Blame SPECS/ca-certificates.spec

b4bc2f
%define pkidir %{_sysconfdir}/pki
b4bc2f
%define catrustdir %{_sysconfdir}/pki/ca-trust
b4bc2f
%define classic_tls_bundle ca-bundle.crt
e5c4b3
%define openssl_format_trust_bundle ca-bundle.trust.crt
e5c4b3
%define p11_format_bundle ca-bundle.trust.p11-kit
b01320
%define legacy_default_bundle ca-bundle.legacy.default.crt
b01320
%define legacy_disable_bundle ca-bundle.legacy.disable.crt
b4bc2f
%define java_bundle java/cacerts
b4bc2f
b4bc2f
Summary: The Mozilla CA root certificate bundle
b4bc2f
Name: ca-certificates
b4bc2f
b4bc2f
# For the package version number, we use: year.{upstream version}
b4bc2f
#
b01320
# The {upstream version} can be found as symbol
b01320
# NSS_BUILTINS_LIBRARY_VERSION in file nss/lib/ckfw/builtins/nssckbi.h
b01320
# which corresponds to the data in file nss/lib/ckfw/builtins/certdata.txt.
b01320
#
b01320
# The files should be taken from a released version of NSS, as published
b01320
# at https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/
b01320
#
b01320
# The versions that are used by the latest released version of 
b01320
# Mozilla Firefox should be available from:
b4bc2f
# https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/nssckbi.h
b4bc2f
# https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
b4bc2f
#
b01320
# The most recent development versions of the files can be found at
b01320
# http://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/nssckbi.h
b01320
# http://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/certdata.txt
b01320
# (but these files might have not yet been released).
b01320
#
b4bc2f
# (until 2012.87 the version was based on the cvs revision ID of certdata.txt,
b4bc2f
# but in 2013 the NSS projected was migrated to HG. Old version 2012.87 is 
b4bc2f
# equivalent to new version 2012.1.93, which would break the requirement 
b4bc2f
# to have increasing version numbers. However, the new scheme will work, 
b4bc2f
# because all future versions will start with 2013 or larger.)
b4bc2f
41a370
Version: 2020.2.41
b4bc2f
# On RHEL 7.x, please keep the release version >= 70
74973b
# When rebasing on Y-Stream (7.y), use 71, 72, 73, ...
74973b
# When rebasing on Z-Stream (7.y.z), use 70.0, 70.1, 70.2, ...
41a370
Release: 70.0%{?dist}
b4bc2f
License: Public Domain
b4bc2f
b4bc2f
Group: System Environment/Base
b4bc2f
URL: http://www.mozilla.org/
b4bc2f
b4bc2f
#Please always update both certdata.txt and nssckbi.h
b4bc2f
Source0: certdata.txt
b4bc2f
Source1: nssckbi.h
b4bc2f
Source2: update-ca-trust
b4bc2f
Source3: trust-fixes
b4bc2f
Source4: certdata2pem.py
b01320
Source5: ca-legacy.conf
b01320
Source6: ca-legacy
b01320
Source9: ca-legacy.8.txt
b4bc2f
Source10: update-ca-trust.8.txt
b4bc2f
Source11: README.usr
b4bc2f
Source12: README.etc
b4bc2f
Source13: README.extr
b4bc2f
Source14: README.java
b4bc2f
Source15: README.openssl
b4bc2f
Source16: README.pem
b4bc2f
Source17: README.src
b01320
Source18: README.ca-certificates
b4bc2f
b4bc2f
BuildArch: noarch
b4bc2f
e5c4b3
Requires: p11-kit >= 0.23.5
e5c4b3
Requires: p11-kit-trust >= 0.23.5
b4bc2f
BuildRequires: perl
b4bc2f
BuildRequires: python
b4bc2f
BuildRequires: openssl
b4bc2f
BuildRequires: asciidoc
b4bc2f
BuildRequires: libxslt
b4bc2f
b4bc2f
%description
b4bc2f
This package contains the set of CA certificates chosen by the
b4bc2f
Mozilla Foundation for use with the Internet PKI.
b4bc2f
b4bc2f
%prep
b4bc2f
rm -rf %{name}
b4bc2f
mkdir %{name}
b4bc2f
mkdir %{name}/certs
b01320
mkdir %{name}/certs/legacy-default
b01320
mkdir %{name}/certs/legacy-disable
b4bc2f
mkdir %{name}/java
b4bc2f
b4bc2f
%build
b4bc2f
pushd %{name}/certs
b4bc2f
 pwd
b4bc2f
 cp %{SOURCE0} .
