linux/poky.git/meta/recipes-support/ca-certificates, branch yocto-2.6.2

ca-certificates: upgrade 20180409 -> 20190110

2019-03-24T16:48:38+00:00

(From OE-Core rev: 73ebdcaedde460108f98971f037e50e9b15c9f0c) (From OE-Core rev: 3bcc575367ac2519fc76fbd3d1d7f0223c059b96) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ca-certificates: update to 20180409

2018-09-04T10:03:56+00:00

License-Update: URI fix (From OE-Core rev: 87acc51a7892524a22640bf9eba46c11701365d6) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

ca-certificates: avoid using += with an over-ride

2018-07-06T21:55:02+00:00

Using += with an over-ride can be a source of confusion so try to avoid the construct in core recipes. In this case, the commit which added the over-ride seems to have been buggy - the commit message mentions "add to SYSROOT_DIRS" rather than a correct description of what the change actually did, ie "over-ride SYSROOT_DIRS": http://git.openembedded.org/openembedded-core/commit/?id=355e49e19abb3e729c82a6de46ada8da8a257f58 The commit also appears to have been unnecessary as ${sysconfdir} is appended to SYSROOT_DIRS for -native recipes by default from within staging.bbclass. To workaround the bug introduced by the first commit, a subsequent commit later added ${datadir}/ca-certificates to the over-ride value (which would not normally be necessary as ${datadir} is included in the default value of SYSROOT_DIRS - ie the value which was lost due to being over-ridden): http://git.openembedded.org/openembedded-core/commit/?id=09bb7718d74573be9a5db4d0737fb14126f6489c Therefore the fix seem to be to remove the SYSROOT_DIRS over-ride entirely - the default value of SYSROOT_DIRS set by staging.bbclass includes both ${datadir} and ${sysconfdir} when building for -native. (From OE-Core rev: c1f18efda0280644b4a4ce6f2988fb7ada71faf6) Signed-off-by: Andre McCurdy Signed-off-by: Richard Purdie

ca-certificates: use relative symlinks from $ETCCERTSDIR

2018-03-31T08:48:42+00:00

update-ca-certificates symlinks (trusted) certificates from $CERTSDIR or $LOCALCERTSDIR into $ETCCERTSDIR. update-ca-certificates can call hook scripts installed into /etc/ca-certificates/update.d. Those scripts are passed the pem file in /etc/ssl/certs/ that was added or removed in this run and those pem files are absolute symlinks into $CERTSDIR or $LOCALCERTSDIR at the moment. When running update-ca-certificates during image build time, they thusly all point into the host's file system, not into the $SYSROOT. This means: * the host's file system layout must match the one produced by OE, and * it also means that the host must have installed the same (or more) certificates as the target in $CERTSDIR and $LOCALCERTSDIR This is a problem when wanting to execute hook scripts, because they all need to be taught about $SYSROOT, and behave differently depending on whether they're called at image build time, or on the target, as otherwise they will be trying to actually read the host's certificates from $CERTSDIR or $LOCALCERTSDIR. This also is a problem when running anything else during image build time that depends on the trusted CA certificates. Changing the symlink to be relative solves all of these problems. At the same time, we have to make sure to add $CERTSDIR to SYSROOT_DIRS, so that the symlinks are still valid when somebody DEPENDS on ca-certificates-native. As a side-effect, this also fixes a problem in meta-java, where some recipes (e.g. openjdk-8-native) try to access certificates from $CERTSDIR to generate the java trustStore at build time. Do so. Upstream-Status: Inappropriate [OE-specific] (From OE-Core rev: 09bb7718d74573be9a5db4d0737fb14126f6489c) Signed-off-by: André Draszik Signed-off-by: Richard Purdie

ca-certificates: change SRC_URI from Debian anonscm to salsa

2018-03-28T11:09:52+00:00

Debian anonscm service in Alioth is shutdown and thus fetching ca-certificates sources fails. https://wiki.debian.org/Alioth "Alioth is broken, and there is nobody around to fix it. Don't ask the remaining people who give it life support to implement fixes and changes. It is being replaced by a cocktail of ?GitLab (see Salsa), read-only repos and keep-alive mechanisms. See below for more information." (From OE-Core rev: fc20ff2003cee7ee3b78ba3bc236a60a8caabc35) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ca-certificates: run postinst script only for -target package

2018-03-20T09:59:31+00:00

Nativesdk package has a special arrangement where the same thing is done in do_install(). It was assumed (in the comment) that postinsts don't run when installing nativesdk packages, but this was incorrect: they are run, but any failures were previously silently ignored. Now this missing failure reporting has been fixed, and so we get to see the failures. (From OE-Core rev: 8ebb695c1429f8d57d655072a362a4f176258699) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ca-certificates: Add /etc to SYSROOT_DIRS

2017-11-30T10:49:21+00:00

For recipes that depend on native ca-certificates.crt, /etc should be added to the list of directories that automatically populate the sysroot, otherwise the file may not be there. (From OE-Core rev: 355e49e19abb3e729c82a6de46ada8da8a257f58) Signed-off-by: Patrick Vacek Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ca-certificates: update to 20170717

2017-08-31T22:30:03+00:00

This is actually the same version as previously; upstream didn't have a tag for it before and now it does, so we can reduce confusion. The SRCREV change is due to a few added commits which modify upstream's debian packaging (not used by us). (From OE-Core rev: 8359730165908025b0762eaa25569e2fdcd9d086) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ca-certificates: Fix postinst dependency issues

2017-08-25T11:08:50+00:00

We were relying on running ca-certificates from the -native version. This meant the host and target path layouts had to match which might not be true, it certainly isn't true for the sdk builds. There was a dependency on run-parts which wasn't represented (we can get it from busybox or debianutils). Since this is an allarch script, call the script directly, making sure debianutils and openssl are available as postinst rootfs time to resolve the issues. (From OE-Core rev: d9575e05f2cb8bf293534c036ddc0d0336701256) Signed-off-by: Richard Purdie

ca-certificates: update to 20170717

2017-08-13T08:27:38+00:00

Upstream lacks a tag for this release, so make it a PR bump. (From OE-Core rev: 0b0a716b243491f026cb7b15e8f546325d6fa760) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie