From 4bbba0604ff23298d109397862c5f88cdec32a2c Mon Sep 17 00:00:00 2001 From: Britney Fransen Date: Tue, 23 Sep 2014 00:49:50 +0000 Subject: nss: update to 3.17-4 --- abs/extra/nss/PKGBUILD | 34 +++-- abs/extra/nss/bundle.sh | 54 +++++++ abs/extra/nss/ca-certificates-mozilla.install | 2 +- abs/extra/nss/certdata2pem.py | 199 ++++++++++++++++++++++++++ abs/extra/nss/certdata2pem.py-loudness.patch | 13 -- 5 files changed, 270 insertions(+), 32 deletions(-) create mode 100644 abs/extra/nss/bundle.sh create mode 100644 abs/extra/nss/certdata2pem.py delete mode 100644 abs/extra/nss/certdata2pem.py-loudness.patch diff --git a/abs/extra/nss/PKGBUILD b/abs/extra/nss/PKGBUILD index d948ba2..7a06cec 100644 --- a/abs/extra/nss/PKGBUILD +++ b/abs/extra/nss/PKGBUILD @@ -4,7 +4,7 @@ pkgbase=nss pkgname=(nss ca-certificates-mozilla) pkgver=3.17 -pkgrel=3 +pkgrel=4 pkgdesc="Mozilla Network Security Services" arch=(i686 x86_64) url="http://www.mozilla.org/projects/security/pki/nss/" @@ -14,21 +14,20 @@ depends=("nspr>=${_nsprver}" 'sqlite' 'zlib' 'sh' 'p11-kit') makedepends=('perl' 'python2') options=('!strip' '!makeflags' 'staticlibs') source=("ftp://ftp.mozilla.org/pub/security/nss/releases/NSS_${pkgver//./_}_RTM/src/${pkgbase}-${pkgver}.tar.gz" - "certdata2pem.py::http://anonscm.debian.org/cgit/collab-maint/ca-certificates.git/plain/mozilla/certdata2pem.py?id=15470c64b5464d273556a290b1e7b50b32a2e5a0" + certdata2pem.py + bundle.sh nss.pc.in nss-config.in - ssl-renegotiate-transitional.patch - certdata2pem.py-loudness.patch) + ssl-renegotiate-transitional.patch) sha256sums=('3b1abcd8f89211dda2cc739bfa76552d080f7ea80482ef2727b006548a7f0c81' - '57bd6f309736825fc0edbf7d522726224764520595dfdddd0dba59158839e863' + 'af13c30801a8a27623948206458432a4cf98061b75ff6e5b5e03912f93c034ee' + '045f520403f715a4cc7f3607b4e2c9bcc88fee5bce58d462fddaa2fdb0e4c180' 'b9f1428ca2305bf30b109507ff335fa00bce5a7ce0434b50acd26ad7c47dd5bd' 'e44ac5095b4d88f24ec7b2e6a9f1581560bd3ad41a3d198596d67ef22f67adb9' - '12df04bccbf674db1eef7a519a28987927b5e9c107b1dc386686f05e64f49a97' - '90f8e72fbcca9ce907dcf6565bcd95ca23d2da5d87caee64c141ac54680f8703') + '12df04bccbf674db1eef7a519a28987927b5e9c107b1dc386686f05e64f49a97') prepare() { mkdir certs - patch --follow-symlinks certdata2pem.py certdata2pem.py-loudness.patch cd nss-$pkgver @@ -40,16 +39,18 @@ prepare() { -i nss/coreconf/rules.mk ln -sr nss/lib/ckfw/builtins/certdata.txt ../certs/ + ln -sr nss/lib/ckfw/builtins/nssckbi.h ../certs/ } build() { cd certs python2 ../certdata2pem.py - printf "mozilla/%s\n" *.crt > mozilla.conf - test -s mozilla.conf - cd ../nss-$pkgver/nss + cd .. + sh bundle.sh + + cd nss-$pkgver/nss export BUILD_OPT=1 export NSS_USE_SYSTEM_SQLITE=1 export NSS_ENABLE_ECC=1 @@ -112,11 +113,8 @@ package_ca-certificates-mozilla() { depends=(ca-certificates-utils) install=ca-certificates-mozilla.install - cd certs - - local _certdir="$pkgdir/usr/share/ca-certificates/mozilla" - install -d "$_certdir" - install -t "$_certdir" -m644 *.crt - - install -Dm644 mozilla.conf "$pkgdir/etc/ca-certificates/conf.d/mozilla.conf" + local _certdir="$pkgdir/usr/share/ca-certificates/trust-source" + install -Dm644 ca-bundle.trust.crt "$_certdir/mozilla.trust.crt" + install -Dm644 ca-bundle.neutral-trust.crt "$_certdir/mozilla.neutral-trust.crt" + install -Dm644 ca-bundle.supplement.p11-kit "$_certdir/mozilla.supplement.p11-kit" } diff --git a/abs/extra/nss/bundle.sh b/abs/extra/nss/bundle.sh new file mode 100644 index 0000000..253e64a --- /dev/null +++ b/abs/extra/nss/bundle.sh @@ -0,0 +1,54 @@ +#!/bin/sh +# From Fedora's ca-certificates.spec + +( + cat < ca-bundle.trust.crt +for f in certs/*.crt; do + echo "processing $f" + tbits=`sed -n '/^# openssl-trust/{s/^.*=//;p;}' $f` + distbits=`sed -n '/^# openssl-distrust/{s/^.