Initial commit

.gitignore

@@ -0,0 +1,2 @@
+# Exclude bpm archives
+*.bpm

pkg.info

@@ -0,0 +1,25 @@
+name: ca-certificates
+description: Common CA certificates for SSL/TLS from Mozilla
+version: "20250419"
+revision: 1
+url: https://wiki.mozilla.org/NSS:Root_certs
+license: GPL2-or-later,MPL2
+architecture: any
+output_architecture: any
+type: source
+depends:
+  - coreutils
+  - findutils
+  - openssl
+  - run-parts
+  - sed
+  - sh
+make_depends:
+  - wget
+replaces:
+  - make-ca
+downloads:
+  - url: http://ftp.us.debian.org/debian/pool/main/c/ca-certificates/ca-certificates_${BPM_PKG_VERSION%+*}.tar.xz
+    extract_to: ${BPM_SOURCE}
+    extract_strip_components: 1
+    checksum: 33b44ef78653ecd3f0f2f13e5bba6be466be2e7da72182f737912b81798ba5d2

post_install.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+[ -d /etc/ca-certificates/update.d ] || install -d /etc/ca-certificates/update.d
+[ -d /etc/ssl/certs ] || install -d etc/ssl/certs
+
+/usr/sbin/update-ca-certificates --fresh

post_remove.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+[ -s etc/ssl/certs/ca-certificates.crt ] || rm -f /etc/ssl/certs/ca-certificates.crt

post_update.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+[ -d /etc/ca-certificates/update.d ] || install -d /etc/ca-certificates/update.d
+[ -d etc/ssl/certs ] || install -d etc/ssl/certs
+
+/usr/sbin/update-ca-certificates --fresh

pre_remove.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+backup=/etc/ca-certificates.conf.tmp
+mv /etc/ca-certificates.conf $backup
+echo > /etc/ca-certificates.conf
+/usr/sbin/update-ca-certificates --fresh
+mv $backup /etc/ca-certificates.conf

source-files/certdata2pem.c

@@ -0,0 +1,142 @@
+/* Copyright (C) 2013, Felix Janda <[email protected]>
+
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all copies.
+
+SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <err.h>
+
+void xwrite(FILE *f, void *p, size_t size)
+{
+  if (fwrite(p, 1, size, f) != size) err(1, 0);
+}
+
+int main(void)
+{
+  FILE *f;
+  char cert[4096], ecert[4096*4/3 + 100];
+  char *line = 0, *tmp, *filename, *label, *pcert = 0;
+  ssize_t len;
+  size_t size, certsize;
+  int trust;
+  char **blacklist = 0, **node;
+
+  filename = "./blacklist.txt";
+  if (!(f = fopen(filename, "r"))) err(1, "%s", filename);
+  while ((len = getline(&line, &size, f)) != -1) {
+    if ((line[0] != '#') && (len > 1)) {
+      if (!(node = malloc(sizeof(void*) + len))) err(1, 0);
+      *node = (char*)blacklist;
+      memcpy(node + 1, line, len);
+      blacklist = node;
+    }
+  }
+  fclose(f);
+
+  filename = "./certdata.txt";
+  if (!(f = fopen(filename, "r"))) err(1, "%s", filename);
+  while ((len = getline(&line, &size, f)) != -1) {
+    tmp = line;
+    if (line[0] == '#') continue;
+    if (pcert) {
+      if (!strcmp(line, "END\n")) {
+        char *base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                       "abcdefghijklmnopqrstuvwxyz0123456789+/";
+        size_t i, j, k, val;
+
+        for (i = 0, val = 0, tmp = ecert; i < (size_t)(pcert - cert); i++) {
+          val = (val << 8) + (unsigned char)cert[i];
+          if (i % 3 == 2) {
+            for (j = 0; j < 4; j++, val >>= 6) tmp[3 - j] = base64[val & 0x3f];
+            tmp += 4;
+          }
+          if (i && !(i % 48)) {
+            *tmp = '\n';
+            tmp++;
+          }
+        }
+        if (k = i % 3) {
+          tmp[2] = '=';
+          tmp[3] = '=';
+          val <<= 6 - 2*k;
+          for (j = 0; j < k + 1; j++, val >>= 6) tmp[k - j] = base64[val & 0x3f];
+          tmp += 4;
+        }
+        certsize = tmp - ecert;
+        pcert = 0;
+      } else while (sscanf(tmp, "\\%hho", pcert) == 1) pcert++, tmp += 4;
+    } else if (!memcmp(line, "CKA_LABEL UTF8 ", 15)) {
+
+      char *p2, *tmp2;
+      len -= 15;
+      if (!(label = malloc(len))) err(1, 0);
+      memcpy(label, line + 15, len);
+      trust = 0;
+      for (node = blacklist; node; node = (char**)*node)
+        if (!strcmp(label, (char*)(node + 1))) trust = 4;
+      if (!(p2 = malloc(len + 2))) err(1, 0);
+      for (tmp = label + 1, tmp2 = p2; *tmp != '"'; tmp++, tmp2++) {
+        switch (*tmp) {
+        case '\\':
+          if (sscanf(tmp, "\\x%hhx", tmp2)!=1) errx(1, "Bad triple: %s\n", tmp);
+          tmp += 3;
+          break;
+        case '/':
+        case ' ':
+          *tmp2 = '_';
+          break;
+        case '(':
+        case ')':
+          *tmp2 = '=';
+          break;
+        default:
+          *tmp2 = *tmp;
+        }
+      }
+      strcpy(tmp2, ".crt");
+      free(label);
+      label = p2;
+    } else if (!strcmp(line, "CKA_VALUE MULTILINE_OCTAL\n")) pcert = cert;
+    else if (!memcmp(line, "CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_", 39)) {
+      tmp += 39;
+      if (!strcmp(tmp, "TRUSTED_DELEGATOR\n")) trust |= 1;
+      else if (!strcmp(tmp, "NOT_TRUSTED\n")) trust |= 2;
+    } else if (!memcmp(line,
+                       "CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_", 44)) {
+      tmp += 44;
+      if (!strcmp(tmp, "TRUSTED_DELEGATOR\n")) trust |= 1;
+      else if (!strcmp(tmp, "NOT_TRUSTED\n")) trust |= 2;
+      if (!trust) printf("Ignoring %s\n", label);
+      if (trust == 1) {
+        FILE *out;
+        if (!(out = fopen(label, "w"))) err(1, "%s", label);
+        xwrite(out, "-----BEGIN CERTIFICATE-----\n", 28);
+        xwrite(out, ecert, certsize);
+        xwrite(out, "\n-----END CERTIFICATE-----\n", 27);
+        fclose(out);
+      }
+    }
+  }
+  fclose(f);
+  
+  while (blacklist) {
+    node = (char**)*blacklist;
+    free(blacklist);
+    blacklist = node;
+  }
+  free(line);
+  free(label);
+  return 0;
+}

