Blame SPECS/ca-certificates.spec

3c42f9
%define pkidir %{_sysconfdir}/pki
3c42f9
%define catrustdir %{_sysconfdir}/pki/ca-trust
3c42f9
%define classic_tls_bundle ca-bundle.crt
3c42f9
%define openssl_format_trust_bundle ca-bundle.trust.crt
3c42f9
%define p11_format_bundle ca-bundle.trust.p11-kit
3c42f9
%define legacy_default_bundle ca-bundle.legacy.default.crt
3c42f9
%define legacy_disable_bundle ca-bundle.legacy.disable.crt
3c42f9
%define java_bundle java/cacerts
3c42f9
3c42f9
Summary: The Mozilla CA root certificate bundle
3c42f9
Name: ca-certificates
3c42f9
3c42f9
# For the package version number, we use: year.{upstream version}
3c42f9
#
3c42f9
# The {upstream version} can be found as symbol
3c42f9
# NSS_BUILTINS_LIBRARY_VERSION in file nss/lib/ckfw/builtins/nssckbi.h
3c42f9
# which corresponds to the data in file nss/lib/ckfw/builtins/certdata.txt.
3c42f9
#
3c42f9
# The files should be taken from a released version of NSS, as published
3c42f9
# at https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/
3c42f9
#
3c42f9
# The versions that are used by the latest released version of 
3c42f9
# Mozilla Firefox should be available from:
3c42f9
# https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/nssckbi.h
3c42f9
# https://hg.mozilla.org/releases/mozilla-release/raw-file/default/security/nss/lib/ckfw/builtins/certdata.txt
3c42f9
#
3c42f9
# The most recent development versions of the files can be found at
3c42f9
# http://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/nssckbi.h
3c42f9
# http://hg.mozilla.org/projects/nss/raw-file/default/lib/ckfw/builtins/certdata.txt
3c42f9
# (but these files might have not yet been released).
3c42f9
#
3c42f9
# (until 2012.87 the version was based on the cvs revision ID of certdata.txt,
3c42f9
# but in 2013 the NSS projected was migrated to HG. Old version 2012.87 is 
3c42f9
# equivalent to new version 2012.1.93, which would break the requirement 
3c42f9
# to have increasing version numbers. However, the new scheme will work, 
3c42f9
# because all future versions will start with 2013 or larger.)
3c42f9
67e491
Version: 2021.2.50
3c42f9
# On RHEL 8.x, please keep the release version >= 80
3c42f9
# When rebasing on Y-Stream (8.y), use 81, 82, 83, ...
3c42f9
# When rebasing on Z-Stream (8.y.z), use 80.0, 80.1, 80.2, ..
dfbe3a
Release: 80.0%{?dist}
3c42f9
License: Public Domain
3c42f9
3c42f9
Group: System Environment/Base
3c42f9
URL: https://fedoraproject.org/wiki/CA-Certificates
3c42f9
3c42f9
#Please always update both certdata.txt and nssckbi.h
3c42f9
Source0: certdata.txt
3c42f9
Source1: nssckbi.h
3c42f9
Source2: update-ca-trust
3c42f9
Source3: trust-fixes
3c42f9
Source4: certdata2pem.py
3c42f9
Source5: ca-legacy.conf
3c42f9
Source6: ca-legacy
3c42f9
Source9: ca-legacy.8.txt
3c42f9
Source10: update-ca-trust.8.txt
3c42f9
Source11: README.usr
3c42f9
Source12: README.etc
3c42f9
Source13: README.extr
3c42f9
Source14: README.java
3c42f9
Source15: README.openssl
3c42f9
Source16: README.pem
3c42f9
Source17: README.edk2
3c42f9
Source18: README.src
3c42f9
3c42f9
BuildArch: noarch
3c42f9
3c42f9
Requires(post): bash
3c42f9
Requires(post): grep
3c42f9
Requires(post): sed
3c42f9
Requires(post): coreutils
3c42f9
Requires: bash
3c42f9
Requires: grep
3c42f9
Requires: sed
3c42f9
Requires(post): p11-kit >= 0.23.12
3c42f9
Requires(post): p11-kit-trust >= 0.23.12
3c42f9
Requires: p11-kit >= 0.23.12
3c42f9
Requires: p11-kit-trust >= 0.23.12
3c42f9
3c42f9
BuildRequires: perl-interpreter
3c42f9
BuildRequires: python3-devel
3c42f9
BuildRequires: openssl
3c42f9
BuildRequires: asciidoc
3c42f9
BuildRequires: libxslt
3c42f9
3c42f9
%description
3c42f9
This package contains the set of CA certificates chosen by the
3c42f9
Mozilla Foundation for use with the Internet PKI.
3c42f9
3c42f9
%prep
3c42f9
rm -rf %{name}
3c42f9
mkdir %{name}
3c42f9
mkdir %{name}/certs
3c42f9
mkdir %{name}/certs/legacy-default
3c42f9
mkdir %{name}/certs/legacy-disable
3c42f9
mkdir %{name}/java
3c42f9
3c42f9
%build
3c42f9
pushd %{name}/certs
3c42f9
 pwd
3c42f9
 cp %{SOURCE0} .
