To fix bug 1400293, we must enable Firefox to distinguish between Mozilla CAs and other, locally installed CAs. Before we can support the new attribute (bug 1418739), we must change how the ca-certificates package passes data to p11-kit-trust. As of today, we use the BEGIN TRUST CERTIFICATE file format p11-kit supports loading both certificate and individual web/email/code trust flag information from that file format, but that file format isn't flexible, and doesn't allow passing of additional attributes to p11-kit-trust. Before we can implement bug 1418739, we must do a preparation step, and stop using that file format, and switch to use the [p11-kit-object-v1] file format, which has more flexibility. I want to make that change to the ca-certificates package separately from bug 1418739, as an earlier preparation step.
Using Stef's new "trust dump" command, inspecting its output, and using multiple rounds of comparisons, I was able to implement this change. There's a minor remaining issue, when using the new file format, the certificates and trust objects have pkcs#11 attribute "modifiable: true" set, I don't know if that could cause any problems. I'll commit this change to Fedora Rawhide, to start testing.
I haven't seen any bug reports. Marking fixed.
ca-certificates-2017.2.11-1.1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-a11057f70e
ca-certificates-2017.2.11-1.1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72
ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-3753e75f72
ca-certificates-2017.2.11-1.1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-a11057f70e
ca-certificates-2017.2.11-1.1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
ca-certificates-2017.2.11-1.1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.