commit 838840dd0d14b05aad8248f63022b3baf4a312a8 Author: EnumDev Date: Wed Nov 19 20:18:06 2025 +0200 Initial commit diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3e58e5f --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +# Exclude bpm archives +*.bpm \ No newline at end of file diff --git a/pkg.info b/pkg.info new file mode 100644 index 0000000..50b9b35 --- /dev/null +++ b/pkg.info @@ -0,0 +1,25 @@ +name: ca-certificates +description: Common CA certificates for SSL/TLS from Mozilla +version: "20250419" +revision: 1 +url: https://wiki.mozilla.org/NSS:Root_certs +license: GPL2-or-later,MPL2 +architecture: any +output_architecture: any +type: source +depends: + - coreutils + - findutils + - openssl + - run-parts + - sed + - sh +make_depends: + - wget +replaces: + - make-ca +downloads: + - url: http://ftp.us.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_${BPM_PKG_VERSION%+*}.tar.xz + extract_to: ${BPM_SOURCE} + extract_strip_components: 1 + checksum: 33b44ef78653ecd3f0f2f13e5bba6be466be2e7da72182f737912b81798ba5d2 diff --git a/post_install.sh b/post_install.sh new file mode 100644 index 0000000..d4a00f6 --- /dev/null +++ b/post_install.sh @@ -0,0 +1,6 @@ +#!/bin/sh + +[ -d /etc/ca-certificates/update.d ] || install -d /etc/ca-certificates/update.d +[ -d /etc/ssl/certs ] || install -d etc/ssl/certs + +/usr/sbin/update-ca-certificates --fresh diff --git a/post_remove.sh b/post_remove.sh new file mode 100644 index 0000000..98670a7 --- /dev/null +++ b/post_remove.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +[ -s etc/ssl/certs/ca-certificates.crt ] || rm -f /etc/ssl/certs/ca-certificates.crt diff --git a/post_update.sh b/post_update.sh new file mode 100644 index 0000000..ceed6b6 --- /dev/null +++ b/post_update.sh @@ -0,0 +1,6 @@ +#!/bin/sh + +[ -d /etc/ca-certificates/update.d ] || install -d /etc/ca-certificates/update.d +[ -d etc/ssl/certs ] || install -d etc/ssl/certs + +/usr/sbin/update-ca-certificates --fresh diff --git a/pre_remove.sh b/pre_remove.sh new file mode 100644 index 0000000..a8b4ebf --- /dev/null +++ b/pre_remove.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +backup=/etc/ca-certificates.conf.tmp +mv /etc/ca-certificates.conf $backup +echo > /etc/ca-certificates.conf +/usr/sbin/update-ca-certificates --fresh +mv $backup /etc/ca-certificates.conf diff --git a/source-files/certdata2pem.c b/source-files/certdata2pem.c new file mode 100644 index 0000000..88fd993 --- /dev/null +++ b/source-files/certdata2pem.c @@ -0,0 +1,142 @@ +/* Copyright (C) 2013, Felix Janda + +Permission to use, copy, modify, and/or distribute this software for +any purpose with or without fee is hereby granted, provided that the +above copyright notice and this permission notice appear in all copies. + +SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +*/ + +#include +#include +#include +#include + +void xwrite(FILE *f, void *p, size_t size) +{ + if (fwrite(p, 1, size, f) != size) err(1, 0); +} + +int main(void) +{ + FILE *f; + char cert[4096], ecert[4096*4/3 + 100]; + char *line = 0, *tmp, *filename, *label, *pcert = 0; + ssize_t len; + size_t size, certsize; + int trust; + char **blacklist = 0, **node; + + filename = "./blacklist.txt"; + if (!(f = fopen(filename, "r"))) err(1, "%s", filename); + while ((len = getline(&line, &size, f)) != -1) { + if ((line[0] != '#') && (len > 1)) { + if (!(node = malloc(sizeof(void*) + len))) err(1, 0); + *node = (char*)blacklist; + memcpy(node + 1, line, len); + blacklist = node; + } + } + fclose(f); + + filename = "./certdata.txt"; + if (!(f = fopen(filename, "r"))) err(1, "%s", filename); + while ((len = getline(&line, &size, f)) != -1) { + tmp = line; + if (line[0] == '#') continue; + if (pcert) { + if (!strcmp(line, "END\n")) { + char *base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" + "abcdefghijklmnopqrstuvwxyz0123456789+/"; + size_t i, j, k, val; + + for (i = 0, val = 0, tmp = ecert; i < (size_t)(pcert - cert); i++) { + val = (val << 8) + (unsigned char)cert[i]; + if (i % 3 == 2) { + for (j = 0; j < 4; j++, val >>= 6) tmp[3 - j] = base64[val & 0x3f]; + tmp += 4; + } + if (i && !(i % 48)) { + *tmp = '\n'; + tmp++; + } + } + if (k = i % 3) { + tmp[2] = '='; + tmp[3] = '='; + val <<= 6 - 2*k; + for (j = 0; j < k + 1; j++, val >>= 6) tmp[k - j] = base64[val & 0x3f]; + tmp += 4; + } + certsize = tmp - ecert; + pcert = 0; + } else while (sscanf(tmp, "\\%hho", pcert) == 1) pcert++, tmp += 4; + } else if (!memcmp(line, "CKA_LABEL UTF8 ", 15)) { + + char *p2, *tmp2; + len -= 15; + if (!