3c42f9
 %{__python3} %{SOURCE4} >c2p.log 2>c2p.err
3c42f9
popd
3c42f9
pushd %{name}
3c42f9
 (
3c42f9
   cat <
3c42f9
# This is a bundle of X.509 certificates of public Certificate
3c42f9
# Authorities.  It was generated from the Mozilla root CA list.
3c42f9
# These certificates and trust/distrust attributes use the file format accepted
3c42f9
# by the p11-kit-trust module.
3c42f9
#
3c42f9
# Source: nss/lib/ckfw/builtins/certdata.txt
3c42f9
# Source: nss/lib/ckfw/builtins/nssckbi.h
3c42f9
#
3c42f9
# Generated from:
3c42f9
EOF
3c42f9
   cat %{SOURCE1}  |grep -w NSS_BUILTINS_LIBRARY_VERSION | awk '{print "# " $2 " " $3}';
3c42f9
   echo '#';
3c42f9
 ) > %{p11_format_bundle}
3c42f9
3c42f9
 touch %{legacy_default_bundle}
3c42f9
 NUM_LEGACY_DEFAULT=`find certs/legacy-default -type f | wc -l`
3c42f9
 if [ $NUM_LEGACY_DEFAULT -ne 0 ]; then
3c42f9
     for f in certs/legacy-default/*.crt; do 
3c42f9
       echo "processing $f"
3c42f9
       tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
3c42f9
       alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
3c42f9
       targs=""
3c42f9
       if [ -n "$tbits" ]; then
3c42f9
          for t in $tbits; do
3c42f9
             targs="${targs} -addtrust $t"
3c42f9
          done
3c42f9
       fi
3c42f9
       if [ -n "$targs" ]; then
3c42f9
          echo "legacy default flags $targs for $f" >> info.trust
3c42f9
          openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_default_bundle}
3c42f9
       fi
3c42f9
     done
3c42f9
 fi
3c42f9
3c42f9
 touch %{legacy_disable_bundle}
3c42f9
 NUM_LEGACY_DISABLE=`find certs/legacy-disable -type f | wc -l`
3c42f9
 if [ $NUM_LEGACY_DISABLE -ne 0 ]; then
3c42f9
     for f in certs/legacy-disable/*.crt; do 
3c42f9
       echo "processing $f"
3c42f9
       tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f`
3c42f9
       alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'`
3c42f9
       targs=""
3c42f9
       if [ -n "$tbits" ]; then
3c42f9
          for t in $tbits; do
3c42f9
             targs="${targs} -addtrust $t"
3c42f9
          done
3c42f9
       fi
3c42f9
       if [ -n "$targs" ]; then
3c42f9
          echo "legacy disable flags $targs for $f" >> info.trust
3c42f9
          openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> %{legacy_disable_bundle}
3c42f9
       fi
3c42f9
     done
3c42f9
 fi
3c42f9
3c42f9
 P11FILES=`find certs -name \*.tmp-p11-kit | wc -l`
3c42f9
 if [ $P11FILES -ne 0 ]; then
3c42f9
   for p in certs/*.tmp-p11-kit; do 
3c42f9
     cat "$p" >> %{p11_format_bundle}
3c42f9
   done
3c42f9
 fi
3c42f9
 # Append our trust fixes
3c42f9
 cat %{SOURCE3} >> %{p11_format_bundle}
3c42f9
popd
3c42f9
3c42f9
#manpage
3c42f9
cp %{SOURCE10} %{name}/update-ca-trust.8.txt
3c42f9
asciidoc.py -v -d manpage -b docbook %{name}/update-ca-trust.8.txt
3c42f9
xsltproc --nonet -o %{name}/update-ca-trust.8 /usr/share/asciidoc/docbook-xsl/manpage.xsl %{name}/update-ca-trust.8.xml
3c42f9
3c42f9
cp %{SOURCE9} %{name}/ca-legacy.8.txt
3c42f9
asciidoc.py -v -d manpage -b docbook %{name}/ca-legacy.8.txt
3c42f9
xsltproc --nonet -o %{name}/ca-legacy.8 /usr/share/asciidoc/docbook-xsl/manpage.xsl %{name}/ca-legacy.8.xml
3c42f9
3c42f9
3c42f9
%install
3c42f9
rm -rf $RPM_BUILD_ROOT
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/tls/certs
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{pkidir}/java
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/ssl
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source/anchors
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/source/blacklist
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/java
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{catrustdir}/extracted/edk2
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/anchors
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/blacklist
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_bindir}
3c42f9
mkdir -p -m 755 $RPM_BUILD_ROOT%{_mandir}/man8
3c42f9
3c42f9
install -p -m 644 %{name}/update-ca-trust.8 $RPM_BUILD_ROOT%{_mandir}/man8
3c42f9
install -p -m 644 %{name}/ca-legacy.8 $RPM_BUILD_ROOT%{_mandir}/man8
3c42f9
install -p -m 644 %{SOURCE11} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/README
3c42f9
install -p -m 644 %{SOURCE12} $RPM_BUILD_ROOT%{catrustdir}/README
3c42f9
install -p -m 644 %{SOURCE13} $RPM_BUILD_ROOT%{catrustdir}/extracted/README
3c42f9
install -p -m 644 %{SOURCE14} $RPM_BUILD_ROOT%{catrustdir}/extracted/java/README
3c42f9
install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/README
3c42f9
install -p -m 644 %{SOURCE16} $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/README
3c42f9
install -p -m 644 %{SOURCE17} $RPM_BUILD_ROOT%{catrustdir}/extracted/edk2/README
3c42f9
install -p -m 644 %{SOURCE18} $RPM_BUILD_ROOT%{catrustdir}/source/README
3c42f9
3c42f9
install -p -m 644 %{name}/%{p11_format_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{p11_format_bundle}
3c42f9
3c42f9
install -p -m 644 %{name}/%{legacy_default_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
3c42f9
install -p -m 644 %{name}/%{legacy_disable_bundle} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
3c42f9
3c42f9
install -p -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{catrustdir}/ca-legacy.conf
3c42f9
3c42f9
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-source/%{p11_format_bundle}
3c42f9
3c42f9
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
3c42f9
touch -r %{SOURCE0} $RPM_BUILD_ROOT%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
