Skip to content

Commit 4da6522

Browse files
committed
[Certificates] Bump CA root certificates
1 parent 18ae672 commit 4da6522

File tree

3 files changed

+66
-11
lines changed

3 files changed

+66
-11
lines changed
Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
From bf18b564122e8f976681a2398862fde1eafd84ba Mon Sep 17 00:00:00 2001
2+
From: Thomas Petazzoni <[email protected]>
3+
Date: Thu, 6 Jan 2022 23:15:00 +0100
4+
Subject: [PATCH] mozilla/certdata2pem.py: make cryptography module optional
5+
6+
The Python cryptography module is only used to verify if trusted
7+
certificates have expired, but this is only a warning. For some build
8+
systems and distributions, providing Python cryptography is costly,
9+
especially since it's now partly written in Rust.
10+
11+
As the check is only a warning, it's anyway going to be overlooked by
12+
most people. This commit changes the check to be optional: if the
13+
cryptography Python module is there, we perform the check, otherwise
14+
the check is skipped.
15+
16+
Signed-off-by: Thomas Petazzoni <[email protected]>
17+
---
18+
mozilla/certdata2pem.py | 18 ++++++++++--------
19+
1 file changed, 10 insertions(+), 8 deletions(-)
20+
21+
diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
22+
index ede23d4..a6261f8 100644
23+
--- a/mozilla/certdata2pem.py
24+
+++ b/mozilla/certdata2pem.py
25+
@@ -28,9 +28,6 @@ import sys
26+
import textwrap
27+
import io
28+
29+
-from cryptography import x509
30+
-
31+
-
32+
objects = []
33+
34+
# Dirty file parser.
35+
@@ -122,11 +119,16 @@ for obj in objects:
36+
if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
37+
continue
38+
39+
- cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
40+
- if cert.not_valid_after < datetime.datetime.now():
41+
- print('!'*74)
42+
- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
43+
- print('!'*74)
44+
+ try:
45+
+ from cryptography import x509
46+
+
47+
+ cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
48+
+ if cert.not_valid_after < datetime.datetime.now():
49+
+ print('!'*74)
50+
+ print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
51+
+ print('!'*74)
52+
+ except ImportError:
53+
+ pass
54+
55+
bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
56+
.replace(' ', '_')\
57+
--
58+
2.33.1
59+
Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# hashes from: $(CA_CERTIFICATES_SITE)/ca-certificates_$(CA_CERTIFICATES_VERSION).dsc :
2-
sha1 47d4584eae85fc905e4994766eb3930a8a84e2e1 ca-certificates_20190110.tar.xz
3-
sha256 ee4bf0f4c6398005f5b5ca4e0b87b82837ac5c3b0280a1cb3a63c47555c3a675 ca-certificates_20190110.tar.xz
2+
sha1 bce5a8fac45456dbebf256f3a812c6cd0a853e3e ca-certificates_20211016.tar.xz
3+
sha256 2ae9b6dc5f40c25d6d7fe55e07b54f12a8967d1955d3b7b2f42ee46266eeef88 ca-certificates_20211016.tar.xz
44

55
# Locally computed
6-
sha256 80fd11117df5543d5cf17bfd951b0ead213f7867d0b09f09c6d5a5eca3ff7422 debian/copyright
6+
sha256 e85e1bcad3a915dc7e6f41412bc5bdeba275cadd817896ea0451f2140a93967c debian/copyright

package/ca-certificates/ca-certificates.mk

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,10 @@
44
#
55
################################################################################
66

7-
CA_CERTIFICATES_VERSION = 20190110
7+
CA_CERTIFICATES_VERSION = 20211016
88
CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
9-
CA_CERTIFICATES_SITE = http://snapshot.debian.org/archive/debian/20190513T145054Z/pool/main/c/ca-certificates
10-
CA_CERTIFICATES_DEPENDENCIES = host-openssl
11-
# ca-certificates can be built with either python 2 or python 3
12-
# but it must be at least python 2.7
13-
CA_CERTIFICATES_DEPENDENCIES += \
14-
$(if $(BR2_PACKAGE_PYTHON3),host-python3,host-python)
9+
CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20211022T144903Z/pool/main/c/ca-certificates
10+
CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
1511
CA_CERTIFICATES_LICENSE = GPL-2.0+ (script), MPL-2.0 (data)
1612
CA_CERTIFICATES_LICENSE_FILES = debian/copyright
1713

@@ -26,7 +22,7 @@ define CA_CERTIFICATES_INSTALL_TARGET_CMDS
2622
rm -f $(TARGET_DIR)/usr/sbin/update-ca-certificates
2723

2824
# Remove any existing certificates under /etc/ssl/certs
29-
rm -f $(TARGET_DIR)/etc/ssl/certs/*
25+
rm -f $(TARGET_DIR)/etc/ssl/certs/*
3026

3127
# Create symlinks to certificates under /etc/ssl/certs
3228
# and generate the bundle

0 commit comments

Comments
 (0)