b4bc2f
 python %{SOURCE4} >c2p.log 2>c2p.err
b4bc2f
popd
b4bc2f
pushd %{name}
b4bc2f
 (
b4bc2f
   cat <
b4bc2f
# This is a bundle of X.509 certificates of public Certificate
b4bc2f
# Authorities.  It was generated from the Mozilla root CA list.
e5c4b3
# These certificates and trust/distrust attributes use the file format accepted
e5c4b3
# by the p11-kit-trust module.
b4bc2f
#
b4bc2f
# Source: nss/lib/ckfw/builtins/certdata.txt
b4bc2f
# Source: nss/lib/ckfw/builtins/nssckbi.h
b4bc2f
#
b4bc2f
# Generated from:
b4bc2f
EOF
b4bc2f
   cat %{SOURCE1}  |grep -w NSS_BUILTINS_LIBRARY_VERSION | awk '{print "# " $2 " " $3}';
b4bc2f
   echo '#';
e5c4b3
 ) > %{p11_format_bundle}
b01320
469a3f
 touch %{legacy_default_bundle}
469a3f
 NUM_LEGACY_DEFAULT=`find certs/legacy-default -type f | wc -l`
469a3f
 if [ $NUM_LEGACY_DEFAULT -ne 0 ]; then
469a3f
     for f in certs/legacy-default/*.crt; do 
469a3f
       echo "processing $f"
469a3f
       tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
469a3f
       alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
469a3f
       targs=""
469a3f
       if [ -n "$tbits" ]; then
469a3f
          for t in $tbits; do
469a3f
             targs="${targs} -addtrust $t"
469a3f
          done
469a3f
       fi
469a3f
       if [ -n "$targs" ]; then
469a3f
          echo "legacy default flags $targs for $f" >> info.trust
469a3f
          openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_default_bundle}
469a3f
       fi
469a3f
     done
469a3f
 fi
b01320
469a3f
 touch %{legacy_disable_bundle}
469a3f
 NUM_LEGACY_DISABLE=`find certs/legacy-disable -type f | wc -l`
469a3f
 if [ $NUM_LEGACY_DISABLE -ne 0 ]; then
469a3f
     for f in certs/legacy-disable/*.crt; do 
469a3f
       echo "processing $f"
469a3f
       tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
469a3f
       alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
469a3f
       targs=""
469a3f
       if [ -n "$tbits" ]; then
469a3f
          for t in $tbits; do
469a3f
             targs="${targs} -addtrust $t"
469a3f
          done
469a3f
       fi
469a3f
       if [ -n "$targs" ]; then
469a3f
          echo "legacy disable flags $targs for $f" >> info.trust
469a3f
          openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_disable_bundle}
469a3f
       fi
469a3f
     done
469a3f
 fi
b01320
e5c4b3
 P11FILES=`find certs -name \*.tmp-p11-kit | wc -l`
b01320
 if [ $P11FILES -ne 0 ]; then
e5c4b3
   for p in certs/*.tmp-p11-kit; do 
e5c4b3
     cat "$p" >> %{p11_format_bundle}
b01320
   done
b01320
 fi
b4bc2f
 # Append our trust fixes
e5c4b3
 cat %{SOURCE3} >> %{p11_format_bundle}
b4bc2f
popd
b4bc2f
b4bc2f
#manpage
b4bc2f
cp %{SOURCE10} %{name}/update-ca-trust.8.txt
b4bc2f
asciidoc.py -v -d manpage -b docbook %{name}/update-ca-trust.8.txt
b4bc2f
xsltproc --nonet -o %{name}/update-ca-trust.8 /usr/share/asciidoc/docbook-xsl/manpage.xsl %{name}/update-ca-trust.8.xml
b4bc2f
b01320
cp %{SOURCE9} %{name}/ca-legacy.8.txt
b01320
asciidoc.py -v -d manpage -b docbook %{name}/ca-legacy.8.txt
b01320
xsltproc --nonet -o %{name}/ca-legacy.8 /usr/share/asciidoc/docbook-xsl/manpage.xsl %{name}/ca-legacy.8.xml
b01320
b4bc2f
b4bc2f
%install
b4bc2f
rm -rf $RPM_BUILD_ROOT
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/tls/certs
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/java
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source/anchors
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source/blacklist
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/java
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/anchors