3c42f9
3c42f9
# TODO: consider to dynamically create the update-ca-trust script from within
3c42f9
#       this .spec file, in order to have the output file+directory names at once place only.
3c42f9
install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_bindir}/update-ca-trust
3c42f9
3c42f9
install -p -m 755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/ca-legacy
3c42f9
3c42f9
# touch ghosted files that will be extracted dynamically
3c42f9
# Set chmod 444 to use identical permission
3c42f9
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
3c42f9
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
3c42f9
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
3c42f9
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
3c42f9
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
3c42f9
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
3c42f9
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle}
3c42f9
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle}
3c42f9
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
3c42f9
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
3c42f9
touch $RPM_BUILD_ROOT%{catrustdir}/extracted/edk2/cacerts.bin
3c42f9
chmod 444 $RPM_BUILD_ROOT%{catrustdir}/extracted/edk2/cacerts.bin
3c42f9
3c42f9
# /etc/ssl/certs symlink for 3rd-party tools
3c42f9
ln -s ../pki/tls/certs \
3c42f9
    $RPM_BUILD_ROOT%{_sysconfdir}/ssl/certs
3c42f9
# legacy filenames
3c42f9
ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
3c42f9
    $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
3c42f9
ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
3c42f9
    $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{classic_tls_bundle}
3c42f9
ln -s %{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle} \
3c42f9
    $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{openssl_format_trust_bundle}
3c42f9
ln -s %{catrustdir}/extracted/%{java_bundle} \
3c42f9
    $RPM_BUILD_ROOT%{pkidir}/%{java_bundle}
3c42f9
3c42f9
3c42f9
%pre
3c42f9
if [ $1 -gt 1 ] ; then
3c42f9
  # Upgrade or Downgrade.
3c42f9
  # If the classic filename is a regular file, then we are upgrading
3c42f9
  # from an old package and we will move it to an .rpmsave backup file.
3c42f9
  # If the filename is a symbolic link, then we are good already.
3c42f9
  # If the system will later be downgraded to an old package with regular 
3c42f9
  # files, and afterwards updated again to a newer package with symlinks,
3c42f9
  # and the old .rpmsave backup file didn't get cleaned up,
3c42f9
  # then we don't backup again. We keep the older backup file.
3c42f9
  # In other words, if an .rpmsave file already exists, we don't overwrite it.
3c42f9
  #
3c42f9
  if ! test -e %{pkidir}/%{java_bundle}.rpmsave; then
3c42f9
    # no backup yet
3c42f9
    if test -e %{pkidir}/%{java_bundle}; then
3c42f9
      # a file exists
3c42f9
        if ! test -L %{pkidir}/%{java_bundle}; then
3c42f9
        # it's an old regular file, not a link
3c42f9
        mv -f %{pkidir}/%{java_bundle} %{pkidir}/%{java_bundle}.rpmsave
3c42f9
      fi
3c42f9
    fi
3c42f9
  fi
3c42f9
3c42f9
  if ! test -e %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave; then
3c42f9
    # no backup yet
3c42f9
    if test -e %{pkidir}/tls/certs/%{classic_tls_bundle}; then
3c42f9
      # a file exists
3c42f9
      if ! test -L %{pkidir}/tls/certs/%{classic_tls_bundle}; then
3c42f9
        # it's an old regular file, not a link
3c42f9
        mv -f %{pkidir}/tls/certs/%{classic_tls_bundle} %{pkidir}/tls/certs/%{classic_tls_bundle}.rpmsave
3c42f9
      fi
3c42f9
    fi
3c42f9
  fi
3c42f9
3c42f9
  if ! test -e %{pkidir}/tls/certs/%{openssl_format_trust_bundle}.rpmsave; then
3c42f9
    # no backup yet
3c42f9
    if test -e %{pkidir}/tls/certs/%{openssl_format_trust_bundle}; then
3c42f9
      # a file exists
3c42f9
      if ! test -L %{pkidir}/tls/certs/%{openssl_format_trust_bundle}; then
3c42f9
        # it's an old regular file, not a link
3c42f9
        mv -f %{pkidir}/tls/certs/%{openssl_format_trust_bundle} %{pkidir}/tls/certs/%{openssl_format_trust_bundle}.rpmsave
