Skip to contentSkip to conversation

ca-certificates: new package

PATCH Superseded Martin Bark 3 participants 7 messages Jan 8, 2014 – Jan 11, 2014

v2 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Martin Bark

author
#0 lore raw

PATCH v2 1/1 ca-certificates: new package

CA certificates used for SSL based applications. The package installs CA certificates to /usr/share/ca-certificates and creates symbolic links under /etc/ssl/certs. For example, the existing libcurl package will use these certificates for https urls. Based on the debian ca-certifcates package.

Signed-off-by Martin Bark <[email protected]>

---
Changes v1 -> v2
- Change CA_CERTIFICATES_SITE to use $(BR2_DEBIAN_MIRROR) (suggested by Baruch Siach)
- Clarify license usage in CA_CERTIFICATES_LICENSE (suggested by Baruch Siach)

---
 package/Config.in                          |    1 +
 package/ca-certificates/Config.in          |    9 +++++++
 package/ca-certificates/ca-certificates.mk |   39 ++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 package/ca-certificates/Config.in
 create mode 100644 package/ca-certificates/ca-certificates.mk
package/Config.in +1 -0
index e502cde..28ad4f4 100644
@@ -471,6 +471,7 @@ endmenu
 
 menu "Crypto"
 source "package/beecrypt/Config.in"
+source "package/ca-certificates/Config.in"
 source "package/cryptodev/Config.in"
 source "package/gnutls/Config.in"
 source "package/libassuan/Config.in"
package/ca-certificates/Config.in new file +9 -0
new file mode 100644
index 0000000..0e52bc1
@@ -0,0 +1,9 @@
+config BR2_PACKAGE_CA_CERTIFICATES
+    bool "CA Certificates"
+    help
+      This package includes PEM files of CA certificates to allow
+      SSL-based applications to check for the authenticity of SSL
+      connections.
+
+      It includes, among others, certificate authorities used by the
+      Debian infrastructure and those shipped with Mozilla's browsers.
package/ca-certificates/ca-certificates.mk new file +39 -0
new file mode 100644
index 0000000..6cf2e7a
@@ -0,0 +1,39 @@
+################################################################################
+#
+# ca-certificates
+#
+################################################################################
+
+CA_CERTIFICATES_VERSION = 20130906
+CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.gz
+CA_CERTIFICATES_SITE = $(BR2_DEBIAN_MIRROR)/debian/pool/main/c/ca-certificates
+CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python
+CA_CERTIFICATES_LICENSE = GPLv2+ (script), MPLv2.0 (data)
+CA_CERTIFICATES_LICENSE_FILES = debian/copyright
+
+define CA_CERTIFICATES_BUILD_CMDS
+    PATH=$(HOST_PATH) $(MAKE) -C $(@D) all
+endef
+
+define CA_CERTIFICATES_INSTALL_TARGET_CMDS
+    $(INSTALL) -d -m 0755 $(TARGET_DIR)/usr/share/ca-certificates
+    $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/ssl/certs
+    $(MAKE) -C $(@D) install DESTDIR=$(TARGET_DIR)
+    rm -f $(TARGET_DIR)/usr/sbin/update-ca-certificates
+
+    #remove any existing certificates under /etc/ssl/certs
+    rm -f  $(TARGET_DIR)/etc/ssl/certs/*
+
+    #generate symlinks to certificates under /etc/ssl/certs
+    ( \
+      cd $(TARGET_DIR) ;\
+      for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
+            ln -sf ../../../$$i etc/ssl/certs/`basename $${i%.crt}.pem` ;\
+      done ;\
+    )
+
+    #create symbolic links to the certificates by their hash values
+    $(HOST_DIR)/usr/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs
+endef
+
+$(eval $(generic-package))
Signature · 1 line
1.7.9.5
#1 lore raw

PATCH v2 1/1 ca-certificates: new package

Dear Martin Bark,

package/ca-certificates/Config.in line 3

Quoted 3 lines · Martin Bark
package/ca-certificates/Config.in new file +3 -0
+config BR2_PACKAGE_CA_CERTIFICATES
+    bool "CA Certificates"
+    help

Indentation should be one tab.

package/ca-certificates/Config.in line 6

Quoted 3 lines
package/ca-certificates/Config.in new file +3 -0
+      This package includes PEM files of CA certificates to allow
+      SSL-based applications to check for the authenticity of SSL
+      connections.

