mirror of
https://git.FreeBSD.org/ports.git
synced 2025-01-16 07:58:04 +00:00
71ee70bfe9
Enable the ETCSYMLINK option so that SSL certificate verification is enabled by default for OpenSSL in base. This change is the third in a set of changes [1][2] that improves the default configuration and behaviour of client software relying on OpenSSL for SSL/TLS and certificate verification. A symlink is installed which points to the root certificate bundle in the location that OpenSSL in base looks for them, as configured at build time [2]. This allows any and all software utilising SSL_CTX_load_verify_locations function to verify SSL certificates by default after installation of this package. [1] https://svnweb.freebsd.org/changeset/ports/372629 [2] https://svnweb.freebsd.org/changeset/ports/378720 PR: 189811 196357 Requested by: many Submitted by: dreamcat4 gmail com Approved by: maintainer timeout (>1 year)
73 lines
2.1 KiB
Makefile
73 lines
2.1 KiB
Makefile
# $FreeBSD$
|
|
|
|
PORTNAME= ca_root_nss
|
|
PORTVERSION= ${VERSION_NSS}
|
|
PORTREVISION= 1
|
|
CATEGORIES= security
|
|
MASTER_SITES= MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
|
|
DISTNAME= nss-${VERSION_NSS}${NSS_SUFFIX}
|
|
|
|
MAINTAINER= gecko@FreeBSD.org
|
|
COMMENT= Root certificate bundle from the Mozilla Project
|
|
|
|
LICENSE= MPL
|
|
|
|
OPTIONS_DEFINE= ETCSYMLINK
|
|
OPTIONS_DEFAULT= ETCSYMLINK
|
|
|
|
OPTIONS_SUB= yes
|
|
|
|
ETCSYMLINK_DESC= Add symlink to /etc/ssl/cert.pem
|
|
ETCSYMLINK_CONFLICTS= ca-roots-[0-9]*
|
|
|
|
USES= perl5
|
|
USE_PERL5= build
|
|
NO_ARCH= yes
|
|
NO_WRKSUBDIR= yes
|
|
|
|
CERTDIR?= share/certs
|
|
PLIST_SUB+= CERTDIR=${CERTDIR}
|
|
|
|
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
# !!! These versions are intended to track security/nss. !!!
|
|
# !!! Please DO NOT submit patches for new version until it has !!!
|
|
# !!! been committed there first. !!!
|
|
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
|
VERSION_NSS= 3.19.1
|
|
#NSS_SUFFIX= .with.ckbi.1.98
|
|
CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt
|
|
BUNDLE_PROCESSOR= MAca-bundle.pl
|
|
|
|
SUB_FILES= MAca-bundle.pl pkg-message
|
|
SUB_LIST= VERSION_NSS=${VERSION_NSS}
|
|
|
|
.include <bsd.port.options.mk>
|
|
|
|
do-extract:
|
|
@${MKDIR} ${WRKDIR}
|
|
@${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \
|
|
${CERTDATA_TXT_PATH}
|
|
@${CP} ${WRKDIR}/${CERTDATA_TXT_PATH} ${WRKDIR}
|
|
@${RM} -rf ${WRKDIR}/nss-${VERSION_NSS}
|
|
|
|
do-build: apply-slist
|
|
@${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \
|
|
< ${WRKDIR}/certdata.txt > \
|
|
${WRKDIR}/ca-root-nss.crt
|
|
|
|
do-install:
|
|
${MKDIR} ${STAGEDIR}${PREFIX}/${CERTDIR}
|
|
${INSTALL_DATA} ${WRKDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/${CERTDIR}
|
|
|
|
post-install:
|
|
.if ${PORT_OPTIONS:METCSYMLINK}
|
|
${MKDIR} ${STAGEDIR}/etc/ssl
|
|
${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}/etc/ssl/cert.pem
|
|
.endif
|
|
${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl
|
|
${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem.sample
|
|
${MKDIR} ${STAGEDIR}${PREFIX}/openssl
|
|
${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/openssl/cert.pem.sample
|
|
|
|
.include <bsd.port.mk>
|