3c42f9
      fi
3c42f9
    fi
3c42f9
  fi
3c42f9
fi
3c42f9
3c42f9
%post
3c42f9
#if [ $1 -gt 1 ] ; then
3c42f9
#  # when upgrading or downgrading
3c42f9
#fi
3c42f9
# if ln is available, go ahead and run the ca-legacy and update
3c42f9
# scripts. If not, wait until %posttrans.
3c42f9
if [ -x %{_bindir}/ln ]; then
3c42f9
%{_bindir}/ca-legacy install
3c42f9
%{_bindir}/update-ca-trust
3c42f9
fi
3c42f9
3c42f9
%posttrans
3c42f9
# When coreutils is installing with ca-certificates
3c42f9
# we need to wait until coreutils install to
3c42f9
# run our update since update requires ln to complete.
3c42f9
# There is a circular dependency here where
3c42f9
# ca-certificates depends on coreutils
3c42f9
# coreutils depends on openssl
3c42f9
# openssl depends on ca-certificates
3c42f9
# so we run the scripts here too, in case we couldn't run them in
3c42f9
# post. If we *could* run them in post this is an unnecessary
3c42f9
# duplication, but it shouldn't hurt anything
3c42f9
%{_bindir}/ca-legacy install
3c42f9
%{_bindir}/update-ca-trust
3c42f9
3c42f9
%files
3c42f9
%defattr(-,root,root,-)
3c42f9
3c42f9
%dir %{_sysconfdir}/ssl
3c42f9
%dir %{pkidir}/tls
3c42f9
%dir %{pkidir}/tls/certs
3c42f9
%dir %{pkidir}/java
3c42f9
%dir %{catrustdir}
3c42f9
%dir %{catrustdir}/source
3c42f9
%dir %{catrustdir}/source/anchors
3c42f9
%dir %{catrustdir}/source/blacklist
3c42f9
%dir %{catrustdir}/extracted
3c42f9
%dir %{catrustdir}/extracted/pem
3c42f9
%dir %{catrustdir}/extracted/openssl
3c42f9
%dir %{catrustdir}/extracted/java
3c42f9
%dir %{_datadir}/pki
3c42f9
%dir %{_datadir}/pki/ca-trust-source
3c42f9
%dir %{_datadir}/pki/ca-trust-source/anchors
3c42f9
%dir %{_datadir}/pki/ca-trust-source/blacklist
3c42f9
%dir %{_datadir}/pki/ca-trust-legacy
3c42f9
3c42f9
%config(noreplace) %{catrustdir}/ca-legacy.conf
3c42f9
3c42f9
%{_mandir}/man8/update-ca-trust.8.gz
3c42f9
%{_mandir}/man8/ca-legacy.8.gz
3c42f9
%{_datadir}/pki/ca-trust-source/README
3c42f9
%{catrustdir}/README
3c42f9
%{catrustdir}/extracted/README
3c42f9
%{catrustdir}/extracted/java/README
3c42f9
%{catrustdir}/extracted/openssl/README
3c42f9
%{catrustdir}/extracted/pem/README
3c42f9
%{catrustdir}/extracted/edk2/README
3c42f9
%{catrustdir}/source/README
3c42f9
3c42f9
# symlinks for old locations
3c42f9
%{pkidir}/tls/cert.pem
3c42f9
%{pkidir}/tls/certs/%{classic_tls_bundle}
3c42f9
%{pkidir}/tls/certs/%{openssl_format_trust_bundle}
3c42f9
%{pkidir}/%{java_bundle}
3c42f9
# symlink directory
3c42f9
%{_sysconfdir}/ssl/certs
3c42f9
3c42f9
# master bundle file with trust
3c42f9
%{_datadir}/pki/ca-trust-source/%{p11_format_bundle}
3c42f9
3c42f9
%{_datadir}/pki/ca-trust-legacy/%{legacy_default_bundle}
3c42f9
%{_datadir}/pki/ca-trust-legacy/%{legacy_disable_bundle}
3c42f9
# update/extract tool
3c42f9
%{_bindir}/update-ca-trust
3c42f9
%{_bindir}/ca-legacy
3c42f9
%ghost %{catrustdir}/source/ca-bundle.legacy.crt
3c42f9
# files extracted files
3c42f9
%ghost %{catrustdir}/extracted/pem/tls-ca-bundle.pem
3c42f9
%ghost %{catrustdir}/extracted/pem/email-ca-bundle.pem
3c42f9
%ghost %{catrustdir}/extracted/pem/objsign-ca-bundle.pem
3c42f9
%ghost %{catrustdir}/extracted/openssl/%{openssl_format_trust_bundle}
3c42f9
%ghost %{catrustdir}/extracted/%{java_bundle}
3c42f9
%ghost %{catrustdir}/extracted/edk2/cacerts.bin
3c42f9
3c42f9
3c42f9
%changelog
dfbe3a
*Wed Jun 16 2021 Bob Relyea <rrelyea@redhat.com> - 2021.2.50-80.0
67e491
- Update to CKBI 2.50 from NSS 3.67
67e491
   - version number update only
67e491
dfbe3a
*Fri Jun 11 2021 Bob Relyea <rrelyea@redhat.com> - 2021.2.48-80.0
67e491
- Update to CKBI 2.48 from NSS 3.66
67e491
-    Removing:
67e491
-     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
67e491
-     # Certificate "GeoTrust Global CA"
67e491
-     # Certificate "GeoTrust Universal CA"
67e491
-     # Certificate "GeoTrust Universal CA 2"
dfbe3a
-     # Certificate "QuoVadis Root CA"
dfbe3a
-     # Certificate "Sonera Class 2 Root CA"
67e491
-     # Certificate "Taiwan GRCA"
67e491
-     # Certificate "GeoTrust Primary Certification Authority"
67e491
-     # Certificate "thawte Primary Root CA"
67e491
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
67e491
-     # Certificate "GeoTrust Primary Certification Authority - G3"
67e491
-     # Certificate "thawte Primary Root CA - G2"
67e491
-     # Certificate "thawte Primary Root CA - G3"
67e491
-     # Certificate "GeoTrust Primary Certification Authority - G2"
67e491
-     # Certificate "VeriSign Universal Root Certification Authority"
67e491
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
dfbe3a
-     # Certificate "Trustis FPS Root CA"
67e491
-     # Certificate "EE Certification Centre Root CA"
67e491
-     # Certificate "LuxTrust Global Root 2"
67e491
-     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
67e491
-     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
67e491
-    Adding:
67e491
-     # Certificate "Microsoft ECC Root Certificate Authority 2017"
67e491
-     # Certificate "Microsoft RSA Root Certificate Authority 2017"
67e491
-     # Certificate "e-Szigno Root CA 2017"
67e491
-     # Certificate "certSIGN Root CA G2"
67e491
-     # Certificate "Trustwave Global Certification Authority"
67e491
-     # Certificate "Trustwave Global ECC P256 Certification Authority"
67e491
-     # Certificate "Trustwave Global ECC P384 Certification Authority"
67e491
-     # Certificate "NAVER Global Root Certification Authority"
67e491
-     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
67e491
-     # Certificate "GlobalSign Secure Mail Root R45"
67e491
-     # Certificate "GlobalSign Secure Mail Root E45"
67e491
-     # Certificate "GlobalSign Root R46"
67e491
-     # Certificate "GlobalSign Root E46"
dfbe3a
-     # Certificate "GLOBALTRUST 2020"
dfbe3a
-     # Certificate "ANF Secure Server Root CA"
dfbe3a
-     # Certificate "Certum EC-384 CA"
dfbe3a
-     # Certificate "Certum Trusted Root CA"
67e491
67e491
*Wed Jun 17 2020 Bob Relyea <rrelyea@redhat.com> - 2020.2.41-82
67e491
- fix post issues
67e491
67e491
*Wed Jun 10 2020 Bob Relyea <rrelyea@redhat.com> - 2020.2.41-81
3c42f9
- Update to CKBI 2.41 from NSS 3.53.0
3c42f9
-    Removing:
3c42f9
-     # Certificate "AddTrust Low-Value Services Root"
3c42f9
-     # Certificate "AddTrust External Root"
3c42f9
-     # Certificate "UTN USERFirst Email Root CA"
3c42f9
-     # Certificate "Certplus Class 2 Primary CA"
3c42f9
-     # Certificate "Deutsche Telekom Root CA 2"
3c42f9
-     # Certificate "Staat der Nederlanden Root CA - G2"
3c42f9
-     # Certificate "Swisscom Root CA 2"
3c42f9
-     # Certificate "Certinomis - Root CA"
3c42f9
-    Adding:
3c42f9
-     # Certificate "Entrust Root Certification Authority - G4"
3c42f9
67e491
*Fri Jun 21 2019 Bob Relyea <rrelyea@redhat.com> - 2019.2.32-1
3c42f9
- Update to CKBI 2.32 from NSS 3.44
3c42f9
-  Removing:
3c42f9
-   # Certificate "Visa eCommerce Root"
3c42f9
-   # Certificate "AC Raiz Certicamara S.A."
3c42f9
-   # Certificate "ComSign CA"
3c42f9
-   # Certificate "Certplus Root CA G1"
3c42f9
-   # Certificate "Certplus Root CA G2"
3c42f9
-   # Certificate "OpenTrust Root CA G1"
3c42f9
-   # Certificate "OpenTrust Root CA G2"
3c42f9
-   # Certificate "OpenTrust Root CA G3"
3c42f9
-  Adding:
3c42f9
-   # Certificate "GlobalSign Root CA - R6"
3c42f9
-   # Certificate "OISTE WISeKey Global Root GC CA"
3c42f9
-   # Certificate "GTS Root R1"
3c42f9
-   # Certificate "GTS Root R2"
3c42f9
-   # Certificate "GTS Root R3"
3c42f9
-   # Certificate "GTS Root R4"
3c42f9
-   # Certificate "UCA Global G2 Root"
3c42f9
-   # Certificate "UCA Extended Validation Root"
3c42f9
-   # Certificate "Certigna Root CA"
3c42f9
-   # Certificate "emSign Root CA - G1"
3c42f9
-   # Certificate "emSign ECC Root CA - G3"
3c42f9
-   # Certificate "emSign Root CA - C1"
3c42f9
-   # Certificate "emSign ECC Root CA - C3"
3c42f9
-   # Certificate "Hongkong Post Root CA 3"
3c42f9
3c42f9
* Fri May 10 2019 Robert Relyea <rrelyea@redhat.com> - 2018.2.24-6.1
3c42f9
- Test gating
3c42f9
3c42f9
* Mon Aug 13 2018 Tomáš Mráz <tmraz@redhat.com> - 2018.2.24-6
3c42f9
- Use __python3 macro when invoking Python
3c42f9
3c42f9
* Thu Jun 28 2018 Kai Engert <kaie@redhat.com> - 2018.2.24-5
3c42f9
- Ported scripts to python3
3c42f9
3c42f9
* Mon Jun 11 2018 Daiki Ueno <dueno@redhat.com> - 2018.2.24-4
3c42f9
- Extract certificate bundle in EDK2 format, suggested by Laszlo Ersek
3c42f9
3c42f9
* Mon Jun 04 2018 Kai Engert <kaie@redhat.com> - 2018.2.24-3
3c42f9
- Adjust ghost file permissions, rhbz#1564432
3c42f9
3c42f9
* Fri May 18 2018 Kai Engert <kaie@redhat.com> - 2018.2.24-2
3c42f9
- Update to CKBI 2.24 from NSS 3.37
3c42f9
3c42f9
* Wed Mar 14 2018 Iryna Shcherbina <ishcherb@redhat.com> - 2018.2.22-4
3c42f9
- Update Python 2 dependency declarations to new packaging standards
3c42f9
  (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
3c42f9
3c42f9
* Fri Feb 23 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 2018.2.22-3
3c42f9
- Add post dep on coreutils for ln(1)
3c42f9
3c42f9
* Tue Feb 06 2018 Kai Engert <kaie@redhat.com> - 2018.2.22-2
3c42f9
- Update to CKBI 2.22 from NSS 3.35
3c42f9
3c42f9
* Mon Jan 22 2018 Kai Engert <kaie@redhat.com> - 2017.2.20-6
3c42f9
- Depend on bash, grep, sed. Required for ca-legacy script execution.
3c42f9
- p11-kit is already required at %%post execution time. (rhbz#1537127)
3c42f9
3c42f9
* Fri Jan 19 2018 Kai Engert <kaie@redhat.com> - 2017.2.20-5
3c42f9
- Use the force, script! (Which sln did by default).
3c42f9
3c42f9
* Fri Jan 19 2018 Kai Engert <kaie@redhat.com> - 2017.2.20-4
3c42f9
- stop using sln in ca-legacy script.
3c42f9
3c42f9
* Fri Jan 19 2018 Kai Engert <kaie@redhat.com> - 2017.2.20-3
3c42f9
- Use ln -s, because sln was removed from glibc. rhbz#1536349
3c42f9
3c42f9
* Mon Nov 27 2017 Kai Engert <kaie@redhat.com> - 2017.2.20-2
3c42f9
- Update to CKBI 2.20 from NSS 3.34.1
3c42f9
3c42f9
* Tue Aug 15 2017 Kai Engert <kaie@redhat.com> - 2017.2.16-4
3c42f9
- Set P11_KIT_NO_USER_CONFIG=1 to prevent p11-kit from reading user
3c42f9
  configuration files (rhbz#1478172).
3c42f9
3c42f9
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2017.2.16-3
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
3c42f9
3c42f9
* Wed Jul 19 2017 Kai Engert <kaie@redhat.com> - 2017.2.16-2
3c42f9
- Update to (yet unreleased) CKBI 2.16 which is planned for NSS 3.32.
3c42f9
  Mozilla removed all trust bits for code signing.
