From patchwork Fri Aug 20 20:04:25 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 4635 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Grszz1DBPz3xHv for ; Fri, 20 Aug 2021 20:04:47 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Grszw1mHQz2gW; Fri, 20 Aug 2021 20:04:44 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Grszv57HSz2xXY; Fri, 20 Aug 2021 20:04:43 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Grszt1wb6z2xNW for ; Fri, 20 Aug 2021 20:04:42 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Grszs3Pfyz1PC; Fri, 20 Aug 2021 20:04:41 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1629489881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RiIiFtcYBfOmzCiLZyY+wQb9QNNwAiqwZE0yyicb/+s=; b=yOI63w5dolD0HpAFhSuss/bSI4BxKAkSUIwvA2dDunYpFl0JSEg/6tXEaMrsMYr48ZD3Uu 2aYXSpT2cjlDSeCQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1629489881; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=RiIiFtcYBfOmzCiLZyY+wQb9QNNwAiqwZE0yyicb/+s=; b=t+grT2pNX/uJRGdPhgz9rHLSj9wmLPtpy6HjVqHIdW3I9M1ioSXpFBJDeRcumHJu75lIOl 8tj+GD5JQdfKpY4bb1kXqHamA8Zt+aC8QBbposUAQA0x4W3FVGJfB5y25U/gR+kiNk1XuE wNXfsWVZs60HoMdqvj4wid3gwCljLyH+nryMjj8ZDFOxjRXhAqq9nsQ4AGE+FsGzMRVu+p 0Ko4rCDNvSVmbxhG1iJB7yvGi0Lq1woYkE6usB+xjfebJwj3IueGnIsPjZI4qnjziMN3yy 3aq/7jXY7jrSNIv25w/zTWhhsy7c2WPNWA+CyrVmRq2YdOVC7F8MegW8Dm5Oqg== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH 1/4] ca-certificates: Update to work with python3 version of certdata2pem.py Date: Fri, 20 Aug 2021 22:04:25 +0200 Message-Id: <20210820200428.3535766-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Implement python3 version of certdata2pem.py script from fedora - Modify build.sh to work with python3 script that uses p11-kit based on fedora approach - https://src.fedoraproject.org/rpms/ca-certificates/tree/rawhide - Extraction of cert files now uses p11-kit which requires libtasn1 as a build dependency - Updated rootfile - Updated ca-certificates installed into a vm and confirmed to download a file from an https site with the same results as with existing ca-certfictaes system Tested-by: Adolf Belka Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- config/ca-certificates/build.sh | 48 +++-- config/ca-certificates/certdata2pem.py | 260 ++++++++++++++++++++---- config/rootfiles/common/ca-certificates | 5 +- lfs/ca-certificates | 2 +- 4 files changed, 248 insertions(+), 67 deletions(-) diff --git a/config/ca-certificates/build.sh b/config/ca-certificates/build.sh index c868ed94a..8e64f9e9f 100644 --- a/config/ca-certificates/build.sh +++ b/config/ca-certificates/build.sh @@ -3,13 +3,34 @@ set -e # Create file layout. -mkdir -pv certs certs/legacy-default certs/legacy-disable +mkdir -pv certs +mkdir -pv /etc/pki/ca-trust/source cp certdata.txt certs cd certs -python ../certdata2pem.py +python3 ../certdata2pem.py cd .. + + +cat < ca-bundle.trust.p11-kit +# This is a bundle of X.509 certificates of public Certificate +# Authorities. It was generated from the Mozilla root CA list. +# These certificates and trust/distrust attributes use the file format accepted +# by the p11-kit-trust module. +# +# Source: mozilla/security/nss/lib/ckfw/builtins/certdata.txt +# +EOF + + +P11FILES=`find certs -name \*.tmp-p11-kit | wc -l` +if [ $P11FILES -ne 0 ]; then + for p in certs/*.tmp-p11-kit; do + cat "$p" >> /etc/pki/ca-trust/source/ca-bundle.trust.p11-kit + done +fi + cat < ca-bundle.crt # This is a bundle of X.509 certificates of public Certificate # Authorities. It was generated from the Mozilla root CA list. @@ -28,24 +49,11 @@ cat < ca-bundle.trust.crt # EOF -for f in certs/*.crt; do - [ -z "${f}" ] && continue - - tbits=$(sed -n '/^# openssl-trust/{s/^.