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/blacklist
b01320
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{_bindir}
b4bc2f
mkdir -p -m 755 $RPM_BUILD_ROOT%{_mandir}/man8
b4bc2f
b4bc2f
install -p -m 644 %{name}/update-ca-trust.8 $RPM_BUILD_ROOT%{_mandir}/man8
b01320
install -p -m 644 %{name}/ca-legacy.8 $RPM_BUILD_ROOT%{_mandir}/man8
b4bc2f
install -p -m 644 %{SOURCE11} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/README
b4bc2f
install -p -m 644 %{SOURCE12} $RPM_BUILD_ROOT%{catrustdir}/README
b4bc2f
install -p -m 644 %{SOURCE13} $RPM_BUILD_ROOT%{catrustdir}/extracted/README
b4bc2f
install -p -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{catrustdir}/extracted/java/README
b4bc2f
install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/README
b4bc2f
install -p -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/README
b4bc2f
install -p -m 644 %{SOURCE17} $RPM_BUILD_ROOT%{catrustdir}/source/README
b4bc2f
b01320
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/doc/%{name}-%{version}
b01320
install -p -m 644 %{SOURCE18} $RPM_BUILD_ROOT%{_datadir}/doc/%{name}-%{version}/README
b01320
e5c4b3
install -p -m 644 %{name}/%{p11_format_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{p11_format_bundle}
b01320
b01320
install -p -m 644 %{name}/%{legacy_default_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
b01320
install -p -m 644 %{name}/%{legacy_disable_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
b01320
b01320
install -p -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{catrustdir}/ca-legacy.conf
b01320
e5c4b3
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{p11_format_bundle}
b4bc2f
b01320
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
b01320
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
b01320
b4bc2f
# TODO: consider to dynamically create the update-ca-trust script from within
b4bc2f
#       this .spec file, in order to have the output file+directory names at once place only.
b4bc2f
install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_bindir}/update-ca-trust
b4bc2f
b01320
install -p -m 755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/ca-legacy
b01320
b4bc2f
# touch ghosted files that will be extracted dynamically
41a370
# Set chmod 444 to use identical permission
b4bc2f
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
41a370
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
b4bc2f
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
41a370
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
b4bc2f
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
41a370
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
e5c4b3
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle}
41a370
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle}
b4bc2f
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
41a370
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
b4bc2f
b4bc2f
# /etc/ssl/certs symlink for 3rd-party tools
eb48f3
sln ../pki/tls/certs \
eb48f3
    $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs
b4bc2f
# legacy filenames
eb48f3
sln %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
eb48f3
    $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
eb48f3
sln %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
eb48f3
    $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{classic_tls_bundle}
e5c4b3
sln %{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle} \
e5c4b3
    $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{openssl_format_trust_bundle}
