[csw-devel] SF.net SVN: gar:[2690] csw/mgar/pkg/ca_certificates/trunk
chninkel at users.sourceforge.net
chninkel at users.sourceforge.net
Wed Dec 24 00:31:29 CET 2008
Revision: 2690
http://gar.svn.sourceforge.net/gar/?rev=2690&view=rev
Author: chninkel
Date: 2008-12-23 23:31:29 +0000 (Tue, 23 Dec 2008)
Log Message:
-----------
ca_certificates: improved certification selection configuration
Modified Paths:
--------------
csw/mgar/pkg/ca_certificates/trunk/Makefile
csw/mgar/pkg/ca_certificates/trunk/checksums
csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.depend
csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.gspec
csw/mgar/pkg/ca_certificates/trunk/files/certdata2pem.pl
csw/mgar/pkg/ca_certificates/trunk/files/update-ca-certificates
Modified: csw/mgar/pkg/ca_certificates/trunk/Makefile
===================================================================
--- csw/mgar/pkg/ca_certificates/trunk/Makefile 2008-12-23 15:36:04 UTC (rev 2689)
+++ csw/mgar/pkg/ca_certificates/trunk/Makefile 2008-12-23 23:31:29 UTC (rev 2690)
@@ -8,7 +8,7 @@
endef
MASTER_SITES = http://hg.mozilla.org/mozilla-central/raw-file/default/security/nss/lib/ckfw/builtins/
-DISTFILES = certdata.txt certdata2pem.pl update-ca-certificates
+DISTFILES = certdata.txt certdata2pem.pl update-ca-certificates ca-certificates.conf
DISTFILES += $(call admfiles,CSWcacertificates,depend postinstall)
# We define upstream file regex so we can be notifed of new upstream software release
@@ -25,12 +25,21 @@
include gar/category.mk
+$(WORKDIR)/hash.db: $(WORKDIR)/certdata.txt
+ rm -f $(WORKDIR)/hash.db
+ find "$(DESTDIR)/$(sharedstatedir)/ca-certificates" -name *.pem | while read FILE; do \
+ echo "`basename $$FILE`=`/opt/csw/bin/openssl x509 -hash -fingerprint -noout -in "$$FILE" | head -n 1`.0" >> hash.db; \
+ done
-install-custom:
+$(WORKDIR)/LICENSE: $(WORKDIR)/certdata.txt
+ sed -ne '/BEGIN LICENSE BLOCK/,/END LICENSE BLOCK/p' "$(WORKDIR)/certdata.txt" | grep -v "LICENSE BLOCK" \
+ > "$(WORKDIR)/LICENSE"
+
+install-custom: $(WORKDIR)/hash.db $(WORKDIR)/LICENSE
ginstall -d "$(DESTDIR)/$(sysconfdir)/ssl/certs"
ginstall -d "$(DESTDIR)/$(sharedstatedir)/ca-certificates"
- ginstall -D "$(CURDIR)/$(WORKDIR)/update-ca-certificates" "$(DESTDIR)/$(sbindir)/update-ca-certificates"
- cd "$(DESTDIR)/$(sharedstatedir)/ca-certificates" && perl "$(CURDIR)/$(WORKDIR)/certdata2pem.pl" < "$(CURDIR)/$(WORKDIR)/certdata.txt"
- cd "$(DESTDIR)/$(sharedstatedir)/ca-certificates" && ls -1 > "$(CURDIR)/$(WORKDIR)/ca-certificate.conf"
- sed -ne '/BEGIN LICENSE BLOCK/,/END LICENSE BLOCK/p' "$(CURDIR)/$(WORKDIR)/certdata.txt" | grep -v "LICENSE BLOCK" \
- > "$(CURDIR)/$(WORKDIR)/LICENSE"
+ ginstall -D $(WORKDIR)/update-ca-certificates "$(DESTDIR)/$(sbindir)/update-ca-certificates"
+ ginstall -D hash.db "$(DESTDIR)/$(sharedstatedir)/ca-certificates/hash.db"
+ ginstall -d "$(DESTDIR)/$(sharedstatedir)/ca-certificates/mozilla"
+ cd "$(DESTDIR)/$(sharedstatedir)/ca-certificates/mozilla" && perl "$(CURDIR)/$(WORKDIR)/certdata2pem.pl" < "$(CURDIR)/$(WORKDIR)/certdata.txt"
+
Modified: csw/mgar/pkg/ca_certificates/trunk/checksums
===================================================================
--- csw/mgar/pkg/ca_certificates/trunk/checksums 2008-12-23 15:36:04 UTC (rev 2689)
+++ csw/mgar/pkg/ca_certificates/trunk/checksums 2008-12-23 23:31:29 UTC (rev 2690)
@@ -1,6 +1,7 @@
4dabeaecfd46395da152e51d312107e4 download/certdata.txt
-6087aaa070808190680dcd5cb03c0cb9 download/certdata2pem.pl
-f7b1df4e84e70b1cf7023779ba11698b download/update-ca-certificates
-3bb0b5d545c0bd8f4381cfd2d500586c download/CSWcacertificates.gspec
