Skip to contentSkip to conversation

package/ca-certificates: generate the bundle of certs

PATCH New Yann E. MORIN 3 participants 3 messages Apr 2, 2015 – Apr 3, 2015

lore
Share & tools
lore

Yann E. MORIN

author
#0 lore raw

PATCH 1/1 package/ca-certificates: generate the bundle of certs

glib-networking wants to use the certificates bundle, not the individual certificates.

Generating the bundle is usually done with update-ca-certificates, but that does not support running out-of-tree.

Fortiunately, and as Gustavo put it, update-ca-certificates is jsut a glorified 'cat'. It is supposed to be fed a config file stating which certificate to add/remove to/from the bundle, otherwise nothing fancy (Oh, yes, running hooks after updating the bundle).

Since we do not need any of this in Buidlroot, we jsut generate a bundle with all certificates unconditionally.

Reported-by Gustavo Zacarias <[email protected]>
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Gustavo Zacarias <[email protected]>
---
 package/ca-certificates/ca-certificates.mk | 2 ++
 1 file changed, 2 insertions(+)
package/ca-certificates/ca-certificates.mk +2 -0
index 271985a..8fe26c9 100644
@@ -25,9 +25,11 @@ define CA_CERTIFICATES_INSTALL_TARGET_CMDS
 	rm -f  $(TARGET_DIR)/etc/ssl/certs/*
 
 	# Create symlinks to certificates under /etc/ssl/certs
+	# and generate the bundle
 	cd $(TARGET_DIR) ;\
 	for i in `find usr/share/ca-certificates -name "*.crt"` ; do \
 		ln -sf ../../../$$i etc/ssl/certs/`basename $${i} .crt`.pem ;\
+		cat $$i >>etc/ssl/certs/ca-certificates.crt ;\
 	done
 
 	# Create symlinks to the certificates by their hash values
Signature · 1 line
1.9.1
#1 lore raw

PATCH 1/1 package/ca-certificates: generate the bundle of certs

Quoted 11 lines · Yann E. MORIN

glib-networking wants to use the certificates bundle, not the individual certificates.

Generating the bundle is usually done with update-ca-certificates, but that does not support running out-of-tree.

Fortiunately, and as Gustavo put it, update-ca-certificates is jsut a glorified 'cat'. It is supposed to be fed a config file stating which certificate to add/remove to/from the bundle, otherwise nothing fancy (Oh, yes, running hooks after updating the bundle).

Quoted 6 lines

Since we do not need any of this in Buidlroot, we jsut generate a bundle with all certificates unconditionally.

Reported-by Gustavo Zacarias <[email protected]>
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Gustavo Zacarias <[email protected]>
Acked-by Gustavo Zacarias <[email protected]>
Tested-by Gustavo Zacarias <[email protected]>

(midori qemu-arm-vexpress with good certificate site + bad site) (when this was missing it would report every site as bad CA when clicking on the lock icon "the signing certificate authority is not know" - besides the console warning).
Regards.

Applied
#2 lore raw

PATCH 1/1 package/ca-certificates: generate the bundle of certs

In reply to Yann E. MORIN

Dear Yann E. MORIN,

Quoted 11 lines · Yann E. MORIN

glib-networking wants to use the certificates bundle, not the individual certificates.

Generating the bundle is usually done with update-ca-certificates, but that does not support running out-of-tree.

Fortiunately, and as Gustavo put it, update-ca-certificates is jsut a glorified 'cat'. It is supposed to be fed a config file stating which certificate to add/remove to/from the bundle, otherwise nothing fancy (Oh, yes, running hooks after updating the bundle).

Quoted 6 lines

Since we do not need any of this in Buidlroot, we jsut generate a bundle with all certificates unconditionally.

Reported-by Gustavo Zacarias <[email protected]>
Signed-off-by "Yann E. MORIN" <[email protected]>
Cc Gustavo Zacarias <[email protected]>

Applied, thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com