3c42f9
3c42f9
* Wed Apr 26 2017 Kai Engert <kaie@redhat.com> - 2017.2.14-2
3c42f9
- Update to CKBI 2.14 from NSS 3.30.2
3c42f9
3c42f9
* Thu Feb 23 2017 Kai Engert <kaie@redhat.com> - 2017.2.11-5
3c42f9
- For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
3c42f9
- Set attribute modifiable: false
3c42f9
- Require p11-kit 0.23.4
3c42f9
3c42f9
* Mon Feb 13 2017 Kai Engert <kaie@redhat.com> - 2017.2.11-4
3c42f9
- Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
3c42f9
  as a preparation to fix bugs in the interaction between p11-kit-trust and
3c42f9
  Mozilla applications, such as Firefox, Thunderbird etc.
3c42f9
- Changed update-ca-trust to add comments to extracted PEM format files.
3c42f9
- Added an utility to help with comparing output of the trust dump command.
3c42f9
3c42f9
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2017.2.11-3
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
3c42f9
3c42f9
* Wed Jan 11 2017 Kai Engert <kaie@redhat.com> - 2017.2.11-2
3c42f9
- Update to CKBI 2.11 from NSS 3.28.1
3c42f9
3c42f9
* Thu Sep 29 2016 Kai Engert <kaie@redhat.com> - 2016.2.10-2
3c42f9
- Update to CKBI 2.10 from NSS 3.27
3c42f9
3c42f9
* Tue Aug 16 2016 Kai Engert <kaie@redhat.com> - 2016.2.9-3
3c42f9
- Revert to the unmodified upstream CA list, changing the legacy trust
3c42f9
  to an empty list. Keeping the ca-legacy tool and existing config,
3c42f9
  however, the configuration has no effect after this change.
3c42f9
3c42f9
* Tue Aug 16 2016 Kai Engert <kaie@redhat.com> - 2016.2.9-2
3c42f9
- Update to CKBI 2.9 from NSS 3.26 with legacy modifications
3c42f9
3c42f9
* Fri Jul 15 2016 Kai Engert <kaie@redhat.com> - 2016.2.8-2
3c42f9
- Update to CKBI 2.8 from NSS 3.25 with legacy modifications
3c42f9
3c42f9
* Tue May 10 2016 Kai Engert <kaie@redhat.com> - 2016.2.7-5
3c42f9
- Only create backup files if there is an original file (bug 999017).
3c42f9
3c42f9
* Tue May 10 2016 Kai Engert <kaie@redhat.com> - 2016.2.7-4
3c42f9
- Use sln, not ln, to avoid the dependency on coreutils.
3c42f9
3c42f9
* Mon Apr 25 2016 Kai Engert <kaie@redhat.com> - 2016.2.7-3
3c42f9
- Fix typos in a manual page and in a README file.
3c42f9
3c42f9
* Wed Mar 16 2016 Kai Engert <kaie@redhat.com> - 2016.2.7-2
3c42f9
- Update to CKBI 2.7 from NSS 3.23 with legacy modifications
3c42f9
3c42f9
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2015.2.6-3
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
3c42f9
3c42f9
* Mon Nov 23 2015 Kai Engert <kaie@redhat.com> - 2015.2.6-2
3c42f9
- Update to CKBI 2.6 from NSS 3.21 with legacy modifications
3c42f9
3c42f9
* Thu Aug 13 2015 Kai Engert <kaie@redhat.com> - 2015.2.5-2
3c42f9
- Update to CKBI 2.5 from NSS 3.19.3 with legacy modifications
3c42f9
3c42f9
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2015.2.4-3
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
3c42f9
3c42f9
* Tue May 05 2015 Kai Engert <kaie@redhat.com> - 2015.2.4-2
3c42f9
- Update to CKBI 2.4 from NSS 3.18.1 with legacy modifications
3c42f9
3c42f9
* Tue May 05 2015 Kai Engert <kaie@redhat.com> - 2015.2.3-4
3c42f9
- Fixed a typo in the ca-legacy manual page.
3c42f9
3c42f9
* Tue Mar 31 2015 Kai Engert <kaie@redhat.com> - 2015.2.3-3
3c42f9
- Don't use "enable" as a value for the legacy configuration, instead
3c42f9
  of the value "default", to make it clear that this preference isn't
3c42f9
  a promise to keep certificates enabled, but rather that we only
3c42f9
  keep them enabled as long as it's considered necessary.
3c42f9
- Changed the configuration file, the ca-legacy utility and filenames
3c42f9
  to use the term "default" (instead of the term "enable").
3c42f9
- Added a manual page for the ca-legacy utility.
3c42f9
- Fixed the ca-legacy utility to handle absence of the configuration
3c42f9
  setting and treat absence as the default setting.
3c42f9
3c42f9
* Fri Mar 20 2015 Kai Engert <kaie@redhat.com> - 2015.2.3-2
3c42f9
- Update to CKBI 2.3 from NSS 3.18 with legacy modifications
3c42f9
- Fixed a mistake in the legacy handling of the upstream 2.2 release:
3c42f9
  Removed two AOL certificates from the legacy group, because
3c42f9
  upstream didn't remove them as part of phasing out 1024-bit
3c42f9
  certificates, which means it isn't necessary to keep them.
3c42f9
- Fixed a mistake in the legacy handling of the upstream 2.1 release:
3c42f9
  Moved two NetLock certificates into the legacy group.
3c42f9
3c42f9
* Tue Dec 16 2014 Kai Engert <kaie@redhat.com> - 2014.2.2-2
3c42f9
- Update to CKBI 2.2 from NSS 3.17.3 with legacy modifications
3c42f9
- Update project URL
3c42f9
- Cleanup
3c42f9
3c42f9
* Sat Nov 15 2014 Peter Lemenkov <lemenkov@gmail.com> - 2014.2.1-7
3c42f9
- Restore Requires: coreutils
3c42f9
3c42f9
* Fri Nov 14 2014 Peter Lemenkov <lemenkov@gmail.com> - 2014.2.1-6
3c42f9
- A proper fix for rhbz#1158343
3c42f9
3c42f9
* Wed Oct 29 2014 Kai Engert <kaie@redhat.com> - 2014.2.1-5
3c42f9
- add Requires: coreutils (rhbz#1158343)
3c42f9
3c42f9
* Tue Oct 28 2014 Kai Engert <kaie@redhat.com> - 2014.2.1-4
3c42f9
- Introduce the ca-legacy utility and a ca-legacy.conf configuration file.
