Page MenuHomeFreeBSD

security/p11-kit: use base system consolidated anchor lists
Needs ReviewPublic

Authored by novel on Wed, Aug 26, 6:05 PM.
Tags
None
Referenced Files
F168474001: D59200.id185161.diff
Fri, Aug 28, 2:04 PM
F168360402: D59200.id185161.diff
Thu, Aug 27, 6:54 PM
F168331120: D59200.id185161.diff
Thu, Aug 27, 3:57 PM
Unknown Object (File)
Thu, Aug 27, 5:57 AM
Unknown Object (File)
Thu, Aug 27, 5:53 AM
Unknown Object (File)
Wed, Aug 26, 6:33 PM
Subscribers

Details

Reviewers
None
Group Reviewers
Ports Committers
Summary

Currently p11-kit already use base-system certificates from /usr/share/certs
(since 8672992ef7f072f87304e953231de77179143f1d 2023-02-01 11:05:18 +0000).

Base system's certctl tool allows administrator to add locally trusted anchors
in /usr/local/share/certs, but p11-kit's current behaviour will ignore them.

I propose using system's consolidated certificates in /etc/ssl/certs and
/etc/ssl/untrusted instead of /usr/share/certs/trusted and
/usr/share/certs/untrusted.

These directories (/etc/ssl/ ones) are managed by system's certctl tool,
and reflects the same content plus admin's managed trusted/untrusted certs.

This change should not break any current behaviour on FreeBSD > 12.2.

This is also coherent with debian's behaviour (on debian, p11_trust_paths
is set to /etc/ssl/certs/ca-certificates.crt, updated by system's
update-ca-certificate which allows custom anchors listed in
/etc/ca-certificates.conf).

PR: 297759

Diff Detail

Repository
R11 FreeBSD ports repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 76191
Build 73074: arc lint + arc unit

Event Timeline

novel requested review of this revision.Wed, Aug 26, 6:05 PM
novel created this revision.

CC @des as well

security/p11-kit/Makefile
53

The untrusted path probably needs to go away entirely, but using /etc instead of /usr/share is a bug-fix IMO.