Until now, the untrusted directory has been maintained manually. Modify
the script used to maintain the trusted directory so it can handle both.
While here, clean it up a bit.
Details
Details
- Reviewers
mandree allanjude markj - Group Reviewers
security - Commits
- rGb88b0bb784c7: caroot: Generate both trusted and untrusted
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Skipped - Unit
Tests Skipped - Build Status
Buildable 66508 Build 63391: arc lint + arc unit
Event Timeline
| secure/caroot/MAca-bundle.pl | ||
|---|---|---|
| 140 | Isn't the key supposed to be $cka_label."\0".$serial? | |
| secure/caroot/MAca-bundle.pl | ||
|---|---|---|
| 140 | It is. I don't know how it got turned around. Than you for catching that. | |
| secure/caroot/MAca-bundle.pl | ||
|---|---|---|
| 140 | this in fact explains why untrusted certs were getting dropped... | |
| secure/caroot/MAca-bundle.pl | ||
|---|---|---|
| 62–64 | This seems to lose the "outputdir" option. I understand the semantic change, but it breaks compatibility. | |
| 249–250 | I had added this safety catch after some format change caused us to end up without trusted certs. Do we really want to kill this feature? | |
| secure/caroot/MAca-bundle.pl | ||
|---|---|---|
| 62–64 | This is explained in the commit message. The original script produced only trusted certificates, and the untrusted certificates were maintained manually. This version produces both trusted and untrusted certificates, so the outputdir option is split in two. | |
| 249–250 | I don't see the point. Remember that this is not user-facing or even part of the build. Immediately after running make updatecerts, I'm going to run git status and then either git add if I'm happy with what I see or git checkout if I'm not. | |