*=//;p;}' ${f}) - case "${tbits}" in - *serverAuth*) - openssl x509 -text -in "${f}" >> ca-bundle.crt - ;; - esac +trust extract --comment --filter=certificates --format=openssl-bundle --overwrite ca-bundle.trust +cat ca-bundle.trust >> ca-bundle.trust.crt - if [ -n "$tbits" ]; then - targs="" - for t in ${tbits}; do - targs="${targs} -addtrust ${t}" - done +trust extract --comment --filter=ca-anchors --format=pem-bundle --overwrite --purpose server-auth ca-bundle +cat ca-bundle >> ca-bundle.crt - openssl x509 -text -in "${f}" -trustout $targs >> ca-bundle.trust.crt - fi -done -exit 0 +exit 0 \ No newline at end of file diff --git a/config/ca-certificates/certdata2pem.py b/config/ca-certificates/certdata2pem.py index 44cc9e03b..a52ce9c74 100644 --- a/config/ca-certificates/certdata2pem.py +++ b/config/ca-certificates/certdata2pem.py @@ -26,16 +26,17 @@ import os.path import re import sys import textwrap -import urllib +import urllib.request, urllib.parse, urllib.error +import subprocess objects = [] def printable_serial(obj): - return ".".join(map(lambda x:str(ord(x)), obj['CKA_SERIAL_NUMBER'])) + return ".".join([str(x) for x in obj['CKA_SERIAL_NUMBER']]) # Dirty file parser. in_data, in_multiline, in_obj = False, False, False -field, type, value, obj = None, None, None, dict() +field, ftype, value, binval, obj = None, None, None, bytearray(), dict() for line in open('certdata.txt', 'r'): # Ignore the file header. if not in_data: @@ -55,33 +56,36 @@ for line in open('certdata.txt', 'r'): continue if in_multiline: if not line.startswith('END'): - if type == 'MULTILINE_OCTAL': + if ftype == 'MULTILINE_OCTAL': line = line.strip() for i in re.finditer(r'\\([0-3][0-7][0-7])', line): - value += chr(int(i.group(1), 8)) + integ = int(i.group(1), 8) + binval.extend((integ).to_bytes(1, sys.byteorder)) + obj[field] = binval else: value += line + obj[field] = value continue - obj[field] = value in_multiline = False continue if line.startswith('CKA_CLASS'): in_obj = True line_parts = line.strip().split(' ', 2) if len(line_parts) > 2: - field, type = line_parts[0:2] + field, ftype = line_parts[0:2] value = ' '.join(line_parts[2:]) elif len(line_parts) == 2: - field, type = line_parts + field, ftype = line_parts value = None else: - raise NotImplementedError, 'line_parts < 2 not supported.\n' + line - if type == 'MULTILINE_OCTAL': + raise NotImplementedError('line_parts < 2 not supported.\n' + line) + if ftype == 'MULTILINE_OCTAL': in_multiline = True value = "" + binval = bytearray() continue obj[field] = value -if len(obj.items()) > 0: +if len(list(obj.items())) > 0: objects.append(obj) # Build up trust database. @@ -91,7 +95,7 @@ for obj in objects: continue key = obj['CKA_LABEL'] + printable_serial(obj) trustmap[key] = obj - print " added trust", key + print(" added trust", key) # Build up cert database. certmap = dict() @@ -100,7 +104,7 @@ for obj in objects: continue key = obj['CKA_LABEL'] + printable_serial(obj) certmap[key] = obj - print " added cert", key + print(" added cert", key) def obj_to_filename(obj): label = obj['CKA_LABEL'][1:-1] @@ -109,10 +113,32 @@ def obj_to_filename(obj): .replace('(', '=')\ .replace(')', '=')\ .replace(',', '_') - label = re.sub(r'\\x[0-9a-fA-F]{2}', lambda m:chr(int(m.group(0)[2:], 16)), label) + labelbytes = bytearray() + i = 0 + imax = len(label) + while i < imax: + if i < imax-3 and label[i] == '\\' and label[i+1] == 'x': + labelbytes.extend(bytes.fromhex(label[i+2:i+4])) + i += 4 + continue + labelbytes.extend(str.encode(label[i])) + i = i+1 + continue + label = labelbytes.decode('utf-8') serial = printable_serial(obj) return label + ":" + serial +def write_cert_ext_to_file(f, oid, value, public_key): + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + f.write("class: x-certificate-extension\n"); + f.write("object-id: " + oid + "\n") + f.write("value: \"" + value + "\"\n") + f.write("modifiable: false\n"); + f.write(public_key) + trust_types = { "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", "CKA_TRUST_NON_REPUDIATION": "non-repudiation", @@ -151,34 +177,39 @@ openssl_trust = { "CKA_TRUST_EMAIL_PROTECTION": "emailProtection", } +cert_distrust_types = { + "CKA_NSS_SERVER_DISTRUST_AFTER": "nss-server-distrust-after", + "CKA_NSS_EMAIL_DISTRUST_AFTER": "nss-email-distrust-after", +} + for tobj in objects: if tobj['CKA_CLASS'] == 'CKO_NSS_TRUST': key = tobj['CKA_LABEL'] + printable_serial(tobj) - print "producing trust for " + key + print("producing trust for " + key) trustbits = [] distrustbits = [] openssl_trustflags = [] openssl_distrustflags = [] legacy_trustbits = [] legacy_openssl_trustflags = [] - for t in trust_types.keys(): - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + for t in list(trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': trustbits.append(t) if t in openssl_trust: openssl_trustflags.append(openssl_trust[t]) - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': distrustbits.append(t) if t in openssl_trust: openssl_distrustflags.append(openssl_trust[t]) - for t in legacy_trust_types.keys(): - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + for t in list(legacy_trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': real_t = legacy_to_real_trust_types[t] legacy_trustbits.append(real_t) if real_t in openssl_trust: legacy_openssl_trustflags.append(openssl_trust[real_t]) - if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': - raise NotImplementedError, 'legacy distrust not supported.\n' + line + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + raise NotImplementedError('legacy distrust not supported.\n' + line) fname = obj_to_filename(tobj) try: @@ -186,43 +217,181 @@ for tobj in objects: except: obj = None - if obj != None: - fname += ".crt" - else: - fname += ".p11-kit" + # optional debug code, that dumps the parsed input to files + #fulldump = "dump-" + fname + #dumpf = open(fulldump, 'w') + #dumpf.write(str(obj)); + #dumpf.write(str(tobj)); + #dumpf.close(); is_legacy = 0 - if tobj.has_key('LEGACY_CKA_TRUST_SERVER_AUTH') or tobj.has_key('LEGACY_CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('LEGACY_CKA_TRUST_CODE_SIGNING'): + if 'LEGACY_CKA_TRUST_SERVER_AUTH' in tobj or 'LEGACY_CKA_TRUST_EMAIL_PROTECTION' in tobj or 'LEGACY_CKA_TRUST_CODE_SIGNING' in tobj: is_legacy = 1 if obj == None: - raise NotImplementedError, 'found legacy trust without certificate.\n' + line - legacy_fname = "legacy-default/" + fname + raise NotImplementedError('found legacy trust without certificate.\n' + line) + + legacy_fname = "legacy-default/" + fname + ".crt" f = open(legacy_fname, 'w') f.write("# alias=%s\n"%tobj['CKA_LABEL']) f.write("# trust=" + " ".join(legacy_trustbits) + "\n") if legacy_openssl_trustflags: f.write("# openssl-trust=" + " ".join(legacy_openssl_trustflags) + "\n") f.write("-----BEGIN CERTIFICATE-----\n") - f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) f.write("\n-----END CERTIFICATE-----\n") f.close() - if tobj.has_key('CKA_TRUST_SERVER_AUTH') or tobj.has_key('CKA_TRUST_EMAIL_PROTECTION') or tobj.has_key('CKA_TRUST_CODE_SIGNING'): - fname = "legacy-disable/" + fname - else: - continue + if 'CKA_TRUST_SERVER_AUTH' in tobj or 'CKA_TRUST_EMAIL_PROTECTION' in tobj or 'CKA_TRUST_CODE_SIGNING' in tobj: + legacy_fname = "legacy-disable/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + # don't produce p11-kit output for legacy certificates + continue + + pk = '' + cert_comment = '' + if obj != None: + # must extract the public key from the cert, let's use openssl + cert_fname = "cert-" + fname + fc = open(cert_fname, 'w') + fc.