Attachment 835854 Details for Bug 1041335 – Patch

Patch

patch.txt (text/plain), 3.46 KB, created by Nikos Mavrogiannopoulos on 2013-12-12 15:11:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Nikos Mavrogiannopoulos

Created: 2013-12-12 15:11:31 UTC

Size: 3.46 KB

patch

obsolete

>diff --git a/ca-certificates.spec b/ca-certificates.spec
>index 7178907..efcf706 100644
>--- a/ca-certificates.spec
>+++ b/ca-certificates.spec
>@@ -170,6 +170,9 @@ install -p -m 755 %{SOURCE2} $RPM_BUILD_ROOT%{_bindir}/update-ca-trust
> touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.pem
> touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.pem
> touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.pem
>+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/tls-ca-bundle.blacklist.pem
>+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/email-ca-bundle.blacklist.pem
>+touch $RPM_BUILD_ROOT%{catrustdir}/extracted/pem/objsign-ca-bundle.blacklist.pem
> touch $RPM_BUILD_ROOT%{catrustdir}/extracted/openssl/%{trusted_all_bundle}
> touch $RPM_BUILD_ROOT%{catrustdir}/extracted/%{java_bundle}
> 
>@@ -179,6 +182,8 @@ ln -s ../pki/tls/certs \
> # legacy filenames
> ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
>       $RPM_BUILD_ROOT%{pkidir}/tls/cert.pem
>+ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.blacklist.pem \
>+      $RPM_BUILD_ROOT%{pkidir}/tls/blacklist.pem
> ln -s %{catrustdir}/extracted/pem/tls-ca-bundle.pem \
>       $RPM_BUILD_ROOT%{pkidir}/tls/certs/%{classic_tls_bundle}
> ln -s %{catrustdir}/extracted/openssl/%{trusted_all_bundle} \
>diff --git a/update-ca-trust b/update-ca-trust
>index a5518d1..c30ea2f 100644
>--- a/update-ca-trust
>+++ b/update-ca-trust
>@@ -16,3 +16,8 @@ DEST=/etc/pki/ca-trust/extracted
> /usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose email $DEST/pem/email-ca-bundle.pem
> /usr/bin/p11-kit extract --format=pem-bundle --filter=ca-anchors --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.pem
> /usr/bin/p11-kit extract --format=java-cacerts --filter=ca-anchors --overwrite --purpose server-auth $DEST/java/cacerts
>+
>+# Generate blacklists
>+/usr/bin/p11-kit extract --format=pem-bundle --filter=blacklist --overwrite --purpose server-auth $DEST/pem/tls-ca-bundle.blacklist.pem
>+/usr/bin/p11-kit extract --format=pem-bundle --filter=blacklist --overwrite --purpose email $DEST/pem/email-ca-bundle.blacklist.pem
>+/usr/bin/p11-kit extract --format=pem-bundle --filter=blacklist --overwrite --purpose code-signing $DEST/pem/objsign-ca-bundle.blacklist.pem
>diff --git a/update-ca-trust.8.txt b/update-ca-trust.8.txt
>index 3a21f87..810d930 100644
>--- a/update-ca-trust.8.txt
>+++ b/update-ca-trust.8.txt
>@@ -193,14 +193,21 @@ or distrusted certificates, including the associated trust flags.
> The directory /etc/pki/ca-trust/extracted/pem/ contains 
> CA certificate bundle files in the simple BEGIN/END CERTIFICATE file format, 
> as decribed in the x509(1) manual page.
>-Distrust information cannot be represented in this file format,
>-and distrusted certificates are missing from these files.
>+The detailed distrust information cannot be expressed in this format, but
>+all blacklisted certificates are available in files that end in .blacklist.pem
>+in PEM format.
> File tls-ca-bundle.pem contains CA certificates 
> trusted for TLS server authentication.
>+File tls-ca-bundle.blacklist.pem contains blacklisted CA certificates 
>+for TLS server authentication.
> File email-ca-bundle.pem contains CA certificates 
> trusted for E-Mail protection.
>+File email-ca-bundle.blacklist.pem contains blacklisted CA certificates 
>+for E-Mail protection.
> File objsign-ca-bundle.pem contains CA certificates 
> trusted for code signing.
>+File objsign-ca-bundle.blacklist.pem contains blacklisted CA certificates 
>+for code signing.
> 
> 
> COMMANDS

Actions: View

Attachments on bug 1041335: 835854