(label = malloc(len))) err(1, 0); + memcpy(label, line + 15, len); + trust = 0; + for (node = blacklist; node; node = (char**)*node) + if (!strcmp(label, (char*)(node + 1))) trust = 4; + if (!(p2 = malloc(len + 2))) err(1, 0); + for (tmp = label + 1, tmp2 = p2; *tmp != '"'; tmp++, tmp2++) { + switch (*tmp) { + case '\\': + if (sscanf(tmp, "\\x%hhx", tmp2)!=1) errx(1, "Bad triple: %s\n", tmp); + tmp += 3; + break; + case '/': + case ' ': + *tmp2 = '_'; + break; + case '(': + case ')': + *tmp2 = '='; + break; + default: + *tmp2 = *tmp; + } + } + strcpy(tmp2, ".crt"); + free(label); + label = p2; + } else if (!strcmp(line, "CKA_VALUE MULTILINE_OCTAL\n")) pcert = cert; + else if (!memcmp(line, "CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_", 39)) { + tmp += 39; + if (!strcmp(tmp, "TRUSTED_DELEGATOR\n")) trust |= 1; + else if (!strcmp(tmp, "NOT_TRUSTED\n")) trust |= 2; + } else if (!memcmp(line, + "CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_", 44)) { + tmp += 44; + if (!strcmp(tmp, "TRUSTED_DELEGATOR\n")) trust |= 1; + else if (!strcmp(tmp, "NOT_TRUSTED\n")) trust |= 2; + if (!trust) printf("Ignoring %s\n", label); + if (trust == 1) { + FILE *out; + if (!(out = fopen(label, "w"))) err(1, "%s", label); + xwrite(out, "-----BEGIN CERTIFICATE-----\n", 28); + xwrite(out, ecert, certsize); + xwrite(out, "\n-----END CERTIFICATE-----\n", 27); + fclose(out); + } + } + } + fclose(f); + + while (blacklist) { + node = (char**)*blacklist; + free(blacklist); + blacklist = node; + } + free(line); + free(label); + return 0; +} diff --git a/source-files/drop-python-dependency.patch b/source-files/drop-python-dependency.patch new file mode 100644 index 0000000..e463096 --- /dev/null +++ b/source-files/drop-python-dependency.patch @@ -0,0 +1,16 @@ +--- a/ca-certificates/mozilla/Makefile ++++ b/ca-certificates/mozilla/Makefile +@@ -2,8 +2,11 @@ + # Makefile + # + +-all: +- python3 certdata2pem.py ++certdata2pem: certdata2pem.c ++ $(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@ ++ ++all: certdata2pem ++ ./certdata2pem + + clean: + -rm -f *.crt diff --git a/source-files/update-ca-certificates-destdir.patch b/source-files/update-ca-certificates-destdir.patch new file mode 100644 index 0000000..5181c28 --- /dev/null +++ b/source-files/update-ca-certificates-destdir.patch @@ -0,0 +1,19 @@ +--- a/ca-certificates/sbin/update-ca-certificates ++++ b/ca-certificates/sbin/update-ca-certificates +@@ -24,12 +24,12 @@ + verbose=0 + fresh=0 + default=0 +-CERTSCONF=/etc/ca-certificates.conf ++CERTSCONF=$DESTDIR/etc/ca-certificates.conf + CERTSDIR=/usr/share/ca-certificates +-LOCALCERTSDIR=/usr/local/share/ca-certificates ++LOCALCERTSDIR=$DESTDIR/usr/local/share/ca-certificates + CERTBUNDLE=ca-certificates.crt +-ETCCERTSDIR=/etc/ssl/certs +-HOOKSDIR=/etc/ca-certificates/update.d ++ETCCERTSDIR=$DESTDIR/etc/ssl/certs ++HOOKSDIR=$DESTDIR/etc/ca-certificates/update.d + + while [ $# -gt 0 ]; + do diff --git a/source.sh b/source.sh new file mode 100644 index 0000000..9d464fe --- /dev/null +++ b/source.sh @@ -0,0 +1,40 @@ +# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package +# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE +# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT + +# The prepare function is executed in the root of the temp directory +# This function is used for putting downloaded files to the correct location or applying patches +prepare() { + cd "$BPM_SOURCE" + # Apply patches + for _patch in "$BPM_WORKDIR"/*.patch; do + patch -p2 -i "$_patch" + done + cp "$BPM_WORKDIR"/certdata2pem.c mozilla/certdata2pem.c +} + +# The build function is executed in the source directory +# This function is used to compile the source code +build() { + make +} + +# The package function is executed in the source directory +# This function is used to move the compiled files into the output directory +package() { + make DESTDIR="$BPM_OUTPUT" install + + # Install man page + install -Dm644 "$BPM_SOURCE"/sbin/update-ca-certificates.8 "$BPM_OUTPUT"/usr/share/man/man8/update-ca-certificates.8 + + # Generate ca-certificates.conf + cd "$BPM_OUTPUT"/usr/share/ca-certificates + find . -name '*.crt' | sort | cut -b3- | install -Dm644 /dev/stdin "$BPM_OUTPUT"/etc/ca-certificates.conf + + # Create certificate symlink + install -d "$BPM_OUTPUT"/etc/ssl + ln -s /etc/ssl/certs/ca-certificates.crt "$BPM_OUTPUT"/etc/ssl/certs.pem + + # Install package license + install -Dm644 "$BPM_SOURCE"/debian/copyright "$BPM_OUTPUT"/usr/share/licenses/ca-certificates/copyright +}