3c42f9
  By default, legacy roots required for OpenSSL/GnuTLS compatibility
3c42f9
  are kept enabled. Using the ca-legacy utility, the legacy roots can be
3c42f9
  disabled. If disabled, the system will use the trust set as provided
3c42f9
  by the upstream Mozilla CA list. (See also: rhbz#1158197)
3c42f9
3c42f9
* Sun Sep 21 2014 Kai Engert <kaie@redhat.com> - 2014.2.1-3
3c42f9
- Temporarily re-enable several legacy root CA certificates because of
3c42f9
  compatibility issues with software based on OpenSSL/GnuTLS,
3c42f9
  see rhbz#1144808
3c42f9
3c42f9
* Thu Aug 14 2014 Kai Engert <kaie@redhat.com> - 2014.2.1-2
3c42f9
- Update to CKBI 2.1 from NSS 3.16.4
3c42f9
- Fix rhbz#1130226
3c42f9
3c42f9
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2013.1.97-3
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
3c42f9
3c42f9
* Wed Mar 19 2014 Kai Engert <kaie@redhat.com> - 2013.1.97-2
3c42f9
- Update to CKBI 1.97 from NSS 3.16
3c42f9
3c42f9
* Mon Feb 10 2014 Kai Engert <kaie@redhat.com> - 2013.1.96-3
3c42f9
- Remove openjdk build dependency
3c42f9
3c42f9
* Sat Jan 25 2014 Ville Skyttä <ville.skytta@iki.fi> - 2013.1.96-2
3c42f9
- Own the %%{_datadir}/pki dir.
3c42f9
3c42f9
* Thu Jan 09 2014 Kai Engert <kaie@redhat.com> - 2013.1.96-1
3c42f9
- Update to CKBI 1.96 from NSS 3.15.4
3c42f9
3c42f9
* Tue Dec 17 2013 Kai Engert <kaie@redhat.com> - 2013.1.95-1
3c42f9
- Update to CKBI 1.95 from NSS 3.15.3.1
3c42f9
3c42f9
* Fri Sep 06 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-18
3c42f9
- Update the Entrust root stapled extension for compatibility with 
3c42f9
  p11-kit version 0.19.2, patch by Stef Walter, rhbz#988745
3c42f9
3c42f9
* Tue Sep 03 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-17
3c42f9
- merge manual improvement from f19
3c42f9
3c42f9
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2013.1.94-16
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
3c42f9
3c42f9
* Tue Jul 09 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-15
3c42f9
- clarification updates to manual page
3c42f9
3c42f9
* Mon Jul 08 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-14
3c42f9
- added a manual page and related build requirements
3c42f9
- simplify the README files now that we have a manual page
3c42f9
- set a certificate alias in trusted bundle (thanks to Ludwig Nussel)
3c42f9
3c42f9
* Mon May 27 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-13
3c42f9
- use correct command in README files, rhbz#961809
3c42f9
3c42f9
* Mon May 27 2013 Kai Engert <kaie@redhat.com> - 2013.1.94-12
3c42f9
- update to version 1.94 provided by NSS 3.15 (beta)
3c42f9
3c42f9
* Mon Apr 22 2013 Kai Engert <kaie@redhat.com> - 2012.87-12
3c42f9
- Use both label and serial to identify cert during conversion, rhbz#927601
3c42f9
- Add myself as contributor to certdata2.pem.py and remove use of rcs/ident.
3c42f9
  (thanks to Michael Shuler for suggesting to do so)
3c42f9
- Update source URLs and comments, add source file for version information.
3c42f9
3c42f9
* Tue Mar 19 2013 Kai Engert <kaie@redhat.com> - 2012.87-11
3c42f9
- adjust to changed and new functionality provided by p11-kit 0.17.3
3c42f9
- updated READMEs to describe the new directory-specific treatment of files
3c42f9
- ship a new file that contains certificates with neutral trust
3c42f9
- ship a new file that contains distrust objects, and also staple a 
3c42f9
  basic constraint extension to one legacy root contained in the
3c42f9
  Mozilla CA list
3c42f9
- adjust the build script to dynamically produce most of above files
3c42f9
- add and own the anchors and blacklist subdirectories
3c42f9
- file generate-cacerts.pl is no longer required
3c42f9
3c42f9
* Fri Mar 08 2013 Kai Engert <kaie@redhat.com> - 2012.87-9
3c42f9
- Major rework for the Fedora SharedSystemCertificates feature.
3c42f9
- Only ship a PEM bundle file using the BEGIN TRUSTED CERTIFICATE file format.
3c42f9
- Require the p11-kit package that contains tools to automatically create
3c42f9
  other file format bundles.
3c42f9
- Convert old file locations to symbolic links that point to dynamically
3c42f9
  generated files.
3c42f9
- Old files, which might have been locally modified, will be saved in backup 
3c42f9
  files with .rpmsave extension.
3c42f9
- Added a update-ca-certificates script which can be used to regenerate
3c42f9
  the merged trusted output.
3c42f9
- Refer to the various README files that have been added for more detailed
3c42f9
  explanation of the new system.
3c42f9
- No longer require rsc for building.
3c42f9
- Add explanation for the future version numbering scheme,
3c42f9
  because the old numbering scheme was based on upstream using cvs,
3c42f9
  which is no longer true, and therefore can no longer be used.
3c42f9
- Includes changes from rhbz#873369.