eb48f3
sln %{catrustdir}/extracted/%{java_bundle} \
eb48f3
    $RPM_BUILD_ROOT%{pkidir}/%{java_bundle}
b4bc2f
b4bc2f
%clean
b4bc2f
rm -rf $RPM_BUILD_ROOT
b4bc2f
b4bc2f
b4bc2f
%pre
b4bc2f
if [ $1 -gt 1 ] ; then
b4bc2f
  # Upgrade or Downgrade.
b4bc2f
  # If the classic filename is a regular file, then we are upgrading
b4bc2f
  # from an old package and we will move it to an .rpmsave backup file.
b4bc2f
  # If the filename is a symbolic link, then we are good already.
b4bc2f
  # If the system will later be downgraded to an old package with regular 
b4bc2f
  # files, and afterwards updated again to a newer package with symlinks,
b4bc2f
  # and the old .rpmsave backup file didn't get cleaned up,
b4bc2f
  # then we don't backup again. We keep the older backup file.
b4bc2f
  # In other words, if an .rpmsave file already exists, we don't overwrite it.
b4bc2f
  #
b4bc2f
  if ! test -e %{pkidir}/%{java_bundle}.rpmsave; then
b4bc2f
    # no backup yet
b4bc2f
    if test -e %{pkidir}/%{java_bundle}; then
b4bc2f
      # a file exists
b4bc2f
	  if ! test -L %{pkidir}/%{java_bundle}; then
b4bc2f
        # it's an old regular file, not a link
b4bc2f
        mv -f %{pkidir}/%{java_bundle} %{pkidir}/%{java_bundle}.rpmsave
b4bc2f
      fi
b4bc2f
    fi
b4bc2f
  fi
b4bc2f
b4bc2f
  if ! test -e %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave; then
b4bc2f
    # no backup yet
b4bc2f
    if test -e %{pkidir}/tls/certs/%{classic_tls_bundle}; then
b4bc2f
      # a file exists
b4bc2f
      if ! test -L %{pkidir}/tls/certs/%{classic_tls_bundle}; then
b4bc2f
        # it's an old regular file, not a link
b4bc2f
        mv -f %{pkidir}/tls/certs/%{classic_tls_bundle} %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave
b4bc2f
      fi
b4bc2f
    fi
b4bc2f
  fi
b4bc2f
e5c4b3
  if ! test -e %{pkidir}/tls/certs/%{openssl_format_trust_bundle}.rpmsave; then
b4bc2f
    # no backup yet
e5c4b3
    if test -e %{pkidir}/tls/certs/%{openssl_format_trust_bundle}; then
b4bc2f
      # a file exists
e5c4b3
      if ! test -L %{pkidir}/tls/certs/%{openssl_format_trust_bundle}; then
b4bc2f
        # it's an old regular file, not a link
e5c4b3
        mv -f %{pkidir}/tls/certs/%{openssl_format_trust_bundle} %{pkidir}/tls/certs/%{openssl_format_trust_bundle}.rpmsave
b4bc2f
      fi
b4bc2f
    fi
b4bc2f
  fi
b4bc2f
fi
b4bc2f
b4bc2f
b4bc2f
%post
b4bc2f
#if [ $1 -gt 1 ] ; then
b4bc2f
#  # when upgrading or downgrading
b4bc2f
#fi
b01320
%{_bindir}/ca-legacy install
b4bc2f
%{_bindir}/update-ca-trust
b4bc2f
b4bc2f
b4bc2f
%files
b4bc2f
%defattr(-,root,root,-)
b4bc2f
b4bc2f
%dir %{_sysconfdir}/ssl
b4bc2f
%dir %{pkidir}/tls
b4bc2f
%dir %{pkidir}/tls/certs
b4bc2f
%dir %{pkidir}/java
b4bc2f
%dir %{catrustdir}
b4bc2f
%dir %{catrustdir}/source
b4bc2f
%dir %{catrustdir}/source/anchors
b4bc2f
%dir %{catrustdir}/source/blacklist
b4bc2f
%dir %{catrustdir}/extracted
b4bc2f
%dir %{catrustdir}/extracted/pem
b4bc2f
%dir %{catrustdir}/extracted/openssl
b4bc2f
%dir %{catrustdir}/extracted/java
b01320
%dir %{_datadir}/pki
b4bc2f
%dir %{_datadir}/pki/ca-trust-source
b4bc2f
%dir %{_datadir}/pki/ca-trust-source/anchors
b4bc2f
%dir %{_datadir}/pki/ca-trust-source/blacklist
b01320
%dir %{_datadir}/pki/ca-trust-legacy
b01320
b01320
%config(noreplace) %{catrustdir}/ca-legacy.conf
b4bc2f
b4bc2f
%{_mandir}/man8/update-ca-trust.8.gz
b01320
%{_mandir}/man8/ca-legacy.8.gz
b4bc2f
%{_datadir}/pki/ca-trust-source/README
b4bc2f
%{catrustdir}/README
b4bc2f
%{catrustdir}/extracted/README
b4bc2f
%{catrustdir}/extracted/java/README
b4bc2f
%{catrustdir}/extracted/openssl/README
b4bc2f
%{catrustdir}/extracted/pem/README
b4bc2f
%{catrustdir}/source/README
b01320
%{_datadir}/doc/%{name}-%{version}/README
b4bc2f
b4bc2f
# symlinks for old locations
b4bc2f
%{pkidir}/tls/cert.pem
b4bc2f
%{pkidir}/tls/certs/%{classic_tls_bundle}
e5c4b3
%{pkidir}/tls/certs/%{openssl_format_trust_bundle}
b4bc2f
%{pkidir}/%{java_bundle}
b4bc2f
# symlink directory
b4bc2f
%{_sysconfdir}/ssl/certs
e5c4b3
b4bc2f
# master bundle file with trust
e5c4b3
%{_datadir}/pki/ca-trust-source/%{p11_format_bundle}
e5c4b3
b01320
%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
