[6630] | 1 | %define pkidir %{_sysconfdir}/pki |
---|
| 2 | |
---|
[11588] | 3 | # this year |
---|
| 4 | %define year 2018 |
---|
| 5 | |
---|
| 6 | # latest nss release. |
---|
| 7 | # reference: https://hg.mozilla.org/projects/nss |
---|
| 8 | %define nss_version 3_36 |
---|
| 9 | |
---|
| 10 | # NSS_BUILTINS_LIBRARY_VERSION from https://hg.mozilla.org/projects/nss/file/NSS_%{nss_version}_RTM/lib/ckfw/builtins/nssckbi.h |
---|
| 11 | %define ckbi_version 2.22 |
---|
| 12 | |
---|
| 13 | %define java_version 1.8.0 |
---|
| 14 | |
---|
[6630] | 15 | Summary: The Mozilla CA root certificate bundle |
---|
| 16 | Summary(ja): Mozilla の CA ルート証明書バンドル |
---|
| 17 | Name: ca-certificates |
---|
[11588] | 18 | Version: %{year}.%{ckbi_version} |
---|
| 19 | Release: 1%{?_dist_release} |
---|
[9836] | 20 | License: MPL2 |
---|
[6630] | 21 | Group: System Environment/Base |
---|
| 22 | URL: http://www.mozilla.org/ |
---|
[11588] | 23 | Source0: https://hg.mozilla.org/projects/nss/raw-file/NSS_%{nss_version}_RTM/lib/ckfw/builtins/certdata.txt |
---|
[6630] | 24 | Source1: blacklist.txt |
---|
| 25 | Source2: generate-cacerts.pl |
---|
| 26 | Source3: certdata2pem.py |
---|
| 27 | BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root |
---|
[11588] | 28 | BuildRequires: perl, java-%{java_version}-openjdk-headless, python, rcs |
---|
[6630] | 29 | BuildArch: noarch |
---|
| 30 | |
---|
[11588] | 31 | Vendor: Project Vine |
---|
| 32 | Distribution: Vine Linux. |
---|
| 33 | |
---|
[6630] | 34 | %description |
---|
| 35 | This package contains the set of CA certificates chosen by the |
---|
| 36 | Mozilla Foundation for use with the Internet PKI. |
---|
| 37 | |
---|
| 38 | %prep |
---|
| 39 | rm -rf %{name} |
---|
| 40 | mkdir %{name} %{name}/certs %{name}/java |
---|
| 41 | |
---|
| 42 | %build |
---|
| 43 | pushd %{name}/certs |
---|
| 44 | cp %{SOURCE0} %{SOURCE1} . |
---|
| 45 | python %{SOURCE3} |
---|
| 46 | popd |
---|
| 47 | pushd %{name} |
---|
| 48 | ( |
---|
| 49 | cat <<EOF |
---|
| 50 | # This is a bundle of X.509 certificates of public Certificate |
---|
| 51 | # Authorities. It was generated from the Mozilla root CA list. |
---|
| 52 | # |
---|
| 53 | # Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt |
---|
| 54 | # |
---|
| 55 | # Generated from: |
---|
| 56 | EOF |
---|
| 57 | ident -q %{SOURCE0} | sed '1d;s/^/#/'; |
---|
| 58 | echo '#'; |
---|
| 59 | ) > ca-bundle.crt |
---|
| 60 | ( |
---|
| 61 | cat <<EOF |
---|
| 62 | # This is a bundle of X.509 certificates of public Certificate |
---|
| 63 | # Authorities. It was generated from the Mozilla root CA list. |
---|
| 64 | # These certificates are in the OpenSSL "TRUSTED CERTIFICATE" |
---|
| 65 | # format and have trust bits set accordingly. |
---|
| 66 | # |
---|
| 67 | # Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt |
---|
| 68 | # |
---|
| 69 | # Generated from: |
---|
| 70 | EOF |
---|
| 71 | ident -q %{SOURCE0} | sed '1d;s/^/#/'; |
---|
| 72 | echo '#'; |
---|
| 73 | ) > ca-bundle.trust.crt |
---|
| 74 | for f in certs/*.crt; do |
---|
| 75 | tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f` |
---|
| 76 | case $tbits in |
---|
| 77 | *serverAuth*) openssl x509 -text -in "$f" >> ca-bundle.crt ;; |
---|
| 78 | esac |
---|
| 79 | if [ -n "$tbits" ]; then |
---|
| 80 | targs="" |
---|
| 81 | for t in $tbits; do |
---|
| 82 | targs="${targs} -addtrust $t" |
---|
| 83 | done |
---|
| 84 | openssl x509 -text -in "$f" -trustout $targs >> ca-bundle.trust.crt |
---|
| 85 | fi |
---|
| 86 | done |
---|
| 87 | popd |
