mirror of
https://gitlab.alpinelinux.org/alpine/aports.git
synced 2025-04-20 06:06:58 +02:00
6629b908cd
The following certs are restored: - Entrust.net Premium 2048 Secure Server CA - Entrust Root Certification Authority - AffirmTrust Commercial - AffirmTrust Networking - AffirmTrust Premium - AffirmTrust Premium ECC - Entrust Root Certification Authority - G2 - Entrust Root Certification Authority - EC - GLOBALTRUST 2020 ref: https://gitlab.alpinelinux.org/alpine/ca-certificates/-/issues/6 fixes: https://gitlab.alpinelinux.org/alpine/aports/-/issues/16812
90 lines
2.9 KiB
Diff
90 lines
2.9 KiB
Diff
From 103d13b09c84715b868b0acff1e8240cc4f0cdba Mon Sep 17 00:00:00 2001
|
|
From: Kevin Daudt <kdaudt@alpinelinux.org>
|
|
Date: Tue, 7 Jan 2025 17:41:44 +0100
|
|
Subject: [PATCH] mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
|
|
|
|
Apply the [upstream patch][0] to restore certificates that are going to
|
|
be removed in the future, but should still be available to verify
|
|
existing certificates.
|
|
|
|
Note that the CKA_NSS_SERVER_DISTRUST_AFTER attribute cannot be encoded
|
|
in the generated certificate bundle, so that means newly generated
|
|
certificates will be trusted as well. This is a trade-off between
|
|
breaking existing certificates versus not trusting newly generated
|
|
certificates.
|
|
|
|
With this change, the following root certificates would be restored:
|
|
|
|
- Entrust.net Premium 2048 Secure Server CA
|
|
- Entrust Root Certification Authority
|
|
- AffirmTrust Commercial
|
|
- AffirmTrust Networking
|
|
- AffirmTrust Premium
|
|
- AffirmTrust Premium ECC
|
|
- Entrust Root Certification Authority - G2
|
|
- Entrust Root Certification Authority - EC
|
|
- GLOBALTRUST 2020
|
|
|
|
[0]:https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c.patch
|
|
|
|
Fixes #6
|
|
---
|
|
mk-ca-bundle.pl | 42 ------------------------------------------
|
|
1 file changed, 42 deletions(-)
|
|
|
|
diff --git a/mk-ca-bundle.pl b/mk-ca-bundle.pl
|
|
index 926478f..3732213 100644
|
|
--- a/mk-ca-bundle.pl
|
|
+++ b/mk-ca-bundle.pl
|
|
@@ -552,48 +552,6 @@ while (<TXT>) {
|
|
}
|
|
next;
|
|
}
|
|
- elsif (/^CKA_NSS_SERVER_DISTRUST_AFTER (CK_BBOOL CK_FALSE|MULTILINE_OCTAL)/) {
|
|
- # Example:
|
|
- # CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
|
|
- # \062\060\060\066\061\067\060\060\060\060\060\060\132
|
|
- # END
|
|
- if($1 eq "MULTILINE_OCTAL") {
|
|
- my @timestamp;
|
|
- while (<TXT>) {
|
|
- last if (/^END/);
|
|
- chomp;
|
|
- my @octets = split(/\\/);
|
|
- shift @octets;
|
|
- for (@octets) {
|
|
- push @timestamp, chr(oct);
|
|
- }
|
|
- }
|
|
- scalar(@timestamp) == 13 or die "Failed parsing timestamp";
|
|
- # A trailing Z in the timestamp signifies UTC
|
|
- if($timestamp[12] ne "Z") {
|
|
- report "distrust date stamp is not using UTC";
|
|
- }
|
|
- # Example date: 200617000000Z
|
|
- # Means 2020-06-17 00:00:00 UTC
|
|
- my $distrustat =
|
|
- timegm($timestamp[10] . $timestamp[11], # second
|
|
- $timestamp[8] . $timestamp[9], # minute
|
|
- $timestamp[6] . $timestamp[7], # hour
|
|
- $timestamp[4] . $timestamp[5], # day
|
|
- ($timestamp[2] . $timestamp[3]) - 1, # month
|
|
- "20" . $timestamp[0] . $timestamp[1]); # year
|
|
- if(time >= $distrustat) {
|
|
- # not trusted anymore
|
|
- $skipnum++;
|
|
- report "Skipping: $main_block_name is not trusted anymore" if ($opt_v);
|
|
- $valid = 0;
|
|
- }
|
|
- else {
|
|
- # still trusted
|
|
- }
|
|
- }
|
|
- next;
|
|
- }
|
|
else {
|
|
next;
|
|
}
|
|
--
|
|
2.47.1
|
|
|