mirror of
https://git.FreeBSD.org/ports.git
synced 2024-12-30 05:40:06 +00:00
a4027193e3
- Only look at CKA_TRUST_SERVER_AUTH, _EMAIL_PROTECTION, and
_CODE_SIGNING attributes.
- Omit certificates that do not have any explicit trust value in these
three attributes; at least one of the purposes must mark the
certificate a trusted delegator.
- Validate that the trust is one of three known trust values, to become
aware of syntax changes in certdata.txt. If it is an unknown token,
abort with an error stating that the script must be updated.
- Check that we have at least 25 certificates in the output or abort.
This removes these two certificates that have "unknown"
(CKT_NSS_MUST_VERIFY_TRUST) in all three tokens, making them unfit as
trust anchors:
1 C=DE, O=TC TrustCenter GmbH, OU=TC TrustCenter Universal CA,
CN=TC TrustCenter Universal CA III
2 C=US, ST=UT, L=Salt Lake City, O=The USERTRUST Network,
OU=http://www.usertrust.com,
CN=UTN-USERFirst-Network Applications
164 trusted certificates remain.
64 lines
1.8 KiB
Makefile
64 lines
1.8 KiB
Makefile
# Created by: Brooks Davis <brooks@FreeBSD.org>
|
|
# $FreeBSD$
|
|
|
|
PORTNAME= ca_root_nss
|
|
PORTVERSION= ${VERSION_NSS}
|
|
PORTREVISION= 1
|
|
CATEGORIES= security
|
|
MASTER_SITES= MOZILLA/security/nss/releases/${DISTNAME:U:C/[-.]/_/g}_RTM/src
|
|
DISTNAME= nss-${VERSION_NSS}${NSS_SUFFIX}
|
|
|
|
MAINTAINER= gecko@FreeBSD.org
|
|
COMMENT= The root certificate bundle from the Mozilla Project
|
|
|
|
OPTIONS_DEFINE= ETCSYMLINK
|
|
ETCSYMLINK_DESC= Add symlink to /etc/ssl/cert.pem
|
|
|
|
USE_PERL5_BUILD= yes
|
|
NO_WRKSUBDIR= yes
|
|
|
|
CERTDIR?= share/certs
|
|
PLIST_SUB+= CERTDIR=${CERTDIR}
|
|
|
|
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
# !!! These versions are indented to track security/nss. !!!
|
|
# !!! Please DO NOT submit patches for new version until it has !!!
|
|
# !!! been committed there first. !!!
|
|
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
VERSION_NSS= 3.15.1
|
|
#NSS_SUFFIX= .with.ckbi.1.93
|
|
CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt
|
|
BUNDLE_PROCESSOR= MAca-bundle.pl
|
|
SUB_FILES= MAca-bundle.pl
|
|
SUB_LIST= VERSION_NSS=${VERSION_NSS}
|
|
|
|
.include <bsd.port.options.mk>
|
|
|
|
.if ${PORT_OPTIONS:METCSYMLINK}
|
|
PLIST_SUB+= ETCSYMLINK=
|
|
CONFLICTS= ca-roots-[0-9]*
|
|
.else
|
|
PLIST_SUB+= ETCSYMLINK="@comment "
|
|
.endif
|
|
|
|
do-extract:
|
|
@${MKDIR} ${WRKDIR}
|
|
@${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \
|
|
${CERTDATA_TXT_PATH}
|
|
@${CP} ${WRKDIR}/${CERTDATA_TXT_PATH} ${WRKDIR}
|
|
@${RM} -rf ${WRKDIR}/nss-${VERSION_NSS}
|
|
|
|
do-build: apply-slist
|
|
@${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \
|
|
< ${WRKDIR}/certdata.txt > \
|
|
${WRKDIR}/ca-root-nss.crt
|
|
|
|
do-install:
|
|
${MKDIR} ${PREFIX}/${CERTDIR}
|
|
${INSTALL_DATA} ${WRKDIR}/ca-root-nss.crt ${PREFIX}/${CERTDIR}
|
|
.if ${PORT_OPTIONS:METCSYMLINK}
|
|
${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt /etc/ssl/cert.pem
|
|
.endif
|
|
|
|
.include <bsd.port.mk>
|