-df81c8c6eb55786ebefd47fc6400b8b6 download/CSWcacertificates.depend
-48e4c60f385981c1430313584f527b50 download/CSWcacertificates.postinstall
+77fe4c8feb1b341814a6ed03d4ff764a download/certdata2pem.pl
+e4b769f7250ea1c929252a13fe09e4ee download/update-ca-certificates
+b4f6772525da6772d51eb30f90605d60 download/ca-certificates.conf
+787d361f8d8b8ecf89e83bb813fdaec5 download/CSWcacertificates.gspec
+31227010faaad1c2b9893ba91d6b16bb download/CSWcacertificates.depend
+32e6ea27867c760d2279330fd4c480d3 download/CSWcacertificates.postinstall
Modified: csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.depend
===================================================================
--- csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.depend 2008-12-23 15:36:04 UTC (rev 2689)
+++ csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.depend 2008-12-23 23:31:29 UTC (rev 2690)
@@ -1,2 +1 @@
P CSWcswclassutils
-P CSWosslutils
Modified: csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.gspec
===================================================================
--- csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.gspec 2008-12-23 15:36:04 UTC (rev 2689)
+++ csw/mgar/pkg/ca_certificates/trunk/files/CSWcacertificates.gspec 2008-12-23 23:31:29 UTC (rev 2690)
@@ -4,4 +4,4 @@
%include url file://%{PKGLIB}/csw_dyndepend.gspec
%copyright url file://%{WORKDIR}/LICENSE
%prototype:merge
-e cswpreserveconf /opt/csw/etc/ca-certificates.conf.csw=ca-certificate.conf 0644 root bin
+e cswpreserveconf /opt/csw/etc/ca-certificates.conf.csw=ca-certificates.conf 0644 root bin
Modified: csw/mgar/pkg/ca_certificates/trunk/files/certdata2pem.pl
===================================================================
--- csw/mgar/pkg/ca_certificates/trunk/files/certdata2pem.pl 2008-12-23 15:36:04 UTC (rev 2689)
+++ csw/mgar/pkg/ca_certificates/trunk/files/certdata2pem.pl 2008-12-23 23:31:29 UTC (rev 2690)
@@ -35,7 +35,7 @@
$val =~ s/"$//;
$val =~ s/[\/\s,]/_/g;
$val =~ s/[()]//g;
- $fname = $val . ".crt";
+ $fname = $val . ".pem";
next;
}
Modified: csw/mgar/pkg/ca_certificates/trunk/files/update-ca-certificates
===================================================================
--- csw/mgar/pkg/ca_certificates/trunk/files/update-ca-certificates 2008-12-23 15:36:04 UTC (rev 2689)
+++ csw/mgar/pkg/ca_certificates/trunk/files/update-ca-certificates 2008-12-23 23:31:29 UTC (rev 2690)
@@ -1,7 +1,7 @@
#!/bin/sh -e
#
# update-ca-certificates
-# Debian script adapted for Solaris by Yann Rouillard
+# Script inspired by debian script update-ca-certificates
#
# Copyright (c) 2003 Fumitoshi UKAI <ukai at debian.or.jp>
# Copyright (c) 2008 Yann Rouillard <yann at pleiades.fr.eu.org>
@@ -21,13 +21,59 @@
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
-verbose=0
-fresh=0
-while [ $# -gt 0 ];
-do
+CACERTS_CONF=/opt/csw/etc/ca-certificates.conf
+CACERTS_DIR=/opt/csw/share/ca-certificates
+CERTBUNDLE=ca-certificates.crt
+CERTSDIR=/opt/csw/etc/ssl/certs
+
+
+# find the certificate files corresponding to the given pattern
+find_certfile ()
+{
+ if [ -f "$CACERTS_DIR/$1" ]; then
+ echo "$CACERTS_DIR/$1"
+ elif [ -f "$1" ]; then
+ echo "$1"
+ else
+ # if the file doesn't exist we suppose it's a find pattern
+ # like *.crt
+ DIRNAME="`dirname "$1"`"
+ if [ "$DIRNAME" = "." ]; then
+ DIRNAME="$CACERTS_DIR"
+ fi
+ BASENAME="`basename "$1"`"
+ find $DIRNAME -name "$BASENAME"
+ fi
+}
+
+
+# return the full paths of all certificate files
+get_certfile_list ()
+{
+ # first we find all excluded certificates, excluding duplicates
+ sed -ne '/^ *!/s/^ *! *//p' "$CACERTS_CONF" | while read CERTFILE; do
