Attachment #151211 for bug #196431





PORTNAME=	ca_root_nss
PORTVERSION=	${VERSION_NSS}
PORTREVISION=	2
CATEGORIES=	security
MASTER_SITES=	MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
DISTNAME=	nss-${VERSION_NSS}${NSS_SUFFIX}

MAINTAINER=	gecko@FreeBSD.org
COMMENT=	Root certificate bundle from the Mozilla Project

LICENSE=	MPL

OPTIONS_DEFINE=		ETCSYMLINK
OPTIONS_SUB=		yes

ETCSYMLINK_DESC=	Add symlink to /etc/ssl/cert.pem
ETCSYMLINK_CONFLICTS=	ca-roots-[0-9]*

USES=		perl5
USE_PERL5=	build

# !!!  Please DO NOT submit patches for new version until it has !!!
# !!!  been committed there first.                               !!!
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

VERSION_NSS=	3.17.3
#NSS_SUFFIX=	.with.ckbi.1.93
CERTDATA_TXT_PATH=	nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt
BUNDLE_PROCESSOR=	MAca-bundle.pl

SUB_FILES=	pkg-message MAca-bundle.pl
SUB_LIST=	VERSION_NSS=${VERSION_NSS}

.include <bsd.port.options.mk>

.if ${PORT_OPTIONS:METCSYMLINK}
PLIST_SUB+=	ETCSYMLINK=
CONFLICTS=	ca-roots-[0-9]*
.else
PLIST_SUB+=	ETCSYMLINK="@comment "
.endif

do-extract:
	@${MKDIR} ${WRKDIR}
	@${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \

	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}/etc/ssl/cert.pem
.endif
	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl
	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem.sample
	${MKDIR} ${STAGEDIR}${PREFIX}/openssl
	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/openssl/cert.pem.sample

.include <bsd.port.mk>




********************************* WARNING *********************************

FreeBSD does not, and can not warrant that the certificate authorities
whose certificates are included in this package have in any way been
audited for trustworthiness or RFC 3647 compliance.

Assessment and verification of trust is the complete responsibility of the
system administrator.

*********************************** NOTE **********************************

This package installs symlinks to support root certificates discovery by
default for software that uses OpenSSL.

This enables SSL Certificate Verification by client software without manual
intervention.

If you prefer to do this manually, replace the following symlinks with
either an empty file or your site-local certificate bundle.

  * /etc/ssl/cert.pem
  * %%PREFIX%%/etc/ssl/cert.pem
  * %%PREFIX%%/openssl/cert.pem

***************************************************************************

Lines 1-3 Link Here

(-)pkg-plist (-1 / +2 lines)
1	%%CERTDIR%%/ca-root-nss.crt	1	%%CERTDIR%%/ca-root-nss.crt
2	etc/ssl/cert.pem	2	@sample etc/ssl/cert.pem.sample
		3	@sample openssl/cert.pem.sample
3	%%ETCSYMLINK%%/etc/ssl/cert.pem	4	%%ETCSYMLINK%%/etc/ssl/cert.pem

Return to bug 196431

Lines 2-17 Link Here

(-)Makefile (-12 / +14 lines)
2		2
3	PORTNAME= ca_root_nss	3	PORTNAME= ca_root_nss
4	PORTVERSION= ${VERSION_NSS}	4	PORTVERSION= ${VERSION_NSS}
5	PORTREVISION= 1	5	PORTREVISION= 2
6	CATEGORIES= security	6	CATEGORIES= security
7	MASTER_SITES= MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src	7	MASTER_SITES= MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
8	DISTNAME= nss-${VERSION_NSS}${NSS_SUFFIX}	8	DISTNAME= nss-${VERSION_NSS}${NSS_SUFFIX}
9		9
10	MAINTAINER= gecko@FreeBSD.org	10	MAINTAINER= gecko@FreeBSD.org
11	COMMENT= The root certificate bundle from the Mozilla Project	11	COMMENT= Root certificate bundle from the Mozilla Project
12		12
13	OPTIONS_DEFINE= ETCSYMLINK	13	LICENSE= MPL
		14
		15	OPTIONS_DEFINE= ETCSYMLINK
		16	OPTIONS_SUB= yes
		17
14	ETCSYMLINK_DESC= Add symlink to /etc/ssl/cert.pem	18	ETCSYMLINK_DESC= Add symlink to /etc/ssl/cert.pem
		19	ETCSYMLINK_CONFLICTS= ca-roots-[0-9]*
15		20
16	USES= perl5	21	USES= perl5
17	USE_PERL5= build	22	USE_PERL5= build
Lines 26-47 Link Here
26	# !!! Please DO NOT submit patches for new version until it has !!!	31	# !!! Please DO NOT submit patches for new version until it has !!!
27	# !!! been committed there first. !!!	32	# !!! been committed there first. !!!
28	# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!	33	# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
		34
29	VERSION_NSS= 3.17.3	35	VERSION_NSS= 3.17.3
30	#NSS_SUFFIX= .with.ckbi.1.93	36	#NSS_SUFFIX= .with.ckbi.1.93
31	CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt	37	CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt
32	BUNDLE_PROCESSOR= MAca-bundle.pl	38	BUNDLE_PROCESSOR= MAca-bundle.pl
33	SUB_FILES= MAca-bundle.pl	39
		40	SUB_FILES= pkg-message MAca-bundle.pl
34	SUB_LIST= VERSION_NSS=${VERSION_NSS}	41	SUB_LIST= VERSION_NSS=${VERSION_NSS}
35		42
36	.include <bsd.port.options.mk>	43	.include <bsd.port.options.mk>
37		44
38	.if ${PORT_OPTIONS:METCSYMLINK}
39	PLIST_SUB+= ETCSYMLINK=
40	CONFLICTS= ca-roots-[0-9]*
41	.else
42	PLIST_SUB+= ETCSYMLINK="@comment "
43	.endif
44
45	do-extract:	45	do-extract:
46	@${MKDIR} ${WRKDIR}	46	@${MKDIR} ${WRKDIR}
47	@${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \	47	@${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \
Lines 64-69 Link Here
64	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}/etc/ssl/cert.pem	64	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}/etc/ssl/cert.pem
65	.endif	65	.endif
66	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl	66	${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl
67	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem	67	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem.sample
		68	${MKDIR} ${STAGEDIR}${PREFIX}/openssl
		69	${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/openssl/cert.pem.sample
68		70
69	.include <bsd.port.mk>	71	.include <bsd.port.mk>

Line 0 Link Here

(-)files/pkg-message.in (+25 lines)
	1	******************************* WARNING *******************************
	2
	3	FreeBSD does not, and can not warrant that the certificate authorities
	4	whose certificates are included in this package have in any way been
	5	audited for trustworthiness or RFC 3647 compliance.
	6
	7	Assessment and verification of trust is the complete responsibility of the
	8	system administrator.
	9
	10	********************************* NOTE ********************************
	11
	12	This package installs symlinks to support root certificates discovery by
	13	default for software that uses OpenSSL.
	14
	15	This enables SSL Certificate Verification by client software without manual
	16	intervention.
	17
	18	If you prefer to do this manually, replace the following symlinks with
	19	either an empty file or your site-local certificate bundle.
	20
	21	* /etc/ssl/cert.pem
	22	* %%PREFIX%%/etc/ssl/cert.pem
	23	* %%PREFIX%%/openssl/cert.pem
	24
	25	***************************************************************************