b01320
%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
b4bc2f
# update/extract tool
b4bc2f
%{_bindir}/update-ca-trust
b01320
%{_bindir}/ca-legacy
b01320
%ghost %{catrustdir}/source/ca-bundle.legacy.crt
b4bc2f
# files extracted files
b4bc2f
%ghost %{catrustdir}/extracted/pem/tls-ca-bundle.pem
b4bc2f
%ghost %{catrustdir}/extracted/pem/email-ca-bundle.pem
b4bc2f
%ghost %{catrustdir}/extracted/pem/objsign-ca-bundle.pem
e5c4b3
%ghost %{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle}
b4bc2f
%ghost %{catrustdir}/extracted/%{java_bundle}
b4bc2f
b4bc2f
b4bc2f
%changelog
41a370
*Tue Jun 09 2020 Bob Relyea <rrelyea@redhat.com> - 2020.2.41-70.0
41a370
- Update to CKBI 2.41 from NSS 3.53.0
41a370
-    Removing:
41a370
-     # Certificate "AddTrust Low-Value Services Root"
41a370
-     # Certificate "AddTrust External Root"
41a370
-     # Certificate "UTN USERFirst Email Root CA"
41a370
-     # Certificate "Certplus Class 2 Primary CA"
41a370
-     # Certificate "Deutsche Telekom Root CA 2"
41a370
-     # Certificate "Staat der Nederlanden Root CA - G2"
41a370
-     # Certificate "Swisscom Root CA 2"
41a370
-     # Certificate "Certinomis - Root CA"
41a370
-    Adding:
41a370
-     # Certificate "Entrust Root Certification Authority - G4"
41a370
- fix permissions on ghosted files.
41a370
171d4d
*Fri Jun 21 2019 Bob Relyea <rrelyea@redhat.com> - 2019.2.32-76
171d4d
- Update to CKBI 2.32 from NSS 3.44
171d4d
-   Removing:
171d4d
-   # Certificate "Visa eCommerce Root"
171d4d
-   # Certificate "AC Raiz Certicamara S.A."
171d4d
-   # Certificate "TC TrustCenter Class 3 CA II"
171d4d
-   # Certificate "ComSign CA"
171d4d
-   # Certificate "S-TRUST Universal Root CA"
171d4d
-   # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
171d4d
-   # Certificate "Certplus Root CA G1"
171d4d
-   # Certificate "Certplus Root CA G2"
171d4d
-   # Certificate "OpenTrust Root CA G1"
171d4d
-   # Certificate "OpenTrust Root CA G2"
171d4d
-   # Certificate "OpenTrust Root CA G3"
171d4d
-  Adding:
171d4d
-   # Certificate "GlobalSign Root CA - R6"
171d4d
-   # Certificate "OISTE WISeKey Global Root GC CA"
171d4d
-   # Certificate "GTS Root R1"
171d4d
-   # Certificate "GTS Root R2"
171d4d
-   # Certificate "GTS Root R3"
171d4d
-   # Certificate "GTS Root R4"
171d4d
-   # Certificate "UCA Global G2 Root"
171d4d
-   # Certificate "UCA Extended Validation Root"
171d4d
-   # Certificate "Certigna Root CA"
171d4d
-   # Certificate "emSign Root CA - G1"
171d4d
-   # Certificate "emSign ECC Root CA - G3"
171d4d
-   # Certificate "emSign Root CA - C1"
171d4d
-   # Certificate "emSign ECC Root CA - C3"
171d4d
-   # Certificate "Hongkong Post Root CA 3"
171d4d
6075f7
* Wed Mar 14 2018 Kai Engert <kaie@redhat.com> - 2018.2.22-70.0
6075f7
- Update to CKBI 2.22 from NSS 3.35
6075f7
e93225
* Wed Nov 29 2017 Kai Engert <kaie@redhat.com> - 2017.2.20-71
e93225
- Update to CKBI 2.20 from NSS 3.34.1
e93225
e93225
* Thu Oct 26 2017 Kai Engert <kaie@redhat.com> - 2017.2.18-71
e93225
- Update to CKBI 2.18 (pre-release snapshot)
e93225
e93225
* Tue Sep 26 2017 Kai Engert <kaie@redhat.com> - 2017.2.16-71
e93225
- Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
e93225
  Mozilla removed code signing trust from all CAs (rhbz#1472933)
e93225
e5c4b3
* Fri Apr 28 2017 Kai Engert <kaie@redhat.com> - 2017.2.14-71
e5c4b3
- Update to CKBI 2.14 from NSS 3.30.2
e5c4b3
e5c4b3
* Fri Mar 10 2017 Kai Engert <kaie@redhat.com> - 2017.2.11-73
e5c4b3
- No longer trust legacy CAs
e5c4b3
e5c4b3
* Fri Mar 10 2017 Kai Engert <kaie@redhat.com> - 2017.2.11-72
e5c4b3
- Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
e5c4b3
  as a preparation to fix bugs in the interaction between p11-kit-trust and
e5c4b3
  Mozilla applications, such as Firefox, Thunderbird etc.
e5c4b3
- For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
e5c4b3
- Require p11-kit 0.23.5
e5c4b3
- Added an utility to help with comparing output of the trust dump command.
aa494b
e5c4b3
* Tue Jan 17 2017 Kai Engert <kaie@redhat.com> - 2017.2.11-71
469a3f
- Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
469a3f
- Use comments in extracted bundle files.
