1 | %define pkidir %{_sysconfdir}/pki |
---|
2 | |
---|
3 | # this year |
---|
4 | %define year 2018 |
---|
5 | |
---|
6 | # latest nss release. |
---|
7 | # reference: https://hg.mozilla.org/projects/nss |
---|
8 | %define nss_version 3_36 |
---|
9 | |
---|
10 | # NSS_BUILTINS_LIBRARY_VERSION from https://hg.mozilla.org/projects/nss/file/NSS_%{nss_version}_RTM/lib/ckfw/builtins/nssckbi.h |
---|
11 | %define ckbi_version 2.22 |
---|
12 | |
---|
13 | %define java_version 1.8.0 |
---|
14 | |
---|
15 | Summary: The Mozilla CA root certificate bundle |
---|
16 | Summary(ja): Mozilla の CA ルート証明書バンドル |
---|
17 | Name: ca-certificates |
---|
18 | Version: %{year}.%{ckbi_version} |
---|
19 | Release: 1%{?_dist_release} |
---|
20 | License: MPL2 |
---|
21 | Group: System Environment/Base |
---|
22 | URL: http://www.mozilla.org/ |
---|
23 | Source0: https://hg.mozilla.org/projects/nss/raw-file/NSS_%{nss_version}_RTM/lib/ckfw/builtins/certdata.txt |
---|
24 | Source1: blacklist.txt |
---|
25 | Source2: generate-cacerts.pl |
---|
26 | Source3: certdata2pem.py |
---|
27 | BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root |
---|
28 | BuildRequires: perl, java-%{java_version}-openjdk-headless, python, rcs |
---|
29 | BuildArch: noarch |
---|
30 | |
---|
31 | Vendor: Project Vine |
---|
32 | Distribution: Vine Linux. |
---|
33 | |
---|
34 | %description |
---|
35 | This package contains the set of CA certificates chosen by the |
---|
36 | Mozilla Foundation for use with the Internet PKI. |
---|
37 | |
---|
38 | %prep |
---|
39 | rm -rf %{name} |
---|
40 | mkdir %{name} %{name}/certs %{name}/java |
---|
41 | |
---|
42 | %build |
---|
43 | pushd %{name}/certs |
---|
44 | cp %{SOURCE0} %{SOURCE1} . |
---|
45 | python %{SOURCE3} |
---|
46 | popd |
---|
47 | pushd %{name} |
---|
48 | ( |
---|
49 | cat <<EOF |
---|
50 | # This is a bundle of X.509 certificates of public Certificate |
---|
51 | # Authorities. It was generated from the Mozilla root CA list. |
---|
52 | # |
---|
53 | # Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt |
---|
54 | # |
---|
55 | # Generated from: |
---|
56 | EOF |
---|
57 | ident -q %{SOURCE0} | sed '1d;s/^/#/'; |
---|
58 | echo '#'; |
---|
59 | ) > ca-bundle.crt |
---|
60 | ( |
---|
61 | cat <<EOF |
---|
62 | # This is a bundle of X.509 certificates of public Certificate |
---|
63 | # Authorities. It was generated from the Mozilla root CA list. |
---|
64 | # These certificates are in the OpenSSL "TRUSTED CERTIFICATE" |
---|
65 | # format and have trust bits set accordingly. |
---|
66 | # |
---|
67 | # Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt |
---|
68 | # |
---|
69 | # Generated from: |
---|
70 | EOF |
---|
71 | ident -q %{SOURCE0} | sed '1d;s/^/#/'; |
---|
72 | echo '#'; |
---|
73 | ) > ca-bundle.trust.crt |
---|
74 | for f in certs/*.crt; do |
---|
75 | tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f` |
---|
76 | case $tbits in |
---|
77 | *serverAuth*) openssl x509 -text -in "$f" >> ca-bundle.crt ;; |
---|
78 | esac |
---|
79 | if [ -n "$tbits" ]; then |
---|
80 | targs="" |
---|
81 | for t in $tbits; do |
---|
82 | targs="${targs} -addtrust $t" |
---|
83 | done |
---|
84 | openssl x509 -text -in "$f" -trustout $targs >> ca-bundle.trust.crt |
---|
85 | fi |
---|
86 | done |
---|
87 | popd |
---|
88 | pushd %{name}/java |
---|
89 | test -s ../ca-bundle.crt || exit 1 |
---|