---|
| 88 | pushd %{name}/java |
---|
| 89 | test -s ../ca-bundle.crt || exit 1 |
---|
| 90 | %{__perl} %{SOURCE2} %{_bindir}/keytool ../ca-bundle.crt |
---|
| 91 | touch -r %{SOURCE0} cacerts |
---|
| 92 | popd |
---|
| 93 | |
---|
| 94 | %install |
---|
| 95 | rm -rf $RPM_BUILD_ROOT |
---|
| 96 | |
---|
| 97 | mkdir -p $RPM_BUILD_ROOT{%{pkidir}/tls/certs,%{pkidir}/java} |
---|
| 98 | |
---|
| 99 | install -p -m 644 %{name}/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt |
---|
| 100 | install -p -m 644 %{name}/ca-bundle.trust.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt |
---|
| 101 | ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem |
---|
| 102 | touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt |
---|
| 103 | touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt |
---|
| 104 | |
---|
| 105 | # Install Java cacerts file. |
---|
| 106 | mkdir -p -m 700 $RPM_BUILD_ROOT%{pkidir}/java |
---|
| 107 | install -p -m 644 %{name}/java/cacerts $RPM_BUILD_ROOT%{pkidir}/java/ |
---|
| 108 | |
---|
| 109 | # /etc/ssl/certs symlink for 3rd-party tools |
---|
| 110 | mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl |
---|
| 111 | ln -s ../pki/tls/certs $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs |
---|
| 112 | |
---|
| 113 | %clean |
---|
| 114 | rm -rf $RPM_BUILD_ROOT |
---|
| 115 | |
---|
| 116 | %files |
---|
| 117 | %defattr(-,root,root,-) |
---|
| 118 | %dir %{pkidir}/java |
---|
| 119 | %config(noreplace) %{pkidir}/java/cacerts |
---|
| 120 | %dir %{pkidir}/tls |
---|
| 121 | %dir %{pkidir}/tls/certs |
---|
| 122 | %config(noreplace) %{pkidir}/tls/certs/ca-bundle.*crt |
---|
| 123 | %{pkidir}/tls/cert.pem |
---|
| 124 | %dir %{_sysconfdir}/ssl |
---|
| 125 | %{_sysconfdir}/ssl/certs |
---|
| 126 | |
---|
| 127 | %changelog |
---|
[11588] | 128 | * Tue Mar 13 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 2018.3.13-1 |
---|
| 129 | - updated to 2.22. |
---|
| 130 | |
---|
[9836] | 131 | * Sun Nov 29 2015 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 2015.2.6-2 |
---|
| 132 | - changed "License:" to MPL2. |
---|
| 133 | |
---|
| 134 | * Sun Nov 29 2015 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 2015.2.6-1 |
---|
| 135 | - updated to 2.6. |
---|
| 136 | |
---|
[8242] | 137 | * Thu Feb 06 2014 Daisuke SUZUKI <daisuke@linux.or.jp> 2013.1.96-1 |
---|
| 138 | - update to 1.96 |
---|
| 139 | |
---|
[7834] | 140 | * Wed Sep 25 2013 Daisuke SUZUKI <daisuke@linux.or.jp> 2013.1.94-1 |
---|
| 141 | - update to 1.94 |
---|
| 142 | |
---|
[6630] | 143 | * Wed Jul 25 2012 Daisuke SUZUKI <daisuke@linux.or.jp> 2012.85-1 |
---|
| 144 | - update to r1.85 |
---|
| 145 | |
---|
| 146 | * Mon Mar 26 2012 Daisuke SUZUKI <daisuke@linux.or.jp> 2012.81-1 |
---|
| 147 | - initial build for Vine Linux |
---|
| 148 | |
---|
| 149 | * Mon Feb 13 2012 Joe Orton <jorton@redhat.com> - 2012.81-1 |
---|
| 150 | - update to r1.81 |
---|
| 151 | |
---|
| 152 | * Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.80-2 |
---|
| 153 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild |
---|
| 154 | |
---|
| 155 | * Wed Nov 9 2011 Joe Orton <jorton@redhat.com> - 2011.80-1 |
---|
| 156 | - update to r1.80 |
---|
| 157 | - fix handling of certs with dublicate Subject names (#733032) |
---|
| 158 | |
---|
| 159 | * Thu Sep 1 2011 Joe Orton <jorton@redhat.com> - 2011.78-1 |
---|
| 160 | - update to r1.78, removing trust from DigiNotar root (#734679) |
---|
| 161 | |
---|
| 162 | * Wed Aug 3 2011 Joe Orton <jorton@redhat.com> - 2011.75-1 |
---|