*=//;p;}' $f` + alias=`sed -n '/^# alias=/{s/^.*=//;p;q;}' $f | sed "s/'//g" | sed 's/"//g'` + targs="" + if [ -n "$tbits" ]; then + for t in $tbits; do + targs="${targs} -addtrust $t" + done + fi + if [ -n "$distbits" ]; then + for t in $distbits; do + targs="${targs} -addreject $t" + done + fi + if [ -n "$targs" ]; then + echo "trust flags $targs for $f" >> info.trust + openssl x509 -text -in "$f" -trustout $targs -setalias "$alias" >> ca-bundle.trust.crt + else + echo "no trust flags for $f" >> info.notrust + # p11-kit-trust defines empty trust lists as "rejected for all purposes". + # That's why we use the simple file format + # (BEGIN CERTIFICATE, no trust information) + # because p11-kit-trust will treat it as a certificate with neutral trust. + # This means we cannot use the -setalias feature for neutral trust certs. + openssl x509 -text -in "$f" >> ca-bundle.neutral-trust.crt + fi +done + +for p in certs/*.p11-kit; do + cat "$p" >> ca-bundle.supplement.p11-kit +done diff --git a/abs/extra/nss/ca-certificates-mozilla.install b/abs/extra/nss/ca-certificates-mozilla.install index 0edbb0d..433c35a 100644 --- a/abs/extra/nss/ca-certificates-mozilla.install +++ b/abs/extra/nss/ca-certificates-mozilla.install @@ -1,5 +1,5 @@ post_install() { - usr/bin/update-ca-certificates --fresh &>/dev/null + usr/bin/update-ca-trust } post_upgrade() { diff --git a/abs/extra/nss/certdata2pem.py b/abs/extra/nss/certdata2pem.py new file mode 100644 index 0000000..175de1a --- /dev/null +++ b/abs/extra/nss/certdata2pem.py @@ -0,0 +1,199 @@ +#!/usr/bin/python +# vim:set et sw=4: +# +# certdata2pem.py - splits certdata.txt into multiple files +# +# Copyright (C) 2009 Philipp Kern +# Copyright (C) 2013 Kai Engert +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, +# USA. + +import base64 +import os.path +import re +import sys +import textwrap +import urllib + +objects = [] + +def printable_serial(obj): + return ".".join(map(lambda x:str(ord(x)), obj['CKA_SERIAL_NUMBER'])) + +# Dirty file parser. +in_data, in_multiline, in_obj = False, False, False +field, type, value, obj = None, None, None, dict() +for line in open('certdata.txt', 'r'): + # Ignore the file header. + if not in_data: + if line.startswith('BEGINDATA'): + in_data = True + continue + # Ignore comment lines. + if line.startswith('#'): + continue + # Empty lines are significant if we are inside an object. + if in_obj and len(line.strip()) == 0: + objects.append(obj) + obj = dict() + in_obj = False + continue + if len(line.strip()) == 0: + continue + if in_multiline: + if not line.startswith('END'): + if type == 'MULTILINE_OCTAL': + line = line.strip() + for i in re.finditer(r'\\([0-3][0-7][0-7])', line): + value += chr(int(i.group(1), 8)) + else: + value += line + continue + obj[field] = value + in_multiline = False + continue + if line.startswith('CKA_CLASS'): + in_obj = True + line_parts = line.strip().split(' ', 2) + if len(line_parts) > 2: + field, type = line_parts[0:2] + value = ' '.join(line_parts[2:]) + elif len(line_parts) == 2: + field, type = line_parts + value = None + else: + raise NotImplementedError, 'line_parts < 2 not supported.\n' + line + if type == 'MULTILINE_OCTAL': + in_multiline = True + value = "" + continue + obj[field] = value +if len(obj.items()) > 0: + objects.append(obj) + +# Build up trust database. +trustmap = dict() +for obj in objects: + if obj['CKA_CLASS'] != 'CKO_NSS_TRUST': + continue + key = obj['CKA_LABEL'] + printable_serial(obj) + trustmap[key] = obj + print " added trust", key + +# Build up cert database. +certmap = dict() +for obj in objects: + if obj['CKA_CLASS'] != 'CKO_CERTIFICATE': + continue + key = obj['CKA_LABEL'] + printable_serial(obj) + certmap[key] = obj + print " added cert", key + +def obj_to_filename(obj): + label = obj['CKA_LABEL'][1:-1] + label = label.replace('/', '_')\ + .replace(' ', '_')\ + .replace('(', '=')\ + .replace(')', '=')\ + .replace(',', '_') + label = re.sub(r'\\x[0-9a-fA-F]{2}', lambda m:chr(int(m.group(0)[2:], 16)), label) + serial = printable_serial(obj) + return label + ":" + serial + +trust_types = { + "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", + "CKA_TRUST_NON_REPUDIATION": "non-repudiation", + "CKA_TRUST_KEY_ENCIPHERMENT": "key-encipherment", + "CKA_TRUST_DATA_ENCIPHERMENT": "data-encipherment", + "CKA_TRUST_KEY_AGREEMENT": "key-agreement", + "CKA_TRUST_KEY_CERT_SIGN": "cert-sign", + "CKA_TRUST_CRL_SIGN": "crl-sign", + "CKA_TRUST_SERVER_AUTH": "server-auth", + "CKA_TRUST_CLIENT_AUTH": "client-auth", + "CKA_TRUST_CODE_SIGNING": "code-signing", + "CKA_TRUST_EMAIL_PROTECTION": "email-protection", + "CKA_TRUST_IPSEC_END_SYSTEM": "ipsec-end-system", + "CKA_TRUST_IPSEC_TUNNEL": "ipsec-tunnel", + "CKA_TRUST_IPSEC_USER": "ipsec-user", + "CKA_TRUST_TIME_STAMPING": "time-stamping", + "CKA_TRUST_STEP_UP_APPROVED": "step-up-approved", +} + +openssl_trust = { + "CKA_TRUST_SERVER_AUTH": "serverAuth", + "CKA_TRUST_CLIENT_AUTH": "clientAuth", + "CKA_TRUST_CODE_SIGNING": "codeSigning", + "CKA_TRUST_EMAIL_PROTECTION": "emailProtection", +} + +for tobj in objects: + if tobj['CKA_CLASS'] == 'CKO_NSS_TRUST': + key = tobj['CKA_LABEL'] + printable_serial(tobj) + print "producing trust for " + key + trustbits = [] + distrustbits = [] + openssl_trustflags = [] + openssl_distrustflags = [] + for t in trust_types.keys(): + if tobj.has_key(t) and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + trustbits.append(t) + if t in openssl_trust: + openssl_trustflags.append(openssl_trust[t]) + if tobj.has_key(t) and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + distrustbits.append(t) + if t in openssl_trust: + openssl_distrustflags.append(openssl_trust[t]) + + fname = obj_to_filename(tobj) + try: + obj = certmap[key] + except: + obj = None + + if obj != None: + fname += ".crt" + else: + fname += ".p11-kit" + + f = open(fname, 'w') + if obj != None: + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + f.write("# distrust=" + " ".join(distrustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + if openssl_distrustflags: + f.write("# openssl-distrust=" + " ".join(openssl_distrustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + else: + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']); + f.write("\n") + f.write("class: certificate\n") + f.write("certificate-type: x-509\n") + f.write("issuer: \""); + f.write(urllib.quote(tobj['CKA_ISSUER'])); + f.write("\"\n") + f.write("serial-number: \""); + f.write(urllib.quote(tobj['CKA_SERIAL_NUMBER'])); + f.write("\"\n") + if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'): + f.write("x-distrusted: true\n") + f.write("\n\n") + print " -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags) diff --git a/abs/extra/nss/certdata2pem.py-loudness.patch b/abs/extra/nss/certdata2pem.py-loudness.patch deleted file mode 100644 index 5ae0d4c..0000000 --- a/abs/extra/nss/certdata2pem.py-loudness.patch +++ /dev/null @@ -1,13 +0,0 @@ ---- certdata2pem.py 2014-08-24 15:16:24.927192958 +0200 -+++ certdata2pem.py.loudness 2014-08-24 15:17:30.193535402 +0200 -@@ -104,9 +104,7 @@ - trust[obj['CKA_LABEL']] = True - elif obj['CKA_TRUST_SERVER_AUTH'] in ('CKT_NETSCAPE_UNTRUSTED', - 'CKT_NSS_NOT_TRUSTED'): -- print '!'*74 -- print "UNTRUSTED BUT NOT BLACKLISTED CERTIFICATE FOUND: %s" % obj['CKA_LABEL'] -- print '!'*74 -+ print "Certificate %s untrusted, ignoring." % obj['CKA_LABEL'] - else: - print "Ignoring certificate %s. SAUTH=%s, EPROT=%s" % \ - (obj['CKA_LABEL'], obj['CKA_TRUST_SERVER_AUTH'], -- cgit v0.12