90 | %{__perl} %{SOURCE2} %{_bindir}/keytool ../ca-bundle.crt |
---|
91 | touch -r %{SOURCE0} cacerts |
---|
92 | popd |
---|
93 | |
---|
94 | %install |
---|
95 | rm -rf $RPM_BUILD_ROOT |
---|
96 | |
---|
97 | mkdir -p $RPM_BUILD_ROOT{%{pkidir}/tls/certs,%{pkidir}/java} |
---|
98 | |
---|
99 | install -p -m 644 %{name}/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt |
---|
100 | install -p -m 644 %{name}/ca-bundle.trust.crt $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt |
---|
101 | ln -s certs/ca-bundle.crt $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem |
---|
102 | touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.crt |
---|
103 | touch -r %{SOURCE0} $RPM_BUILD_ROOT%{pkidir}/tls/certs/ca-bundle.trust.crt |
---|
104 | |
---|
105 | # Install Java cacerts file. |
---|
106 | mkdir -p -m 700 $RPM_BUILD_ROOT%{pkidir}/java |
---|
107 | install -p -m 644 %{name}/java/cacerts $RPM_BUILD_ROOT%{pkidir}/java/ |
---|
108 | |
---|
109 | # /etc/ssl/certs symlink for 3rd-party tools |
---|
110 | mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl |
---|
111 | ln -s ../pki/tls/certs $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs |
---|
112 | |
---|
113 | %clean |
---|
114 | rm -rf $RPM_BUILD_ROOT |
---|
115 | |
---|
116 | %files |
---|
117 | %defattr(-,root,root,-) |
---|
118 | %dir %{pkidir}/java |
---|
119 | %config(noreplace) %{pkidir}/java/cacerts |
---|
120 | %dir %{pkidir}/tls |
---|
121 | %dir %{pkidir}/tls/certs |
---|
122 | %config(noreplace) %{pkidir}/tls/certs/ca-bundle.*crt |
---|
123 | %{pkidir}/tls/cert.pem |
---|
124 | %dir %{_sysconfdir}/ssl |
---|
125 | %{_sysconfdir}/ssl/certs |
---|
126 | |
---|
127 | %changelog |
---|
128 | * Tue Mar 13 2018 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 2018.3.13-1 |
---|
129 | - updated to 2.22. |
---|
130 | |
---|
131 | * Sun Nov 29 2015 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 2015.2.6-2 |
---|
132 | - changed "License:" to MPL2. |
---|
133 | |
---|
134 | * Sun Nov 29 2015 Tomohiro "Tomo-p" KATO <tomop@teamgedoh.net> 2015.2.6-1 |
---|
135 | - updated to 2.6. |
---|
136 | |
---|
137 | * Thu Feb 06 2014 Daisuke SUZUKI <daisuke@linux.or.jp> 2013.1.96-1 |
---|
138 | - update to 1.96 |
---|
139 | |
---|
140 | * Wed Sep 25 2013 Daisuke SUZUKI <daisuke@linux.or.jp> 2013.1.94-1 |
---|
141 | - update to 1.94 |
---|
142 | |
---|
143 | * Wed Jul 25 2012 Daisuke SUZUKI <daisuke@linux.or.jp> 2012.85-1 |
---|
144 | - update to r1.85 |
---|
145 | |
---|
146 | * Mon Mar 26 2012 Daisuke SUZUKI <daisuke@linux.or.jp> 2012.81-1 |
---|
147 | - initial build for Vine Linux |
---|
148 | |
---|
149 | * Mon Feb 13 2012 Joe Orton <jorton@redhat.com> - 2012.81-1 |
---|
150 | - update to r1.81 |
---|
151 | |
---|
152 | * Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.80-2 |
---|
153 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild |
---|
154 | |
---|
155 | * Wed Nov 9 2011 Joe Orton <jorton@redhat.com> - 2011.80-1 |
---|
156 | - update to r1.80 |
---|
157 | - fix handling of certs with dublicate Subject names (#733032) |
---|
158 | |
---|
159 | * Thu Sep 1 2011 Joe Orton <jorton@redhat.com> - 2011.78-1 |
---|
160 | - update to r1.78, removing trust from DigiNotar root (#734679) |
---|
161 | |
---|
162 | * Wed Aug 3 2011 Joe Orton <jorton@redhat.com> - 2011.75-1 |
---|
163 | - update to r1.75 |
---|
164 | |
---|