+ [ -n "$CERTFILE" ] && find_certfile "$CERTFILE"
+ done | sort -u > /tmp/update-ca-certificates.tmp.$$
+
+ # then we find all certificates excluding duplicates
+ # and excluded certificates
+ sed -e '/^ *[#!]/d' "$CACERTS_CONF" | while read CERTFILE; do
+ [ -n "$CERTFILE" ] && find_certfile "$CERTFILE"
+ done | sort -u | {
+ while read CERTFILE; do
+ grep -w "$CERTFILE" /tmp/update-ca-certificates.tmp.$$ >/dev/null || echo "$CERTFILE"
+ done
+ }
+
+ rm -f /tmp/update-ca-certificates.tmp.$$
+}
+
+
+VERBOSE=0
+while [ $# -gt 0 ]; do
case $1 in
--verbose|-v)
- verbose=1;;
+ VERBOSE=1;;
--help|-h|*)
echo "$0: [--verbose] [--fresh]"
@@ -36,42 +82,59 @@
shift
done
-CERTSCONF=/opt/csw/etc/ca-certificates.conf
-CERTSDIR=/opt/csw/share/ca-certificates
-CERTBUNDLE=ca-certificates.crt
-ETCCERTSDIR=/opt/csw/etc/ssl/certs
-if [ ! -f "$CERTSCONF" ]; then
- echo "ERROR: $CERTSCONF doesn't exist !" >&2
+if [ ! -f "$CACERTS_CONF" ]; then
+ echo "ERROR: $CACERTS_CONF doesn't exist !" >&2
exit 2
fi
-cd $ETCCERTSDIR
-find . -type l -print | while read SYMLINK; do
- test -f $SYMLINK || rm -f $SYMLINK
+printf "Updating certificates in $CERTSDIR..."
+
+
+# first we remove the existing symlink
+find "$CERTSDIR" -type l -print | while read SYMLINK; do
+ [ ! -L "$SYMLINK" ] || rm -f "$SYMLINK"
done
-printf "Updating certificates in $ETCCERTSDIR..."
+# then we recreate them
+get_certfile_list | while read CERTFILE; do
+ SYMLINK="`basename "$CERTFILE"`"
+ SYMLINK="`echo $SYMLINK | sed -e 's/\.[^\.]*$//'`.pem"
-BUNDLETMP=`mktemp "${CERTBUNDLE}.tmp.XXXXXX"`
-sed -e '/^#/g' "$CERTSCONF" | while read CERTFILE; do
- if [ ! -f "$CERTFILE" ]; then
- if [ ! -f "$CERTSDIR/$CERTFILE" ]; then
- continue
- fi
- CERTFILE="$CERTSDIR/$CERTFILE"
- fi
-
- cd "$ETCCERTSDIR" && ln -sf "$CERTFILE" "`basename $CERTFILE`.pem"
+ cd "$CERTSDIR" && ln -sf "$CERTFILE" "$SYMLINK"
done
-cd "$ETCCERTSDIR" && cat *.pem > "$BUNDLETMP"
-chmod 0644 "$BUNDLETMP"
-mv -f "$BUNDLETMP" "$ETCCERTSDIR/$CERTBUNDLE"
+# we create the certificate bundle file which contains all the
+# certificate, some software prefer to use this file
+# (and this is mandatory for software linked with gnutls)
+cat "$CERTSDIR/"*.pem > "$CERTSDIR/$CERTBUNDLE.tmp" 2>/dev/null || true
+chmod 0644 "$CERTSDIR/$CERTBUNDLE.tmp"
+mv -f "$CERTSDIR/$CERTBUNDLE.tmp" "$CERTSDIR/$CERTBUNDLE"
-if [ "$verbose" = 0 ]; then
- OPENSSL=/opt/csw/bin/openssl /opt/csw/bin/c_rehash . >/dev/null 2>&1
-else
- OPENSSL=/opt/csw/bin/openssl /opt/csw/bin/c_rehash .
+
+# we create the hash links for certificate, openssl library need
+# this link to be able to find a CA certificate
+if { openssl version; } >/dev/null 2>&1; then
+ c_rehash "$CERTSDIR" >/dev/null 2>&1
+
+elif { /opt/csw/bin/openssl version; } >/dev/null 2>&1; then
+ OPENSSL="/opt/csw/bin/openssl" /opt/csw/bin/c_rehash "$CERTSDIR" >/dev/null 2>&1
+
+# openssl binary isn't available, so we fall back our own provided file containing
+# hash value for certificates provided by this package
+# this way, we don't stricly depend on the openssl_utils package
+elif [ -f "$CACERTS_DIR/hash.db" ]; then
+ cd "$CERTSDIR"
+ for FILE in *.pem; do
+ HASH=`awk -F= " \\\$1 == \"$FILE\" { print \\\$2; exit 0 }" "$CACERTS_DIR/hash.db"`
+ if [ -n "$HASH" ]; then
+ ln -s "$FILE" "$HASH"
+ else
+ echo
+ echo "WARNING: a custom certificate was installed, you need to install openssl_utils so"
+ echo " update-ca-certificates is able to generate the hash of your custom certificate."
+ fi
+ done
fi
+
echo "done."
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
More information about the devel
mailing list