Bug 1041328 - Adding a CA into blacklist doesn't remove it from extracted/pem/tls-ca-bundled.pem
Summary: Adding a CA into blacklist doesn't remove it from extracted/pem/tls-ca-bundle...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: p11-kit
Version: 20
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Stef Walter
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-12 15:02 UTC by Nikos Mavrogiannopoulos
Modified: 2014-01-16 07:04 UTC (History)
6 users (show)

Fixed In Version: p11-kit-0.20.2-1.fc20
Clone Of:
Environment:
Last Closed: 2014-01-16 07:04:29 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 73558 0 None None None Never

Internal Links: 1041335

Description Nikos Mavrogiannopoulos 2013-12-12 15:02:14 UTC
When a CA that is included in tls-ca-bundled.pem is added in /etc/pki/ca-trust/source/blacklist/, and update-ca-trust is run, nothing changes in /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

How reproducible:
Steps to Reproduce:
0. backup /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem to /tmp/bak
1. open /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
2. copy the any certificate from it to clipboard
3. open a file in /etc/pki/ca-trust/source/blacklist/ and paste the certificate
4. run update-ca-trust
5. run diff -u /tmp/bak /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

Actual results:
No changes.

Expected results:
The selected CA should have been removed.

Comment 1 Kai Engert (:kaie) (inactive account) 2014-01-11 21:17:49 UTC
I think the right place to fix this issue is in p11-kit-trust, as it decides which certificates get produced in the "extracted" list.

Comment 2 Stef Walter 2014-01-13 09:17:20 UTC
Confirming on Fedora 20. Regression.

Comment 4 Stef Walter 2014-01-13 17:21:43 UTC
Patches available upstream for testing.

https://bugs.freedesktop.org/show_bug.cgi?id=73558

Comment 5 Nikos Mavrogiannopoulos 2014-01-14 13:59:47 UTC
I cannot verify the fix. If I use p11-kit from the compiled directory I get:
p11-kit: couldn't run trust tool: No such file or directory

If I install in /usr/local and run the Steps above I see no difference than the version of p11-kit in F20.

Comment 6 Stef Walter 2014-01-14 14:15:26 UTC
Hmm, I think you would need to build with at least the following configure options:

./configure --prefix=/usr --with-trust-paths=/etc/pki/ca-trust/source:/usr/share/pki/ca-trust-source

But I've added more integration tests which verify this, so I guess I'll just go ahead and release p11-kit 0.20.2

   (ie: without these patches)

# yum reinstall p11-kit-trust
# make installcheck
...
sh ./test-extract
1..2
ok 1 test_extract
test-extract: blacklist-test.pem contains test_A4R794lRVSwCVinsUsvXDCctIF3lzBdsa1U2lZZQv2Daz4FGiDcA
not ok 2 test_blacklist

   (and with these patches)

# make install
# make installcheck
...
sh ./test-extract
1..2
ok 1 test_extract
ok 2 test_blacklist

Comment 7 Nikos Mavrogiannopoulos 2014-01-14 15:51:59 UTC
It works for me.

Comment 8 Fedora Update System 2014-01-14 17:44:48 UTC
p11-kit-0.20.2-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/p11-kit-0.20.2-1.fc20

Comment 9 Stef Walter 2014-01-14 17:47:01 UTC
(In reply to Nikos Mavrogiannopoulos from comment #7)
> It works for me.

Thanks! 

I've done a fedora update. Kai and Nikos, if you are able to test it and give it positive feedback (if it works) then we can get this fix out to people.

Nikos above problem description is a good test case.

Comment 10 Fedora Update System 2014-01-15 06:06:05 UTC
Package p11-kit-0.20.2-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing p11-kit-0.20.2-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-0832/p11-kit-0.20.2-1.fc20
then log in and leave karma (feedback).

Comment 11 Fedora Update System 2014-01-16 07:04:29 UTC
p11-kit-0.20.2-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.