Summary:        Certificate Authority certificates
Name:           ca-certificates
Version:        20190521
Release:        1%{?dist}
License:        Custom
# http://anduin.linuxfromscratch.org/BLFS/other/certdata.txt
URL:            http://anduin.linuxfromscratch.org/BLFS/other/
Group:          System Environment/Security
Vendor:         VMware, Inc.
Distribution:   Photon
Source0:        certdata.txt
Requires:       openssl
BuildRequires:  openssl
Requires:       ca-certificates-pki = %{version}-%{release}
Requires(post): /bin/ln
Provides:       ca-certificates-mozilla

%description
The Public Key Inrastructure is used for many security issues in a
Linux system. In order for a certificate to be trusted, it must be
signed by a trusted agent called a Certificate Authority (CA). The
certificates loaded by this section are from the list on the Mozilla
version control system and formats it into a form used by
OpenSSL-1.0.1e. The certificates can also be used by other applications
either directly of indirectly through openssl.

%package pki
Summary:  Certificate Authority certificates (pki tls certs)
Group:    System Environment/Security

%description pki
Certificate Authority certificates (pki tls certs)

%prep -p exit

%build
[ %{builddir} != "/"] && rm -rf %{builddir}/*
install -vdm 755 %{_builddir}/bin/
cp %{SOURCE0} %{_builddir}
#
# make-cert.pl
#
cat > %{_builddir}/bin/make-cert.pl << "EOF"
#!/usr/bin/perl -w
# Used to generate PEM encoded files from Mozilla certdata.txt.
# Run as ./make-cert.pl > certificate.crt
# Parts of this script courtesy of RedHat (mkcabundle.pl)
# This script modified for use with single file data (tempfile.cer) extracted
# from certdata.txt, taken from the latest version in the Mozilla NSS source.
# mozilla/security/nss/lib/ckfw/builtins/certdata.txt
# Authors:  DJ Lucas
#   Bruce Dubbs
# Version 20120211
my $certdata = './tempfile.cer';
open( IN, "cat $certdata|" )
    || die "could not open $certdata";
my $incert = 0;
while ( <IN> )
{
    if ( /^CKA_VALUE MULTILINE_OCTAL/ )
    {
        $incert = 1;
        open( OUT, "|openssl x509 -text -inform DER -fingerprint" )
            || die "could not pipe to openssl x509";
    }
    elsif ( /^END/ && $incert )
    {
        close( OUT );
        $incert = 0;
        print "\n\n";
    }
    elsif ($incert)
    {
        my @bs = split( /\\/ );
        foreach my $b (@bs)
        {
            chomp $b;
            printf( OUT "%c", oct($b) ) unless $b eq '';
        }
    }
}
EOF
#
# make-ca.sh
#
cat > %{_builddir}/bin/make-ca.sh << "EOF"
#!/bin/bash
# Begin make-ca.sh
# Script to populate OpenSSL's CApath from a bundle of PEM formatted CAs
# The file certdata.txt must exist in the local directory
# Version number is obtained from the version of the data.
# Authors: DJ Lucas
#          Bruce Dubbs
# Version 20120211
certdata="certdata.txt"
if [ ! -r $certdata ]; then
  echo "$certdata must be in the local directory"
  exit 1
fi
REVISION=$(grep CVS_ID $certdata | cut -f4 -d'$')
if [ -z "${REVISION}" ]; then
  echo "$certfile has no 'Revision' in CVS_ID"
  exit 1
fi
VERSION=$(echo $REVISION | cut -f2 -d" ")
TEMPDIR=$(mktemp -d)
TRUSTATTRIBUTES="CKA_TRUST_SERVER_AUTH"
BUNDLE="BLFS-ca-bundle-${VERSION}.crt"
CONVERTSCRIPT="bin/make-cert.pl"
SSLDIR="/etc/ssl"
mkdir "${TEMPDIR}/certs"
# Get a list of staring lines for each cert
CERTBEGINLIST=$(grep -n "^# Certificate" "${certdata}" | cut -d ":" -f1)
# Get a list of ending lines for each cert
CERTENDLIST=`grep -n "^CKA_TRUST_STEP_UP_APPROVED" "${certdata}" | cut -d ":" -f 1`
# Start a loop
for certbegin in ${CERTBEGINLIST}; do
  for certend in ${CERTENDLIST}; do
    if test "${certend}" -gt "${certbegin}"; then
      break
    fi
  done
  # Dump to a temp file with the name of the file as the beginning line number
  sed -n "${certbegin},${certend}p" "${certdata}" > "${TEMPDIR}/certs/${certbegin}.tmp"
done
unset CERTBEGINLIST CERTDATA CERTENDLIST certebegin certend
mkdir -p certs
rm certs/*      # Make sure the directory is clean
for tempfile in ${TEMPDIR}/certs/*.tmp; do
  # Make sure that the cert is trusted...
  grep "CKA_TRUST_SERVER_AUTH" "${tempfile}" | \
    egrep "TRUST_UNKNOWN|NOT_TRUSTED" > /dev/null
  if test "${?}" = "0"; then
    # Throw a meaningful error and remove the file
    cp "${tempfile}" tempfile.cer
    perl ${CONVERTSCRIPT} > tempfile.crt
    keyhash=$(openssl x509 -noout -in tempfile.crt -hash)
    echo "Certificate ${keyhash} is not trusted!  Removing..."
    rm -f tempfile.cer tempfile.crt "${tempfile}"
    continue
  fi
  # If execution made it to here in the loop, the temp cert is trusted
  # Find the cert data and generate a cert file for it
  cp "${tempfile}" tempfile.cer
  perl ${CONVERTSCRIPT} > tempfile.crt
  keyhash=$(openssl x509 -noout -in tempfile.crt -hash)
  mv tempfile.crt "certs/${keyhash}.pem"
  rm -f tempfile.cer "${tempfile}"
  echo "Created ${keyhash}.pem"
done
# Remove blacklisted files
# MD5 Collision Proof of Concept CA
if test -f certs/8f111d69.pem; then
  echo "Certificate 8f111d69 is not trusted!  Removing..."
  rm -f certs/8f111d69.pem
fi
# Finally, generate the bundle and clean up.
cat certs/*.pem >  ${BUNDLE}
rm -r "${TEMPDIR}"
EOF
#
# remove-expired-certs.sh\
#
cat > %{_builddir}/bin/remove-expired-certs.sh << "EOF"
#!/bin/bash
# Begin /bin/remove-expired-certs.sh
# Version 20120211
# Make sure the date is parsed correctly on all systems
function mydate()
{
  local y=$( echo $1 | cut -d" " -f4 )
  local M=$( echo $1 | cut -d" " -f1 )
  local d=$( echo $1 | cut -d" " -f2 )
  local m
  if [ ${d} -lt 10 ]; then d="0${d}"; fi
  case $M in
    Jan) m="01";;
    Feb) m="02";;
    Mar) m="03";;
    Apr) m="04";;
    May) m="05";;
    Jun) m="06";;
    Jul) m="07";;
    Aug) m="08";;
    Sep) m="09";;
    Oct) m="10";;
    Nov) m="11";;
    Dec) m="12";;
  esac
  certdate="${y}${m}${d}"
}
OPENSSL=/usr/bin/openssl
DIR=certs
if [ $# -gt 0 ]; then
  DIR="$1"
fi
certs=$( find ${DIR} -type f -name "*.pem" -o -name "*.crt" )
today=$( date +%Y%m%d )
for cert in $certs; do
  notafter=$( $OPENSSL x509 -enddate -in "${cert}" -noout )
  date=$( echo ${notafter} |  sed 's/^notAfter=//' )
  mydate "$date"
  if [ ${certdate} -lt ${today} ]; then
     echo "${cert} expired on ${certdate}! Removing..."
     rm -f "${cert}"
  fi
done
EOF