source-files/drop-python-dependency.patch

@@ -0,0 +1,16 @@
+--- a/ca-certificates/mozilla/Makefile
++++ b/ca-certificates/mozilla/Makefile
+@@ -2,8 +2,11 @@
+ # Makefile
+ #
+ 
+-all:
+-	python3 certdata2pem.py
++certdata2pem: certdata2pem.c
++	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@
++
++all: certdata2pem
++	./certdata2pem
+ 
+ clean:
+ 	-rm -f *.crt

source-files/update-ca-certificates-destdir.patch

@@ -0,0 +1,19 @@
+--- a/ca-certificates/sbin/update-ca-certificates
++++ b/ca-certificates/sbin/update-ca-certificates
+@@ -24,12 +24,12 @@
+ verbose=0
+ fresh=0
+ default=0
+-CERTSCONF=/etc/ca-certificates.conf
++CERTSCONF=$DESTDIR/etc/ca-certificates.conf
+ CERTSDIR=/usr/share/ca-certificates
+-LOCALCERTSDIR=/usr/local/share/ca-certificates
++LOCALCERTSDIR=$DESTDIR/usr/local/share/ca-certificates
+ CERTBUNDLE=ca-certificates.crt
+-ETCCERTSDIR=/etc/ssl/certs
+-HOOKSDIR=/etc/ca-certificates/update.d
++ETCCERTSDIR=$DESTDIR/etc/ssl/certs
++HOOKSDIR=$DESTDIR/etc/ca-certificates/update.d
+ 
+ while [ $# -gt 0 ];
+ do

source.sh

@@ -0,0 +1,40 @@
+# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package
+# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
+# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
+
+# The prepare function is executed in the root of the temp directory
+# This function is used for putting downloaded files to the correct location or applying patches
+prepare() {
+  cd "$BPM_SOURCE"
+  # Apply patches
+  for _patch in "$BPM_WORKDIR"/*.patch; do
+    patch -p2 -i "$_patch"
+  done
+  cp "$BPM_WORKDIR"/certdata2pem.c mozilla/certdata2pem.c
+}
+
+# The build function is executed in the source directory
+# This function is used to compile the source code
+build() {
+  make
+}
+
+# The package function is executed in the source directory
+# This function is used to move the compiled files into the output directory
+package() {
+  make DESTDIR="$BPM_OUTPUT" install
+
+  # Install man page
+  install -Dm644 "$BPM_SOURCE"/sbin/update-ca-certificates.8 "$BPM_OUTPUT"/usr/share/man/man8/update-ca-certificates.8
+
+  # Generate ca-certificates.conf
+  cd "$BPM_OUTPUT"/usr/share/ca-certificates
+  find . -name '*.crt' | sort | cut -b3- | install -Dm644 /dev/stdin "$BPM_OUTPUT"/etc/ca-certificates.conf
+
+  # Create certificate symlink
+  install -d "$BPM_OUTPUT"/etc/ssl
+  ln -s /etc/ssl/certs/ca-certificates.crt "$BPM_OUTPUT"/etc/ssl/certs.pem
+
+  # Install package license
+  install -Dm644 "$BPM_SOURCE"/debian/copyright "$BPM_OUTPUT"/usr/share/licenses/ca-certificates/copyright
+}