[packages/ca-certificates] Rel 2. Merge hashed certificates dir back to main package (some apps use such certs and lack of hash
arekm
arekm at pld-linux.org
Thu Jul 16 13:13:39 CEST 2026
commit b2a9559ec4bfc54206e775239902d59da1dade51
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Jul 16 12:55:26 2026 +0200
Rel 2. Merge hashed certificates dir back to main package (some apps use such certs and lack of hashed tree leads to hard to diagnose bugs like upstream php issue 20586). Switch to p11-kit instead of openssl-tools to avoid circular dep and keep dependency small.
ca-certificates-p11-kit.patch | 102 ++++++++++++++++++++++++++++++++++++++++++
ca-certificates.spec | 33 ++++----------
no-openssl-rehash.patch | 14 ------
3 files changed, 111 insertions(+), 38 deletions(-)
---
diff --git a/ca-certificates.spec b/ca-certificates.spec
index b8e4c2e..fad885d 100644
--- a/ca-certificates.spec
+++ b/ca-certificates.spec
@@ -13,7 +13,7 @@ Summary(pl.UTF-8): Pliki PEM popularnych certyfikatów CA
Name: ca-certificates
%define ver_date 20260601
Version: %{ver_date}
-Release: 1
+Release: 2
License: GPL v2 (scripts), MPL v2 (mozilla certs), distributable (other certs)
Group: Base
Source0: https://ftp.debian.org/debian/pool/main/c/ca-certificates/%{name}_%{version}.tar.xz
@@ -48,8 +48,10 @@ Patch1: %{name}-more-certs.patch
Patch2: %{name}-etc-certs.patch
Patch3: %{name}-DESTDIR.patch
Patch4: %{name}.d.patch
-Patch5: no-openssl-rehash.patch
+Patch5: %{name}-p11-kit.patch
URL: https://packages.debian.org/sid/ca-certificates
+Requires: mktemp
+Requires: p11-kit
BuildRequires: openssl-tools
BuildRequires: python3
BuildRequires: python3-cryptography
@@ -60,6 +62,8 @@ BuildRequires: sed >= 4.0
BuildRequires: tar >= 1:1.22
BuildRequires: unzip
BuildRequires: xz
+Provides: ca-certificates-update = %{version}-%{release}
+Obsoletes: ca-certificates-update < %{version}-%{release}
Obsoletes: certificates < 1.2
BuildArch: noarch
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
@@ -73,20 +77,6 @@ Common CA Certificates PEM files.
%description -l pl.UTF-8
Pliki PEM popularnych certyfikatów CA.
-%package update
-Summary: Script for updating CA Certificates database
-Summary(pl.UTF-8): Skrypt do odświeżania bazy certyfikatów CA
-Group: Libraries
-Requires: %{name} = %{version}-%{release}
-Requires: mktemp
-Requires: openssl-tools >= 0.9.8i-3
-
-%description update
-Script and data for updating CA Certificates database.
-
-%description update -l pl.UTF-8
-Skrypt i dane do odświeżania bazy certyfikatów CA.
-
%prep
%setup -qc
cd ca-certificates
@@ -164,9 +154,7 @@ find . -name '*.crt' | sort | cut -b3-
) > $RPM_BUILD_ROOT%{_sysconfdir}/ca-certificates.conf
# build %{certsdir}/ca-certificates.crt
-install -d $RPM_BUILD_ROOT%{openssldir}
./sbin/update-ca-certificates --destdir $RPM_BUILD_ROOT
-rm -rf $RPM_BUILD_ROOT%{openssldir}
ln -s %{certsdir}/ca-certificates.crt $RPM_BUILD_ROOT/etc/pki/tls/certs/ca-bundle.crt
@@ -218,10 +206,10 @@ ln -s %{certsdir}/ca-certificates.crt $RPM_BUILD_ROOT/etc/ssl/certs
%clean
rm -rf $RPM_BUILD_ROOT
-%post update
+%post
%{_sbindir}/update-ca-certificates --fresh || :
-%postun update
+%postun
/usr/bin/find "%{openssldir}" -xtype l -delete || :
%pretrans -p <lua>
@@ -233,6 +221,7 @@ end
%files
%defattr(644,root,root,755)
%doc ca-certificates/debian/{README.Debian,changelog}
+%attr(755,root,root) %{_sbindir}/update-ca-certificates
%dir /etc/pki/tls
%dir /etc/pki/tls/certs
%dir /etc/ssl
@@ -240,10 +229,6 @@ end
/etc/ssl/certs/ca-certificates.crt
%config(noreplace) %verify(not md5 mtime size) /etc/pki/tls/certs/ca-bundle.crt
%verify(not md5 mtime size) %{certsdir}/ca-certificates.crt
-
-%files update
-%defattr(644,root,root,755)
-%attr(755,root,root) %{_sbindir}/update-ca-certificates
%config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/ca-certificates.conf
%dir %{_sysconfdir}/ca-certificates.d
%{_datadir}/ca-certificates
diff --git a/ca-certificates-p11-kit.patch b/ca-certificates-p11-kit.patch
new file mode 100644
index 0000000..de37fbe
--- /dev/null
+++ b/ca-certificates-p11-kit.patch
@@ -0,0 +1,102 @@
+--- ca-certificates/sbin/update-ca-certificates.orig
++++ ca-certificates/sbin/update-ca-certificates
+@@ -104,49 +104,20 @@
+ ADDED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
+ REMOVED="$(mktemp -p "${TMPDIR:-/tmp}" "ca-certificates.tmp.XXXXXX")"
+
+-# Adds a certificate to the list of trusted ones. This includes a symlink
+-# in /etc/ssl/certs to the certificate file and its inclusion into the
+-# bundle.