469a3f
- Change packaging script to support empty legacy bundles.
469a3f
eb48f3
* Tue May 10 2016 Kai Engert <kaie@redhat.com> - 2016.2.6-73
eb48f3
- Use sln, not ln, to avoid the dependency on coreutils (rhbz#1328586)
eb48f3
eb48f3
* Mon Apr 25 2016 Kai Engert <kaie@redhat.com> - 2015.2.6-72
eb48f3
- Fixed a typo in a manual page (rhbz#1303960)
eb48f3
eb48f3
* Wed Jan 27 2016 Kai Engert <kaie@redhat.com> - 2015.2.6-71
f6df8d
- Update to CKBI 2.6 from NSS 3.21 with legacy modifications.
f6df8d
2e96a8
* Thu Apr 23 2015 Kai Engert <kaie@redhat.com> - 2015.2.4-71
b01320
- Update to CKBI 2.4 from NSS 3.18.1 with legacy modifications.
b01320
2e96a8
* Tue Apr 14 2015 Kai Engert <kaie@redhat.com> - 2015.2.3-72
2e96a8
- Fix a typo in the ca-legacy manual page (rhbz#1208850)
2e96a8
2e96a8
* Tue Mar 31 2015 Kai Engert <kaie@redhat.com> - 2015.2.3-71
b01320
- Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
2e96a8
- Add an alternative version of the "Thawte Premium Server CA" root,
2e96a8
  which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
2e96a8
  which contain that version of the root certificate.
2e96a8
  This change doesn't add trust for another key, because both versions
2e96a8
  of the certificate use the same public key (rhbz#1170982).
b01320
- Add a patch to the source RPM that documents the changes from the
b01320
  upstream version.
b01320
- Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
b01320
  configuration file.
b01320
- The new scriptlets require the coreutils package.
b01320
- Remove the obsolete blacklist.txt file.
b01320
237021
* Wed Sep 17 2014 Stef Walter <stefw@redhat.com> - 2014.1.98-72
237021
- The BasicConstraints fix for Entrust Root is no longer necessary.
237021
  In addition it was invalid for p11-kit 0.20.x. rhbz#1130485
237021
237021
* Wed Sep 03 2014 Kai Engert <kaie@redhat.com> - 2014.1.98-71
237021
- Update to CKBI 1.98 from NSS 3.16.1
74973b
- building on RHEL 7 no longer requires java-openjdk
74973b
- added more detailed instructions for release numbers on RHEL branches,
74973b
  to avoid problems when rebasing on both z- and y-stream branches.
74973b
e97ab0
* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 2013.1.95-71
e97ab0
- Mass rebuild 2013-12-27
e97ab0
e97ab0
* Tue Dec 17 2013 Kai Engert <kaie@redhat.com> - 2013.1.95-70.1
e97ab0
- Update to CKBI 1.95 from NSS 3.15.3.1
e97ab0
b4bc2f
* Fri Oct 18 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-70.1
b4bc2f
- Only create backup files if there is an original file, rhbz#999017
b4bc2f
b4bc2f
* Tue Sep 03 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-70.0
b4bc2f
- Update to CKBI 1.94 from NSS 3.15
b4bc2f
b4bc2f
* Wed Jul 17 2013 Kai Engert <kaie@redhat.com> - 2012.87-70.1
b4bc2f
- improve manpage
b4bc2f
b4bc2f
* Tue Jul 09 2013 Kai Engert <kaie@redhat.com> - 2012.87-70.0
b4bc2f
- use a release version that 's larger than on rhel 6
b4bc2f
b4bc2f
* Tue Jul 09 2013 Kai Engert <kaie@redhat.com> - 2012.87-10.4
b4bc2f
- clarification updates to manual page
b4bc2f
b4bc2f
* Mon Jul 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-10.3
b4bc2f
- added a manual page and related build requirements
b4bc2f
- simplify the README files now that we have a manual page
b4bc2f
- set a certificate alias in trusted bundle (thanks to Ludwig Nussel)
b4bc2f
b4bc2f
* Mon May 27 2013 Kai Engert <kaie@redhat.com> - 2012.87-10.2
b4bc2f
- use correct command in README files, rhbz#961809
b4bc2f
b4bc2f
* Mon Apr 22 2013 Kai Engert <kaie@redhat.com> - 2012.87-10.1
b4bc2f
- Add myself as contributor to certdata2.pem.py and remove use of rcs/ident.