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + fc.write("\n".join(temp_wrapped)) + fc.write("\n-----END CERTIFICATE-----\n") + fc.close(); + pk_fname = "pubkey-" + fname + fpkout = open(pk_fname, "w") + dump_pk_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-pubkey"] + subprocess.call(dump_pk_command, stdout=fpkout) + fpkout.close() + with open (pk_fname, "r") as myfile: + pk=myfile.read() + # obtain certificate information suitable as a comment + comment_fname = "comment-" + fname + fcout = open(comment_fname, "w") + comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text"] + subprocess.call(comment_command, stdout=fcout) + fcout.close() + sed_command = ["sed", "--in-place", "s/^/#/", comment_fname] + subprocess.call(sed_command) + with open (comment_fname, "r", errors = 'replace') as myfile: + cert_comment=myfile.read() + + fname += ".tmp-p11-kit" f = open(fname, 'w') + if obj != None: - f.write("# alias=%s\n"%tobj['CKA_LABEL']) - f.write("# trust=" + " ".join(trustbits) + "\n") - f.write("# distrust=" + " ".join(distrustbits) + "\n") - if openssl_trustflags: - f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") - if openssl_distrustflags: - f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n") + is_distrusted = False + has_server_trust = False + has_email_trust = False + has_code_trust = False + + if 'CKA_TRUST_SERVER_AUTH' in tobj: + if tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_server_trust = True + + if 'CKA_TRUST_EMAIL_PROTECTION' in tobj: + if tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_email_trust = True + + if 'CKA_TRUST_CODE_SIGNING' in tobj: + if tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_code_trust = True + + if is_distrusted: + trust_ext_oid = "1.3.6.1.4.1.3319.6.10.1" + trust_ext_value = "0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + trust_ext_oid = "2.5.29.37" + if has_server_trust: + if has_email_trust: + if has_code_trust: + # server + email + code + trust_ext_value = "0%2a%06%03U%1d%25%01%01%ff%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + email + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01" + else: + if has_code_trust: + # server + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%01" + else: + if has_email_trust: + if has_code_trust: + # email + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%03" + else: + # email + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%04" + else: + if has_code_trust: + # code + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%03" + else: + # none + trust_ext_value = "0%18%06%03U%1d%25%01%01%ff%04%0e0%0c%06%0a%2b%06%01%04%01%99w%06%0a%10" + + # no 2.5.29.37 for neutral certificates + if (is_distrusted or has_server_trust or has_email_trust or has_code_trust): + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + pk = '' + f.write("\n") + + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + if is_distrusted: + f.write("x-distrusted: true\n") + elif has_server_trust or has_email_trust or has_code_trust: + f.write("trusted: true\n") + else: + f.write("trusted: false\n") + + # requires p11-kit >= 0.23.4 + f.write("nss-mozilla-ca-policy: true\n") + f.write("modifiable: false\n"); + + # requires p11-kit >= 0.23.19 + for t in list(cert_distrust_types.keys()): + if t in obj: + value = obj[t] + if value == 'CK_FALSE': + value = bytearray(1) + f.write(cert_distrust_types[t] + ": \"") + f.write(urllib.parse.quote(value)); + f.write("\"\n") + f.write("-----BEGIN CERTIFICATE-----\n") - f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) f.write("\n-----END