Add ca-certificates recipe

From: Christopher Larson <[email protected]>

This is based on the meta-oe recipe, with enhancements, and prepopulates the certificates for the nativesdk version, for later use in the buildtools-tarball.

The following changes since commit 9b05c65450526522d7358d0c0901b594de546748:

sstate: Fix the relative symlink replacement code (2013-08-23 16:59:04 +0100)

are available in the git repository at:

https://github.com/kergoth/oe-core.git ca-certificates

Christopher Larson (2):
ca-certificates: add recipe (version 20130610)
nativesdk-ca-certificates: prepopulate ca-certificates.crt

 ...01-update-ca-certificates-remove-c-rehash.patch | 46 +++++++++++++++
 .../0002-update-ca-certificates-use-SYSROOT.patch  | 55 +++++++++++++++++
 .../ca-certificates/default-sysroot.patch          | 55 +++++++++++++++++
 .../ca-certificates/ca-certificates/sbindir.patch  | 20 +++++++
 .../ca-certificates/ca-certificates_20130610.bb    | 69 ++++++++++++++++++++++
 5 files changed, 245 insertions(+)
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-remove-c-rehash.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/sbindir.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates_20130610.bb

1.8.3.4

From: Christopher Larson <[email protected]>

We need this for certain nativesdk recipes, as we can't rely on the certificate path or bundle path being the same across distros, and it's useful in many cases on the target as well.

This is based on the 20130119 recipe from meta-oe, with the following changes:

- use the debian git repository to avoid vanishing sources
- obey our target paths
- default to a sysroot relative to the script location (make relocatable)
- define SUMMARY
- don't inherit autotools, this isn't an autotools package
- add MPL-2.0 to LICENSE, as that's the license of the certdata
- install the script man page
- use a native rather than cross recipe, as it's not bound in any way to the target system
- add nativesdk to bbclassextend, for use in SDKs

---
 ...01-update-ca-certificates-remove-c-rehash.patch | 46 ++++++++++++++++
 .../0002-update-ca-certificates-use-SYSROOT.patch  | 55 +++++++++++++++++++
 .../ca-certificates/default-sysroot.patch          | 55 +++++++++++++++++++
 .../ca-certificates/ca-certificates/sbindir.patch  | 20 +++++++
 .../ca-certificates/ca-certificates_20130610.bb    | 63 ++++++++++++++++++++++
 5 files changed, 239 insertions(+)
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0001-update-ca-certificates-remove-c-rehash.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/default-sysroot.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates/sbindir.patch
 create mode 100644 meta/recipes-support/ca-certificates/ca-certificates_20130610.bb

new file mode 100644
index 0000000..bf02723
@@ -0,0 +1,46 @@
+Upstream-Status: Pending
+
+From 111e905fe931da1a3800accfc675cc01c8ee080c Mon Sep 17 00:00:00 2001
+From: Ulf Samuelsson <[email protected]>
+Date: Tue, 28 Feb 2012 06:42:58 +0100
+Subject: [PATCH] update-ca-certificates: remove c rehash
+
+Updated earlier patch to apply clean on 2012-02-12
+Signed-off-by: Ulf Samuelsson <[email protected]>
+---
+ sbin/update-ca-certificates |   20 ++++++++++----------
+ 1 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sbin/update-ca-certificates b/sbin/update-ca-certificates
+index 5375950..c567e3d 100755
+--- a/sbin/update-ca-certificates
++++ b/sbin/update-ca-certificates
+@@ -132,16 +132,16 @@ rm -f "$CERTBUNDLE"
+ ADDED_CNT=$(wc -l < "$ADDED")
+ REMOVED_CNT=$(wc -l < "$REMOVED")
+
+-if [ "$ADDED_CNT" -gt 0 ] || [ "$REMOVED_CNT" -gt 0 ]
+-then
+-  # only run if set of files has changed
+-  if [ "$verbose" = 0 ]
+-  then
+-    c_rehash . > /dev/null
+-  else
+-    c_rehash .
+-  fi
+-fi
++#if [ "$ADDED_CNT" -gt 0 ] || [ "$REMOVED_CNT" -gt 0 ]
++#then
++#  # only run if set of files has changed
++#  if [ "$verbose" = 0 ]
++#  then
++#    c_rehash . > /dev/null
++#  else
++#    c_rehash .
++#  fi
++#fi
+
+ chmod 0644 "$TEMPBUNDLE"
+ mv -f "$TEMPBUNDLE" "$CERTBUNDLE"
+--
+1.7.4.1

new file mode 100644
index 0000000..a113fa8
@@ -0,0 +1,20 @@
+Upstream-Status: Pending
+
+Let us alter the install destination of the script via SBINDIR
+
+--- ca-certificates-20130119.orig/sbin/Makefile
++++ ca-certificates-20130119/sbin/Makefile
+@@ -3,9 +3,12 @@
+ #
+ #
+
++SBINDIR = /usr/sbin
++
+ all:
+
+ clean:
+
+ install:
+-	install -m755 update-ca-certificates $(DESTDIR)/usr/sbin/
++	install -d $(DESTDIR)$(SBINDIR)
++	install -m755 update-ca-certificates $(DESTDIR)$(SBINDIR)/

1.8.3.4

From: Christopher Larson <[email protected]>

As postinsts aren't run for nativesdk packages when populating an SDK, we need to prepopulate up-front.

---
 meta/recipes-support/ca-certificates/ca-certificates_20130610.bb | 6 ++++++
 1 file changed, 6 insertions(+)

index 0692ca2..29d6ebd 100644
@@ -60,4 +60,10 @@ pkg_postinst_${PN} () {
 
 CONFFILES_${PN} += "${sysconfdir}/ca-certificates.conf"
 
+# Postinsts don't seem to be run for nativesdk packages when populating SDKs.
+CONFFILES_${PN}_append_class-nativesdk = " ${sysconfdir}/ssl/certs/ca-certificates.crt"
+do_install_append_class-nativesdk () {
+    SYSROOT="${D}${SDKPATHNATIVE}" update-ca-certificates
+}
+
 BBCLASSEXTEND += "native nativesdk"

1.8.3.4

Are you going to send patches to oe-devel to remove moved recipes/bbclasses ?

Martin 'JaMa' Jansa     jabber: [email protected]

9b05c65450526522d7358d0c0901b594de546748:

Martin is now aware, but FYI I've sent a patch for this.

Cheers,
Paul

Ah, thanks.

Christopher Larson