b4bc2f
  (thanks to Michael Shuler for suggesting to do so)
b4bc2f
- Update source URLs and comments, add source file for version information.
b4bc2f
b4bc2f
* Wed Mar 27 2013 Kai Engert <kaie@redhat.com> - 2012.87-10.0
b4bc2f
- Use both label and serial to identify cert during conversion, rhbz#927601 
b4bc2f
b4bc2f
* Tue Mar 19 2013 Kai Engert <kaie@redhat.com> - 2012.87-9.fc19.1
b4bc2f
- adjust to changed and new functionality provided by p11-kit 0.17.3
b4bc2f
- updated READMEs to describe the new directory-specific treatment of files
b4bc2f
- ship a new file that contains certificates with neutral trust
b4bc2f
- ship a new file that contains distrust objects, and also staple a 
b4bc2f
  basic constraint extension to one legacy root contained in the
b4bc2f
  Mozilla CA list
b4bc2f
- adjust the build script to dynamically produce most of above files
b4bc2f
- add and own the anchors and blacklist subdirectories
b4bc2f
- file generate-cacerts.pl is no longer required
b4bc2f
b4bc2f
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9
b4bc2f
- Major rework for the Fedora SharedSystemCertificates feature.
b4bc2f
- Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
b4bc2f
- Require the p11-kit package that contains tools to automatically create
b4bc2f
  other file format bundles.
b4bc2f
- Convert old file locations to symbolic links that point to dynamically
b4bc2f
  generated files.
b4bc2f
- Old files, which might have been locally modified, will be saved in backup 
b4bc2f
  files with .rpmsave extension.
b4bc2f
- Added a update-ca-certificates script which can be used to regenerate
b4bc2f
  the merged trusted output.
b4bc2f
- Refer to the various README files that have been added for more detailed
b4bc2f
  explanation of the new system.
b4bc2f
- No longer require rsc for building.
b4bc2f
- Add explanation for the future version numbering scheme,
b4bc2f
  because the old numbering scheme was based on upstream using cvs,
b4bc2f
  which is no longer true, and therefore can no longer be used.
b4bc2f
- Includes changes from rhbz#873369.
b4bc2f
b4bc2f
* Thu Mar 07 2013 Kai Engert <kaie@redhat.com> - 2012.87-2.fc19.1
b4bc2f
- Ship trust bundle file in /usr/share/pki/ca-trust-source/, temporarily in addition.
b4bc2f
  This location will soon become the only place containing this file.
b4bc2f
b4bc2f
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2012.87-2
b4bc2f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
b4bc2f
b4bc2f
* Fri Jan 04 2013 Paul Wouters <pwouters@redhat.com> - 2012.87-1
b4bc2f
- Updated to r1.87 to blacklist mis-issued turktrust CA certs
b4bc2f
b4bc2f
* Wed Oct 24 2012 Paul Wouters <pwouters@redhat.com> - 2012.86-2
b4bc2f
- Updated blacklist with 20 entries (Diginotar, Trustwave, Comodo(?)