CERTIFICATE-----\n") + f.write(cert_comment) + f.write("\n") + else: f.write("[p11-kit-object-v1]\n") f.write("label: "); @@ -230,14 +399,15 @@ for tobj in objects: f.write("\n") f.write("class: certificate\n") f.write("certificate-type: x-509\n") + f.write("modifiable: false\n"); f.write("issuer: \""); - f.write(urllib.quote(tobj['CKA_ISSUER'])); + f.write(urllib.parse.quote(tobj['CKA_ISSUER'])); f.write("\"\n") f.write("serial-number: \""); - f.write(urllib.quote(tobj['CKA_SERIAL_NUMBER'])); + f.write(urllib.parse.quote(tobj['CKA_SERIAL_NUMBER'])); f.write("\"\n") if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'): f.write("x-distrusted: true\n") f.write("\n\n") f.close() - print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags) + print(" -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)) diff --git a/config/rootfiles/common/ca-certificates b/config/rootfiles/common/ca-certificates index 087c3e450..06eb66f3b 100644 --- a/config/rootfiles/common/ca-certificates +++ b/config/rootfiles/common/ca-certificates @@ -1,4 +1,7 @@ +#etc/pki +#etc/pki/ca-trust +#etc/pki/ca-trust/source +etc/pki/ca-trust/source/ca-bundle.trust.p11-kit etc/ssl/cert.pem -#etc/ssl/certs etc/ssl/certs/ca-bundle.crt etc/ssl/certs/ca-bundle.trust.crt diff --git a/lfs/ca-certificates b/lfs/ca-certificates index f3c68a7c0..9e37687da 100644 --- a/lfs/ca-certificates +++ b/lfs/ca-certificates @@ -24,7 +24,7 @@ include Config -VER = 20210611 +VER = 20210819 THISAPP = ca-certificates DIR_APP = $(DIR_SRC)/$(THISAPP) From patchwork Fri Aug 20 20:04:26 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 4636 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Grt0C1yNCz3xHv for ; Fri, 20 Aug 2021 20:04:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Grt0B6YDgz6YN; Fri, 20 Aug 2021 20:04:58 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Grt0B5xCqz2yXV; Fri, 20 Aug 2021 20:04:58 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Grt096zxzz2xR5 for ; Fri, 20 Aug 2021 20:04:57 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Grt09212Gz2gW; Fri, 20 Aug 2021 20:04:57 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1629489897; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uN/1824q3voKs5aK0sSKjXaboOL15mZNCWOA6lW335M=; b=NSXT/hq29G0lYBNqn6TwlOSNlbs2MkJuWQJKF1RlArVfEdxa24mgU6H0csHKkniqfdZpyy ct/+vtTU5/mc6lDA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1629489897; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uN/1824q3voKs5aK0sSKjXaboOL15mZNCWOA6lW335M=; b=qCeo8e0piGgquLsIPVmDsiWfPNBK8q9MLicSrn7KzDJ0z5cQtIY0mdIcz53+y0MEFRhJ+l EQ13hziUEbbwhKs4VLuwqOpLmDEl4bs3pJxpSHif70WYoXb1SujViuwyMqJJ40SJX0w3CE D+bIpKslxxe88zLTAZDrfSJuhbpq1414GX2TJ/Oss5zyPiHxooMza1lRWOm+6160SBkSP8 vJFcZaZY9vN7W/ldMTZgaVkAgHgayP6+OzolgVAbzXcDvqL5B9QK8iuZoimE4JZGgTcHVv hKYnKDGpSEaXs00YcHHqm7LsUkQetIxIDxIdo6BoFIoi9lrChEjjWVCZQEtpAg== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH 2/4] make.sh: Added p11-kit and libtasn1 for python3 based ca-certificates approach Date: Fri, 20 Aug 2021 22:04:26 +0200 Message-Id: <20210820200428.3535766-2-adolf.belka@ipfire.org> In-Reply-To: <20210820200428.3535766-1-adolf.belka@ipfire.org> References: <20210820200428.3535766-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - p11-kit required for certs extraction in building of python3 compatible ca-certificates - p11-kit requires libtasn1 as a build dependency - p11-kit and libtasn1 added to make.sh Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- make.