++# Adds a certificate to the bundle being built. The OpenSSL hashed
++# CApath is regenerated afterwards from the finished bundle by p11-kit.
+ add() {
+ CERT="$1"
+- PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed -e 's/.crt$//' -e 's/ /_/g' \
+- -e 's/[()]/=/g' \
+- -e 's/,/_/g').pem"
+- if ! test -e "$PEM" || [ "$(readlink "$PEM")" != "$CERT" ]
+- then
+- ln -sf "$CERT" "$PEM"
+- echo "+$PEM" >> "$ADDED"
+- fi
++ echo "+$CERT" >> "$ADDED"
+ # Add trailing newline to certificate, if it is missing (#635570)
+ sed -e '$a\' "$CERT" >> "$TEMPBUNDLE"
+ }
+
+ remove() {
+ CERT="$1"
+- PEM="$ETCCERTSDIR/$(basename "$CERT" .pem | sed 's/.crt$//').pem"
+- if test -L "$PEM"
+- then
+- rm -f "$PEM"
+- echo "-$PEM" >> "$REMOVED"
+- fi
++ echo "-$CERT" >> "$REMOVED"
+ }
+
+-cd "$ETCCERTSDIR"
+-if [ "$fresh" = 1 ]; then
+- echo "Clearing symlinks in $ETCCERTSDIR..."
+- find . -type l -print | while read -r symlink
+- do
+- case $(readlink "$symlink") in
+- $CERTSDIR*|$LOCALCERTSDIR*) rm -f "$symlink";;
+- esac
+- done
+- find . -type l -print | while read -r symlink
+- do
+- test -f "$symlink" || rm -f "$symlink"
+- done
+- echo "done."
+-fi
+-
+ echo "Updating certificates in $ETCCERTSDIR..."
+
+ # Add default certificate authorities if requested
+@@ -186,26 +157,6 @@
+ ADDED_CNT=$(wc -l < "$ADDED")
+ REMOVED_CNT=$(wc -l < "$REMOVED")
+
+-if [ "$ADDED_CNT" -gt 0 ] || [ "$REMOVED_CNT" -gt 0 ]
+-then
+- # only run if set of files has changed
+- # Remove orphan symlinks found in ETCCERTSDIR to prevent `openssl rehash`
+- # from exiting with an error. See #895482, #895473.
+- find "$ETCCERTSDIR" -type l ! -exec test -e {} \; -print | while read -r orphan
+- do
+- rm -f "$orphan"
+- if [ "$verbose" = 1 ]; then
+- echo "Removed orphan symlink $orphan"
+- fi
+- done
+- if [ "$verbose" = 0 ]
+- then
+- openssl rehash . > /dev/null
+- else
+- openssl rehash -v .
+- fi
+-fi
+-
+ # chmod and mv only if TEMPBUNDLE exists or install may fail, #996005
+ if [ -f "$TEMPBUNDLE" ]
+ then
+@@ -215,6 +166,18 @@
+ [ -x /sbin/restorecon ] && /sbin/restorecon "$CERTBUNDLE" >/dev/null 2>&1
+ fi
+
++# Regenerate the OpenSSL hashed CApath from the freshly built bundle.
++# p11-kit computes the hashes itself, so ca-certificates stays off the
++# openssl -> ca-certificates dependency cycle. Skipped under --destdir
++# because trust reads the live system trust module, not the buildroot.
++if [ -z "$DESTDIR" ]
++then
++ # drop stale symlinks (incl. the legacy openssl-rehash layout) first;
++ # trust extract leaves foreign symlinks in place otherwise
++ find "$ETCCERTSDIR" -maxdepth 1 -type l -delete 2>/dev/null || :
++ trust extract --format=openssl-directory --filter=ca-anchors --overwrite "$ETCCERTSDIR"
++fi
++
+ echo "$ADDED_CNT added, $REMOVED_CNT removed; done."
+
+ # vim:set et sw=2:
diff --git a/no-openssl-rehash.patch b/no-openssl-rehash.patch
deleted file mode 100644
index 2ea0b20..0000000
--- a/no-openssl-rehash.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- ca-certificates/sbin/update-ca-certificates~ 2018-04-13 22:08:15.000000000 +0200
-+++ ca-certificates/sbin/update-ca-certificates 2018-04-13 22:30:21.837942256 +0200
-@@ -185,9 +185,9 @@
- done
- if [ "$verbose" = 0 ]
- then
-- openssl rehash . > /dev/null
-+ c_rehash.sh . > /dev/null
- else
-- openssl rehash -v .
-+ c_rehash.sh .
- fi
- fi
-
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/ca-certificates.git/commitdiff/b2a9559ec4bfc54206e775239902d59da1dade51
More information about the pld-cvs-commit
mailing list