And here one tab + two spaces.

package/ca-certificates/Config.in line 9

Quoted 3 lines
package/ca-certificates/Config.in new file +3 -0
+
+      It includes, among others, certificate authorities used by the
+      Debian infrastructure and those shipped with Mozilla's browsers.

If possible, please add an upstream URL here.

Quoted 6 lines
package/ca-certificates/ca-certificates.mk new file +0 -0
new file mode 100644
index 0000000..6cf2e7a

package/ca-certificates/ca-certificates.mk line 9

Quoted 9 lines
package/ca-certificates/ca-certificates.mk new file +9 -0
@@ -0,0 +1,39 @@
+################################################################################
+#
+# ca-certificates
+#
+################################################################################
+
+CA_CERTIFICATES_VERSION = 20130906
+CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.gz
+CA_CERTIFICATES_SITE = $(BR2_DEBIAN_MIRROR)/debian/pool/main/c/ca-certificates

I think we should use snapshot.debian.net instead of BR2_DEBIAN_MIRROR. Maybe we should even completely remove BR2_DEBIAN_MIRROR altogether. The problem of using BR2_DEBIAN_MIRROR is that there is no guarantee that the tarballs are going to stay at the same location, as Debian evolves. While snapshot.debian.net guarantees this.

package/ca-certificates/ca-certificates.mk line 15

Quoted 6 lines
package/ca-certificates/ca-certificates.mk new file +6 -0
+CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python
+CA_CERTIFICATES_LICENSE = GPLv2+ (script), MPLv2.0 (data)
+CA_CERTIFICATES_LICENSE_FILES = debian/copyright
+
+define CA_CERTIFICATES_BUILD_CMDS
+    PATH=$(HOST_PATH) $(MAKE) -C $(@D) all

Instead of PATH=$(HOST_PATH), I'd prefer to see:

	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) all

Also, the indentation of the command should be one tab.

Quoted 8 lines
package/ca-certificates/ca-certificates.mk new file +8 -0
+endef
+
+define CA_CERTIFICATES_INSTALL_TARGET_CMDS
+    $(INSTALL) -d -m 0755 $(TARGET_DIR)/usr/share/ca-certificates
+    $(INSTALL) -d -m 0755 $(TARGET_DIR)/etc/ssl/certs
+    $(MAKE) -C $(@D) install DESTDIR=$(TARGET_DIR)
+    rm -f $(TARGET_DIR)/usr/sbin/update-ca-certificates
+

package/ca-certificates/ca-certificates.mk line 33

Quoted 10 lines
package/ca-certificates/ca-certificates.mk new file +10 -0
+    #remove any existing certificates under /etc/ssl/certs
+    rm -f  $(TARGET_DIR)/etc/ssl/certs/*
+
+    #generate symlinks to certificates under /etc/ssl/certs
+    ( \
+      cd $(TARGET_DIR) ;\
+      for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
+            ln -sf ../../../$$i etc/ssl/certs/`basename $${i%.crt}.pem` ;\
+      done ;\
+    )

This is not very pretty, but I don't really have a better suggestion, unfortunately.

package/ca-certificates/ca-certificates.mk line 39

Quoted 6 lines
package/ca-certificates/ca-certificates.mk new file +6 -0
+
+    #create symbolic links to the certificates by their hash values
+    $(HOST_DIR)/usr/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs
+endef
+
+$(eval $(generic-package))

Thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
#3 lore raw

PATCH v2 1/1 ca-certificates: new package

Dear Martin Bark,

Quoted 5 lines · Martin Bark
Quoted 1 line

If possible, please add an upstream URL here.

There is the a browsable version of the git repo here
http://anonscm.debian.org/gitweb/?p=collab-maint/ca-certificates.git
would that do?

Well, if there's no other web site for that, it's ok.

Thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
#4 lore raw

PATCH v2 1/1 ca-certificates: new package

In reply to Martin Bark

Martin, All,

On 2014-01-08 17:15 +0000, Martin Bark spake thusly:

Quoted 6 lines

CA certificates used for SSL based applications. The package installs CA certificates to /usr/share/ca-certificates and creates symbolic links under /etc/ssl/certs. For example, the existing libcurl package will use these certificates for https urls. Based on the debian ca-certifcates package.

Signed-off-by Martin Bark <[email protected]>

[--SNIP--]

package/ca-certificates/ca-certificates.mk

Quoted 6 lines
package/ca-certificates/ca-certificates.mk new file +0 -0
new file mode 100644
index 0000000..6cf2e7a
@@ -0,0 +1,39 @@

[--SNIP--]

package/ca-certificates/ca-certificates.mk line 33

Quoted 7 lines
package/ca-certificates/ca-certificates.mk new file +7 -0
+    #generate symlinks to certificates under /etc/ssl/certs
+    ( \
+      cd $(TARGET_DIR) ;\
+      for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
+            ln -sf ../../../$$i etc/ssl/certs/`basename $${i%.crt}.pem` ;\
+      done ;\
+    )

As stated by Thomas, this is not very nice.

However, you do not need to enclose the command in-between a ()-pair, since make will spawn a shell for each 'command', and thus the cd is in effect only in that shell. That is, the following line:

package/ca-certificates/ca-certificates.mk line 36

Quoted 1 line
package/ca-certificates/ca-certificates.mk new file +1 -0
+    $(HOST_DIR)/usr/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs

Will be executed in another shell.

Also, your use of basename is weird. I'd use this instead:

    `basename $${i} .crt`.pem

Regards,
Yann E. MORIN.

Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
author
#5 lore raw

PATCH v2 1/1 ca-certificates: new package

Yann,

Thanks for the feedback.

On 09/01/14 23:59, Yann E. MORIN wrote:

[--SNIP--]

Quoted 14 lines

package/ca-certificates/ca-certificates.mk line 33

Quoted 7 lines
package/ca-certificates/ca-certificates.mk new file +7 -0
+    #generate symlinks to certificates under /etc/ssl/certs
+    ( \
+      cd $(TARGET_DIR) ;\
+      for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
+            ln -sf ../../../$$i etc/ssl/certs/`basename $${i%.crt}.pem` ;\
+      done ;\
+    )

As stated by Thomas, this is not very nice.

However, you do not need to enclose the command in-between a ()-pair, since make will spawn a shell for each 'command', and thus the cd is in effect only in that shell. That is, the following line:

Quoted 7 lines
Quoted 1 line

+ $(HOST_DIR)/usr/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs

Will be executed in another shell.

Also, your use of basename is weird. I'd use this instead:

     `basename $${i} .crt`.pem

I was using the bash ${var%Pattern} substitution but your solution is neater. I'll make those changes now.

Thanks

#6 lore raw

PATCH v2 1/1 ca-certificates: new package

Martin, All,

On 2014-01-10 14:24 +0000, Martin Bark spake thusly:

Quoted 1 line · Yann E. MORIN

[--SNIP--]

Quoted 16 lines
Quoted 16 lines

package/ca-certificates/ca-certificates.mk line 33

Quoted 7 lines
package/ca-certificates/ca-certificates.mk new file +7 -0
+    #generate symlinks to certificates under /etc/ssl/certs
+    ( \
+      cd $(TARGET_DIR) ;\
+      for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
+            ln -sf ../../../$$i etc/ssl/certs/`basename $${i%.crt}.pem` ;\
+      done ;\
+    )

As stated by Thomas, this is not very nice.

However, you do not need to enclose the command in-between a ()-pair, since make will spawn a shell for each 'command', and thus the cd is in effect only in that shell. That is, the following line:

Quoted 1 line

+ $(HOST_DIR)/usr/bin/c_rehash $(TARGET_DIR)/etc/ssl/certs

Quoted 7 lines
Quoted 4 lines

Will be executed in another shell.

Also, your use of basename is weird. I'd use this instead:

    `basename $${i} .crt`.pem

I was using the bash ${var%Pattern} substitution but your solution is neater. I'll make those changes now.

Yes, I know about this, and I even use it a lot. But I think it is not obvious enough in this context.

Regards,
Yann E. MORIN.

Signature · 6 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'