL}" | /bin/sed -e 's@^label: @@' -e 's@"@@g' -e 's@ @_@g'`
+    cp -v "${TEMPDIR}/${LABELNEW}.pem" "${LOCALDIR}"
+    unset LABEL LABELNEW
+done
+
+# Clean up
+rm -rf "${TEMPDIR}"
+unset ANCHORDIR ANCHORLIST LOCALDIR CERTLIST TEMPDIR
+
+# Generate a new trust store
+/usr/sbin/make-ca -f</literal>
 EOF</userinput></screen>
 
@@ -123 +154 @@
     </para>
 
-<screen role="root"><userinput>make install</userinput></screen>
+<screen role="root"><userinput>make install &amp;&amp;
+ln -s /usr/libexec/p11-kit/trust-extract-compat \
+      /usr/bin/update-ca-certificates</userinput></screen>
 
   </sect2>
@@ -225 +258 @@
       </varlistentry>
 
+      <varlistentry id="update-ca-certificates">
+        <term><command>update-ca-certificates</command></term>
+        <listitem>
+          <para>
+            is a command line tool to both extract local certificates from an
+            upadated anchor store, and regenerate all anchors and certificate
+            stores on the system.
+          </para>
+          <indexterm zone="p11-kit update-ca-certificates">
+            <primary sortas="b-trust">update-ca-certificates</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
 
       <varlistentry id="libp11-kit">