3c42f9
3c42f9
* Thu Mar 07 2013 Kai Engert <kaie@redhat.com> - 2012.87-2.fc19.1
3c42f9
- Ship trust bundle file in /usr/share/pki/ca-trust-source/, temporarily in addition.
3c42f9
  This location will soon become the only place containing this file.
3c42f9
3c42f9
* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2012.87-2
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
3c42f9
3c42f9
* Fri Jan 04 2013 Paul Wouters <pwouters@redhat.com> - 2012.87-1
3c42f9
- Updated to r1.87 to blacklist mis-issued turktrust CA certs
3c42f9
3c42f9
* Wed Oct 24 2012 Paul Wouters <pwouters@redhat.com> - 2012.86-2
3c42f9
- Updated blacklist with 20 entries (Diginotar, Trustwave, Comodo(?)
3c42f9
- Fix to certdata2pem.py to also check for CKT_NSS_NOT_TRUSTED 
3c42f9
3c42f9
* Tue Oct 23 2012 Paul Wouters <pwouters@redhat.com> - 2012.86-1
3c42f9
- update to r1.86
3c42f9
3c42f9
* Mon Jul 23 2012 Joe Orton <jorton@redhat.com> - 2012.85-2
3c42f9
- add openssl to BuildRequires
3c42f9
3c42f9
* Mon Jul 23 2012 Joe Orton <jorton@redhat.com> - 2012.85-1
3c42f9
- update to r1.85
3c42f9
3c42f9
* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2012.81-2
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
3c42f9
3c42f9
* Mon Feb 13 2012 Joe Orton <jorton@redhat.com> - 2012.81-1
3c42f9
- update to r1.81
3c42f9
3c42f9
* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.80-2
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
3c42f9
3c42f9
* Wed Nov  9 2011 Joe Orton <jorton@redhat.com> - 2011.80-1
3c42f9
- update to r1.80
3c42f9
- fix handling of certs with dublicate Subject names (#733032)
3c42f9
3c42f9
* Thu Sep  1 2011 Joe Orton <jorton@redhat.com> - 2011.78-1
3c42f9
- update to r1.78, removing trust from DigiNotar root (#734679)
3c42f9
3c42f9
* Wed Aug  3 2011 Joe Orton <jorton@redhat.com> - 2011.75-1
3c42f9
- update to r1.75
3c42f9
3c42f9
* Wed Apr 20 2011 Joe Orton <jorton@redhat.com> - 2011.74-1
3c42f9
- update to r1.74
3c42f9
3c42f9
* Tue Feb 08 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2011.70-2
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
3c42f9
3c42f9
* Wed Jan 12 2011 Joe Orton <jorton@redhat.com> - 2011.70-1
3c42f9
- update to r1.70
3c42f9
3c42f9
* Tue Nov  9 2010 Joe Orton <jorton@redhat.com> - 2010.65-3
3c42f9
- update to r1.65
3c42f9
3c42f9
* Wed Apr  7 2010 Joe Orton <jorton@redhat.com> - 2010.63-3
3c42f9
- package /etc/ssl/certs symlink for third-party apps (#572725)
3c42f9
3c42f9
* Wed Apr  7 2010 Joe Orton <jorton@redhat.com> - 2010.63-2
3c42f9
- rebuild
3c42f9
3c42f9
* Wed Apr  7 2010 Joe Orton <jorton@redhat.com> - 2010.63-1
3c42f9
- update to certdata.txt r1.63
3c42f9
- use upstream RCS version in Version
3c42f9
3c42f9
* Fri Mar 19 2010 Joe Orton <jorton@redhat.com> - 2010-4
3c42f9
- fix ca-bundle.crt (#575111)
3c42f9
3c42f9
* Thu Mar 18 2010 Joe Orton <jorton@redhat.com> - 2010-3
3c42f9
- update to certdata.txt r1.58
3c42f9
- add /etc/pki/tls/certs/ca-bundle.trust.crt using 'TRUSTED CERTICATE' format
3c42f9
- exclude ECC certs from the Java cacerts database
3c42f9
- catch keytool failures
3c42f9
- fail parsing certdata.txt on finding untrusted but not blacklisted cert
3c42f9
3c42f9
* Fri Jan 15 2010 Joe Orton <jorton@redhat.com> - 2010-2
3c42f9
- fix Java cacert database generation: use Subject rather than Issuer
3c42f9
  for alias name; add diagnostics; fix some alias names.
3c42f9
3c42f9
* Mon Jan 11 2010 Joe Orton <jorton@redhat.com> - 2010-1
3c42f9
- adopt Python certdata.txt parsing script from Debian
3c42f9
3c42f9
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2009-2
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
3c42f9
3c42f9
* Wed Jul 22 2009 Joe Orton <jorton@redhat.com> 2009-1
3c42f9
- update to certdata.txt r1.53
3c42f9
3c42f9
* Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2008-8
3c42f9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
3c42f9
3c42f9
* Tue Oct 14 2008 Joe Orton <jorton@redhat.com> 2008-7
3c42f9
- update to certdata.txt r1.49
3c42f9
3c42f9
* Wed Jun 25 2008 Thomas Fitzsimmons <fitzsim@redhat.com> - 2008-6
3c42f9
- Change generate-cacerts.pl to produce pretty aliases.
3c42f9
3c42f9
* Mon Jun  2 2008 Joe Orton <jorton@redhat.com> 2008-5
3c42f9
- include /etc/pki/tls/cert.pem symlink to ca-bundle.crt
3c42f9
3c42f9
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-4
3c42f9
- use package name for temp dir, recreate it in prep
3c42f9
3c42f9
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-3
3c42f9
- fix source script perms
3c42f9
- mark packaged files as config(noreplace)
3c42f9
3c42f9
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-2
3c42f9
- add (but don't use) mkcabundle.pl
3c42f9
- tweak description
3c42f9
- use /usr/bin/keytool directly; BR java-openjdk
3c42f9
3c42f9
* Tue May 27 2008 Joe Orton <jorton@redhat.com> 2008-1
3c42f9
- Initial build (#448497)