chmod +x %{_builddir}/bin/make-cert.pl
chmod +x %{_builddir}/bin/make-ca.sh
chmod +x %{_builddir}/bin/remove-expired-certs.sh

printf "making certs\n"
bin/make-ca.sh
printf "Removing expired certs\n"
bin/remove-expired-certs.sh
printf "Build portion completed\n"

sed -i 's|CONVERTSCRIPT="bin/make-cert.pl"|CONVERTSCRIPT="/bin/make-cert.pl"|' bin/make-ca.sh
sed -i 's|DIR=certs|DIR=/etc/ssl/certs|' bin/remove-expired-certs.sh

%install
SSLDIR=/etc/ssl
install -d %{buildroot}/${SSLDIR}/certs
install -d %{buildroot}/etc/pki/tls/certs
cp -v certs/*.pem %{buildroot}/${SSLDIR}/certs
install BLFS-ca-bundle*.crt %{buildroot}/etc/pki/tls/certs/ca-bundle.crt
#ln -sfv ../$(readlink %{buildroot}/${SSLDIR}/ca-bundle.crt) %{buildroot}/${SSLDIR}/certs/ca-certificates.crt
unset SSLDIR

install -Dm644 bin/make-ca.sh %{buildroot}/bin/make-ca.sh
install -Dm644 bin/make-cert.pl %{buildroot}/bin/make-cert.pl
install -Dm644 bin/remove-expired-certs.sh %{buildroot}/bin/remove-expired-certs.sh
%{_fixperms} %{buildroot}/*

%post
cd /etc/ssl/certs;
for file in *.pem; do ln -sf $file `openssl x509 -hash -noout -in $file`.0; done
exit 0

%clean
%files
%defattr(-,root,root)
/etc/ssl/certs/*
/bin/make-ca.sh
/bin/remove-expired-certs.sh
/bin/make-cert.pl

%files pki
%defattr(-,root,root)
/etc/pki/tls/certs/ca-bundle.crt

%changelog
* Wed May 22 2019 Gerrit Photon <photon-checkins@vmware.com> 20190521-1
- Automatic Version Bump
* Tue Sep 25 2018 Ankit Jain <ankitja@vmware.com> 20180919-1
- Updating mozilla certdata.txt to latest revision
* Wed May  3 2017 Bo Gan <ganb@vmware.com> 20170406-3
- Fixed dependency on coreutils
* Fri Apr 14 2017 Alexey Makhalov <amakhalov@vmware.com> 20170406-2
- Added -pki subpackage
* Fri Apr 07 2017 Anish Swaminathan <anishs@vmware.com> 20170406-1
- Updating mozilla certdata.txt to latest revision
* Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 20160109-5
- GA - Bump release of all rpms
* Wed Feb 10 2016 Anish Swaminathan <anishs@vmware.com> 20160109-4
- Add Provides field
* Wed Feb 03 2016 Anish Swaminathan <anishs@vmware.com> 20160109-3
- Force create links for certificates
* Mon Feb 01 2016 Anish Swaminathan <anishs@vmware.com> 20160109-2
- Remove c_rehash dependency
* Wed Jan 13 2016 Divya Thaluru <dthaluru@vmware.com> 20160109-1
- Updating mozilla certdata.txt to latest revision
* Wed Oct 15 2014 Divya Thaluru <dthaluru@vmware.com> 20130524-1
- Initial build.  First version