165 | * Wed Apr 20 2011 Joe Orton <jorton@redhat.com> - 2011.74-1 |
---|
166 | - update to r1.74 |
---|
167 | |
---|
168 | * Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.70-2 |
---|
169 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild |
---|
170 | |
---|
171 | * Wed Jan 12 2011 Joe Orton <jorton@redhat.com> - 2011.70-1 |
---|
172 | - update to r1.70 |
---|
173 | |
---|
174 | * Tue Nov 9 2010 Joe Orton <jorton@redhat.com> - 2010.65-3 |
---|
175 | - update to r1.65 |
---|
176 | |
---|
177 | * Wed Apr 7 2010 Joe Orton <jorton@redhat.com> - 2010.63-3 |
---|
178 | - package /etc/ssl/certs symlink for third-party apps (#572725) |
---|
179 | |
---|
180 | * Wed Apr 7 2010 Joe Orton <jorton@redhat.com> - 2010.63-2 |
---|
181 | - rebuild |
---|
182 | |
---|
183 | * Wed Apr 7 2010 Joe Orton <jorton@redhat.com> - 2010.63-1 |
---|
184 | - update to certdata.txt r1.63 |
---|
185 | - use upstream RCS version in Version |
---|
186 | |
---|
187 | * Fri Mar 19 2010 Joe Orton <jorton@redhat.com> - 2010-4 |
---|
188 | - fix ca-bundle.crt (#575111) |
---|
189 | |
---|
190 | * Thu Mar 18 2010 Joe Orton <jorton@redhat.com> - 2010-3 |
---|
191 | - update to certdata.txt r1.58 |
---|
192 | - add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format |
---|
193 | - exclude ECC certs from the Java cacerts database |
---|
194 | - catch keytool failures |
---|
195 | - fail parsing certdata.txt on finding untrusted but not blacklisted cert |
---|
196 | |
---|
197 | * Fri Jan 15 2010 Joe Orton <jorton@redhat.com> - 2010-2 |
---|
198 | - fix Java cacert database generation: use Subject rather than Issuer |
---|
199 | for alias name; add diagnostics; fix some alias names. |
---|
200 | |
---|
201 | * Mon Jan 11 2010 Joe Orton <jorton@redhat.com> - 2010-1 |
---|
202 | - adopt Python certdata.txt parsing script from Debian |
---|
203 | |
---|
204 | * Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2009-2 |
---|
205 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild |
---|
206 | |
---|
207 | * Wed Jul 22 2009 Joe Orton <jorton@redhat.com> 2009-1 |
---|
208 | - update to certdata.txt r1.53 |
---|
209 | |
---|
210 | * Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2008-8 |
---|
211 | - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild |
---|
212 | |
---|
213 | * Tue Oct 14 2008 Joe Orton <jorton@redhat.com> 2008-7 |
---|
214 | - update to certdata.txt r1.49 |
---|
215 | |
---|
216 | * Wed Jun 25 2008 Thomas Fitzsimmons <fitzsim@redhat.com> - 2008-6 |
---|
217 | - Change generate-cacerts.pl to produce pretty aliases. |
---|
218 | |
---|
219 | * Mon Jun 2 2008 Joe Orton <jorton@redhat.com> 2008-5 |
---|
220 | - include /etc/pki/tls/cert.pem symlink to ca-bundle.crt |
---|
221 | |
---|
222 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-4 |
---|
223 | - use package name for temp dir, recreate it in prep |
---|
224 | |
---|
225 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-3 |
---|
226 | - fix source script perms |
---|
227 | - mark packaged files as config(noreplace) |
---|
228 | |
---|
229 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-2 |
---|
230 | - add (but don't use) mkcabundle.pl |
---|
231 | - tweak description |
---|
232 | - use /usr/bin/keytool directly; BR java-openjdk |
---|
233 | |
---|
234 | * Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-1 |
---|
235 | - Initial build (#448497) |
---|