| 163 | - update to r1.75 |
---|
| 164 | |
---|
| 165 | * Wed Apr 20 2011 Joe Orton <jorton@redhat.com> - 2011.74-1 |
---|
| 166 | - update to r1.74 |
---|
| 167 | |
---|
| 168 | * Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.70-2 |
---|
| 169 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild |
---|
| 170 | |
---|
| 171 | * Wed Jan 12 2011 Joe Orton <jorton@redhat.com> - 2011.70-1 |
---|
| 172 | - update to r1.70 |
---|
| 173 | |
---|
| 174 | * Tue Nov 9 2010 Joe Orton <jorton@redhat.com> - 2010.65-3 |
---|
| 175 | - update to r1.65 |
---|
| 176 | |
---|
| 177 | * Wed Apr 7 2010 Joe Orton <jorton@redhat.com> - 2010.63-3 |
---|
| 178 | - package /etc/ssl/certs symlink for third-party apps (#572725) |
---|
| 179 | |
---|
| 180 | * Wed Apr 7 2010 Joe Orton <jorton@redhat.com> - 2010.63-2 |
---|
| 181 | - rebuild |
---|
| 182 | |
---|
| 183 | * Wed Apr 7 2010 Joe Orton <jorton@redhat.com> - 2010.63-1 |
---|
| 184 | - update to certdata.txt r1.63 |
---|
| 185 | - use upstream RCS version in Version |
---|
| 186 | |
---|
| 187 | * Fri Mar 19 2010 Joe Orton <jorton@redhat.com> - 2010-4 |
---|
| 188 | - fix ca-bundle.crt (#575111) |
---|
| 189 | |
---|
| 190 | * Thu Mar 18 2010 Joe Orton <jorton@redhat.com> - 2010-3 |
---|
| 191 | - update to certdata.txt r1.58 |
---|
| 192 | - add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format |
---|
| 193 | - exclude ECC certs from the Java cacerts database |
---|
| 194 | - catch keytool failures |
---|
| 195 | - fail parsing certdata.txt on finding untrusted but not blacklisted cert |
---|
| 196 | |
---|
| 197 | * Fri Jan 15 2010 Joe Orton <jorton@redhat.com> - 2010-2 |
---|
| 198 | - fix Java cacert database generation: use Subject rather than Issuer |
---|
| 199 | for alias name; add diagnostics; fix some alias names. |
---|
| 200 | |
---|
| 201 | * Mon Jan 11 2010 Joe Orton <jorton@redhat.com> - 2010-1 |
---|
| 202 | - adopt Python certdata.txt parsing script from Debian |
---|
| 203 | |
---|
| 204 | * Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2009-2 |
---|
| 205 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild |
---|
| 206 | |
---|
| 207 | * Wed Jul 22 2009 Joe Orton <jorton@redhat.com> 2009-1 |
---|
| 208 | - update to certdata.txt r1.53 |
---|
| 209 | |
---|
| 210 | * Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2008-8 |
---|
| 211 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild |
---|
| 212 | |
---|
| 213 | * Tue Oct 14 2008 Joe Orton <jorton@redhat.com> 2008-7 |
---|
| 214 | - update to certdata.txt r1.49 |
---|
| 215 | |
---|
| 216 | * Wed Jun 25 2008 Thomas Fitzsimmons <fitzsim@redhat.com> - 2008-6 |
---|
| 217 | - Change generate-cacerts.pl to produce pretty aliases. |
---|
| 218 | |
---|
| 219 | * Mon Jun 2 2008 Joe Orton <jorton@redhat.com> 2008-5 |
---|
| 220 | - include /etc/pki/tls/cert.pem symlink to ca-bundle.crt |
---|
| 221 | |
---|
| 222 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-4 |
---|
| 223 | - use package name for temp dir, recreate it in prep |
---|
| 224 | |
---|
| 225 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-3 |
---|
| 226 | - fix source script perms |
---|
| 227 | - mark packaged files as config(noreplace) |
---|
| 228 | |
---|
| 229 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-2 |
---|
| 230 | - add (but don't use) mkcabundle.pl |
---|
| 231 | - tweak description |
---|
| 232 | - use /usr/bin/keytool directly; BR java-openjdk |
---|
| 233 | |
---|
| 234 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-1 |
---|
| 235 | - Initial build (#448497) |
---|