b4bc2f
- Fix to certdata2pem.py to also check for CKT_NSS_NOT_TRUSTED 
b4bc2f
b4bc2f
* Tue Oct 23 2012 Paul Wouters <pwouters@redhat.com> - 2012.86-1
b4bc2f
- update to r1.86
b4bc2f
b4bc2f
* Mon Jul 23 2012 Joe Orton <jorton@redhat.com> - 2012.85-2
b4bc2f
- add openssl to BuildRequires
b4bc2f
b4bc2f
* Mon Jul 23 2012 Joe Orton <jorton@redhat.com> - 2012.85-1
b4bc2f
- update to r1.85
b4bc2f
b4bc2f
* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2012.81-2
b4bc2f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
b4bc2f
b4bc2f
* Mon Feb 13 2012 Joe Orton <jorton@redhat.com> - 2012.81-1
b4bc2f
- update to r1.81
b4bc2f
b4bc2f
* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.80-2
b4bc2f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
b4bc2f
b4bc2f
* Wed Nov  9 2011 Joe Orton <jorton@redhat.com> - 2011.80-1
b4bc2f
- update to r1.80
b4bc2f
- fix handling of certs with dublicate Subject names (#733032)
b4bc2f
b4bc2f
* Thu Sep  1 2011 Joe Orton <jorton@redhat.com> - 2011.78-1
b4bc2f
- update to r1.78, removing trust from DigiNotar root (#734679)
b4bc2f
b4bc2f
* Wed Aug  3 2011 Joe Orton <jorton@redhat.com> - 2011.75-1
b4bc2f
- update to r1.75
b4bc2f
b4bc2f
* Wed Apr 20 2011 Joe Orton <jorton@redhat.com> - 2011.74-1
b4bc2f
- update to r1.74
b4bc2f
b4bc2f
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.70-2
b4bc2f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
b4bc2f
b4bc2f
* Wed Jan 12 2011 Joe Orton <jorton@redhat.com> - 2011.70-1
b4bc2f
- update to r1.70
b4bc2f
b4bc2f
* Tue Nov  9 2010 Joe Orton <jorton@redhat.com> - 2010.65-3
b4bc2f
- update to r1.65
b4bc2f
b4bc2f
* Wed Apr  7 2010 Joe Orton <jorton@redhat.com> - 2010.63-3
b4bc2f
- package /etc/ssl/certs symlink for third-party apps (#572725)
b4bc2f
b4bc2f
* Wed Apr  7 2010 Joe Orton <jorton@redhat.com> - 2010.63-2
b4bc2f
- rebuild
b4bc2f
b4bc2f
* Wed Apr  7 2010 Joe Orton <jorton@redhat.com> - 2010.63-1
b4bc2f
- update to certdata.txt r1.63
b4bc2f
- use upstream RCS version in Version
b4bc2f
b4bc2f
* Fri Mar 19 2010 Joe Orton <jorton@redhat.com> - 2010-4
b4bc2f
- fix ca-bundle.crt (#575111)
b4bc2f
b4bc2f
* Thu Mar 18 2010 Joe Orton <jorton@redhat.com> - 2010-3
b4bc2f
- update to certdata.txt r1.58
b4bc2f
- add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format
b4bc2f
- exclude ECC certs from the Java cacerts database
b4bc2f
- catch keytool failures
b4bc2f
- fail parsing certdata.txt on finding untrusted but not blacklisted cert
b4bc2f
b4bc2f
* Fri Jan 15 2010 Joe Orton <jorton@redhat.com> - 2010-2
b4bc2f
- fix Java cacert database generation: use Subject rather than Issuer
b4bc2f
  for alias name; add diagnostics; fix some alias names.
b4bc2f
b4bc2f
* Mon Jan 11 2010 Joe Orton <jorton@redhat.com> - 2010-1
b4bc2f
- adopt Python certdata.txt parsing script from Debian
b4bc2f
b4bc2f
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2009-2
b4bc2f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
b4bc2f
b4bc2f
* Wed Jul 22 2009 Joe Orton <jorton@redhat.com> 2009-1
b4bc2f
- update to certdata.txt r1.53
b4bc2f
b4bc2f
* Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2008-8
b4bc2f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
b4bc2f
b4bc2f
* Tue Oct 14 2008 Joe Orton <jorton@redhat.com> 2008-7
b4bc2f
- update to certdata.txt r1.49
b4bc2f
b4bc2f
* Wed Jun 25 2008 Thomas Fitzsimmons <fitzsim@redhat.com> - 2008-6
b4bc2f
- Change generate-cacerts.pl to produce pretty aliases.
b4bc2f
b4bc2f
* Mon Jun  2 2008 Joe Orton <jorton@redhat.com> 2008-5
b4bc2f
- include /etc/pki/tls/cert.pem symlink to ca-bundle.crt
b4bc2f
b4bc2f
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-4
b4bc2f
- use package name for temp dir, recreate it in prep
b4bc2f
b4bc2f
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-3
b4bc2f
- fix source script perms
b4bc2f
- mark packaged files as config(noreplace)
b4bc2f
b4bc2f
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-2
b4bc2f
- add (but don't use) mkcabundle.pl
b4bc2f
- tweak description
b4bc2f
- use /usr/bin/keytool directly; BR java-openjdk
b4bc2f
b4bc2f
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-1
b4bc2f
- Initial build (#448497)