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/make.sh b/make.sh index 0baf2050d..7608e1630 100755 --- a/make.sh +++ b/make.sh @@ -1234,6 +1234,8 @@ buildipfire() { lfsmake2 grub lfsmake2 efivar lfsmake2 efibootmgr + lfsmake2 libtasn1 + lfsmake2 p11-kit lfsmake2 ca-certificates lfsmake2 fireinfo lfsmake2 libnet From patchwork Fri Aug 20 20:04:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 4637 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Grt0T37bkz3xJ1 for ; Fri, 20 Aug 2021 20:05:13 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Grt0T07NTz2gW; Fri, 20 Aug 2021 20:05:13 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Grt0S6bxzz2y0t; Fri, 20 Aug 2021 20:05:12 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Grt0R6YSvz2xR5 for ; Fri, 20 Aug 2021 20:05:11 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Grt0R1qbbz1Tx; Fri, 20 Aug 2021 20:05:11 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1629489911; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=r2LhEbmWfaBh6026GsgXiNcQHQE7M56S3rFVzbnzHOM=; b=G+kdfmzjvs7a4s8ufNhWVEn+m9hiDSGfdSNXPWKnT2dESRnPWA/lFjIoAFtys2IUxYU7yX pnL0qm6ARPAbjsBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1629489911; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=r2LhEbmWfaBh6026GsgXiNcQHQE7M56S3rFVzbnzHOM=; b=S4wnUo8JMvTMsw4X+7cBxLtXHbAYmvNglYHbg2TGCGbvP9bgI7konaYocN+J6rnNX0HB9K Obyf97Io8Z3tZ76bd2TB7YEKQp3MJ4w14PPoK1QEXmRL9vAKNhz7mlAVc3HeWu8aD8V9eF dH8UVJeqEXh5cR0UMtiuJAGyJz7y65fZxDdWkrYkKCf3YzSdUZeb+YQP38iIhJIdTEF02T B7EqP9xxATi9TnCqSe0uvzyNRaWD6EByH8eWfTH/E3854uyi6k1DOgZMSKYGr1hyr/dMYD LVi7jMgQScdNPzkUVNLf4MUpAAp3CxlyhtszQJErehmzy1+WhEVyiXyvQHFYow== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH 3/4] p11-kit: New program required for python3 compatibility of ca-certificates Date: Fri, 20 Aug 2021 22:04:27 +0200 Message-Id: <20210820200428.3535766-3-adolf.belka@ipfire.org> In-Reply-To: <20210820200428.3535766-1-adolf.belka@ipfire.org> References: <20210820200428.3535766-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - creation of lfs and rootfile for implementation of p11-kit Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- config/rootfiles/common/p11-kit | 74 +++++++++++++++++++++++++++++ lfs/p11-kit | 82 +++++++++++++++++++++++++++++++++ 2 files changed, 156 insertions(+) create mode 100644 config/rootfiles/common/p11-kit create mode 100644 lfs/p11-kit diff --git a/config/rootfiles/common/p11-kit b/config/rootfiles/common/p11-kit new file mode 100644 index 000000000..df9001e27 --- /dev/null +++ b/config/rootfiles/common/p11-kit @@ -0,0 +1,74 @@ +usr/bin/p11-kit +usr/bin/trust +#usr/etc/pkcs11 +#usr/etc/pkcs11/pkcs11.conf.example +#usr/include/p11-kit-1 +#usr/include/p11-kit-1/p11-kit +#usr/include/p11-kit-1/p11-kit/deprecated.h +#usr/include/p11-kit-1/p11-kit/iter.h +#usr/include/p11-kit-1/p11-kit/p11-kit.h +#usr/include/p11-kit-1/p11-kit/pin.h +#usr/include/p11-kit-1/p11-kit/pkcs11.h +#usr/include/p11-kit-1/p11-kit/pkcs11x.h +#usr/include/p11-kit-1/p11-kit/remote.h +#usr/include/p11-kit-1/p11-kit/uri.h +#usr/lib/libp11-kit.la +#usr/lib/libp11-kit.so +usr/lib/libp11-kit.so.0 +usr/lib/libp11-kit.so.0.3.0 +usr/lib/p11-kit-proxy.so +#usr/lib/pkcs11 +#usr/lib/pkcs11/p11-kit-client.la +usr/lib/pkcs11/p11-kit-client.so +#usr/lib/pkcs11/p11-kit-trust.la +usr/lib/pkcs11/p11-kit-trust.so +#usr/lib/pkgconfig/p11-kit-1.pc +#usr/libexec/p11-kit +#usr/libexec/p11-kit/p11-kit-remote +#usr/libexec/p11-kit/p11-kit-server +#usr/libexec/p11-kit/trust-extract-compat +#usr/share/gtk-doc +#usr/share/gtk-doc/html +#usr/share/gtk-doc/html/p11-kit +#usr/share/gtk-doc/html/p11-kit/config-example.html +#usr/share/gtk-doc/html/p11-kit/config-files.html +#usr/share/gtk-doc/html/p11-kit/config.html +#usr/share/gtk-doc/html/p11-kit/devel-building-style.html +#usr/share/gtk-doc/html/p11-kit/devel-building.html +#usr/share/gtk-doc/html/p11-kit/devel-commands.html +#usr/share/gtk-doc/html/p11-kit/devel-debugging.html +#usr/share/gtk-doc/html/p11-kit/devel-paths.html +#usr/share/gtk-doc/html/p11-kit/devel-testing.html +#usr/share/gtk-doc/html/p11-kit/devel.html +#usr/share/gtk-doc/html/p11-kit/gtk-doc.css +#usr/share/gtk-doc/html/p11-kit/home.png +#usr/share/gtk-doc/html/p11-kit/index.html +#usr/share/gtk-doc/html/p11-kit/left-insensitive.png +#usr/share/gtk-doc/html/p11-kit/left.png +#usr/share/gtk-doc/html/p11-kit/p11-kit-Deprecated.html +#usr/share/gtk-doc/html/p11-kit/p11-kit-Future.html +#usr/share/gtk-doc/html/p11-kit/p11-kit-Modules.html +#usr/share/gtk-doc/html/p11-kit/p11-kit-PIN-Callbacks.html +#usr/share/gtk-doc/html/p11-kit/p11-kit-URIs.html +#usr/share/gtk-doc/html/p11-kit/p11-kit-Utilities.html +#usr/share/gtk-doc/html/p11-kit/p11-kit.devhelp2 +#usr/share/gtk-doc/html/p11-kit/p11-kit.html +#usr/share/gtk-doc/html/p11-kit/pkcs11-conf.html +#usr/share/gtk-doc/html/p11-kit/reference.html +#usr/share/gtk-doc/html/p11-kit/remoting.html +#usr/share/gtk-doc/html/p11-kit/right-insensitive.png +#usr/share/gtk-doc/html/p11-kit/right.png +#usr/share/gtk-doc/html/p11-kit/sharing-managed.html +#usr/share/gtk-doc/html/p11-kit/sharing.html +#usr/share/gtk-doc/html/p11-kit/style.css +#usr/share/gtk-doc/html/p11-kit/tools.html +#usr/share/gtk-doc/html/p11-kit/trust-disable.html +#usr/share/gtk-doc/html/p11-kit/trust-glib-networking.html +#usr/share/gtk-doc/html/p11-kit/trust-module.html +#usr/share/gtk-doc/html/p11-kit/trust-nss.html +#usr/share/gtk-doc/html/p11-kit/trust.html +#usr/share/gtk-doc/html/p11-kit/up-insensitive.png +#usr/share/gtk-doc/html/p11-kit/up.png +#usr/share/p11-kit +#usr/share/p11-kit/modules +#usr/share/p11-kit/modules/p11-kit-trust.module diff --git a/lfs/p11-kit b/lfs/p11-kit new file mode 100644 index 000000000..df3f51df1 --- /dev/null +++ b/lfs/p11-kit @@ -0,0 +1,82 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 0.24.0 + +THISAPP = p11-kit-$(VER) +DL_FILE = $(THISAPP).tar.xz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +CFLAGS += -fcommon + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 8ccf11c4a2e2e505b8e516d8549e64a5 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + $(UPDATE_AUTOMAKE) + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --with-trust-paths=/etc/pki/ca-trust/source + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD) From patchwork Fri Aug 20 20:04:28 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 4638 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4Grt0m3dPdz3xJ1 for ; Fri, 20 Aug 2021 20:05:28 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Grt0m1C5Qz6Pq; Fri, 20 Aug 2021 20:05:28 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4Grt0m0Yqgz2xhR; Fri, 20 Aug 2021 20:05:28 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Grt0k3SKFz2xNW for ; Fri, 20 Aug 2021 20:05:26 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4Grt0j5mPCz1Tx; Fri, 20 Aug 2021 20:05:25 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1629489925; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kQk5ObF5EfMP8doHyBQlLDG7BFOM5YjQUPHC5JUR2kk=; b=IpbUBeKbSUxSJLHWF063IcLvpuulYr0bdcodRdLJs9dcwCBX2bo2THh3mDYVge5Q1yEzL/ Lv6j4lUeG9IzQGBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1629489925; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kQk5ObF5EfMP8doHyBQlLDG7BFOM5YjQUPHC5JUR2kk=; b=ZVC1HNAa1pREyZXRjw65n5bn0/1id1yybF62PbJNfIqhFSYP1svW/Bg0X7VeNNMIEck9P4 enuVbdCyT4C8sQKuOBAdtK+Ew98ZyGk5TANoa515gZOFlbtfv+JkUwFbjbP9Xvnry6stYb l6ruIEspepOg3qViHRnb9gph/W5QdwoN3U3ufmnlvucdz4RqAi7jRH0r4s1A8YVpemaXAJ Qoi39xKxAco0hUI4ueoMTqijkLwxniSJ1+nllYAtGUg01CRotm6eyrlyKmZl46a5VmhAoP B8zXrhIowEbMFj6MN1QkeYVMl6m5UjudPvAcZCOaPEVoiec9UuZfT0arM+Nvwg== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH 4/4] libtasn1: New program required as build dependency for p11-kit Date: Fri, 20 Aug 2021 22:04:28 +0200 Message-Id: <20210820200428.3535766-4-adolf.belka@ipfire.org> In-Reply-To: <20210820200428.3535766-1-adolf.belka@ipfire.org> References: <20210820200428.3535766-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - creation of lfs and rootfile for libtasn1 Signed-off-by: Adolf Belka Reviewed-by: Michael Tremer --- config/rootfiles/common/libtasn1 | 54 +++++++++++++++++++++ lfs/libtasn1 | 82 ++++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) create mode 100644 config/rootfiles/common/libtasn1 create mode 100644 lfs/libtasn1 diff --git a/config/rootfiles/common/libtasn1 b/config/rootfiles/common/libtasn1 new file mode 100644 index 000000000..33c729cf5 --- /dev/null +++ b/config/rootfiles/common/libtasn1 @@ -0,0 +1,54 @@ +#usr/bin/asn1Coding +#usr/bin/asn1Decoding +#usr/bin/asn1Parser +#usr/include/libtasn1.h +#usr/lib/libtasn1.la +#usr/lib/libtasn1.so +usr/lib/libtasn1.so.6 +usr/lib/libtasn1.so.6.6.1 +#usr/lib/pkgconfig/libtasn1.pc +#usr/share/info/libtasn1.info +#usr/share/man/man1/asn1Coding.1 +#usr/share/man/man1/asn1Decoding.1 +#usr/share/man/man1/asn1Parser.1 +#usr/share/man/man3/asn1_array2tree.3 +#usr/share/man/man3/asn1_bit_der.3 +#usr/share/man/man3/asn1_check_version.3 +#usr/share/man/man3/asn1_copy_node.3 +#usr/share/man/man3/asn1_create_element.3 +#usr/share/man/man3/asn1_decode_simple_ber.3 +#usr/share/man/man3/asn1_decode_simple_der.3 +#usr/share/man/man3/asn1_delete_element.3 +#usr/share/man/man3/asn1_delete_structure.3 +#usr/share/man/man3/asn1_delete_structure2.3 +#usr/share/man/man3/asn1_der_coding.3 +#usr/share/man/man3/asn1_der_decoding.3 +#usr/share/man/man3/asn1_der_decoding2.3 +#usr/share/man/man3/asn1_der_decoding_element.3 +#usr/share/man/man3/asn1_der_decoding_startEnd.3 +#usr/share/man/man3/asn1_dup_node.3 +#usr/share/man/man3/asn1_encode_simple_der.3 +#usr/share/man/man3/asn1_expand_any_defined_by.3 +#usr/share/man/man3/asn1_expand_octet_string.3 +#usr/share/man/man3/asn1_find_node.3 +#usr/share/man/man3/asn1_find_structure_from_oid.3 +#usr/share/man/man3/asn1_get_bit_der.3 +#usr/share/man/man3/asn1_get_length_ber.3 +#usr/share/man/man3/asn1_get_length_der.3 +#usr/share/man/man3/asn1_get_object_id_der.3 +#usr/share/man/man3/asn1_get_octet_der.3 +#usr/share/man/man3/asn1_get_tag_der.3 +#usr/share/man/man3/asn1_length_der.3 +#usr/share/man/man3/asn1_number_of_elements.3 +#usr/share/man/man3/asn1_object_id_der.3 +#usr/share/man/man3/asn1_octet_der.3 +#usr/share/man/man3/asn1_parser2array.3 +#usr/share/man/man3/asn1_parser2tree.3 +#usr/share/man/man3/asn1_perror.3 +#usr/share/man/man3/asn1_print_structure.3 +#usr/share/man/man3/asn1_read_node_value.3 +#usr/share/man/man3/asn1_read_tag.3 +#usr/share/man/man3/asn1_read_value.3 +#usr/share/man/man3/asn1_read_value_type.3 +#usr/share/man/man3/asn1_strerror.3 +#usr/share/man/man3/asn1_write_value.3 diff --git a/lfs/libtasn1 b/lfs/libtasn1 new file mode 100644 index 000000000..155608807 --- /dev/null +++ b/lfs/libtasn1 @@ -0,0 +1,82 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2018 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 4.17.0 + +THISAPP = libtasn1-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +CFLAGS += -fcommon + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = c46f6eb3bd1287031ae5d36465094402 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE) + $(UPDATE_AUTOMAKE) + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --disable-static + cd $(DIR_APP) && make $(MAKETUNING) + cd $(DIR_APP) && make install + @rm -rf $(DIR_APP) + @$(POSTBUILD)