Change Details

This is a work in progress. Currently, only the rehash command is implemented. Notable changes include: - We no longer forget manually untrusted certificates when rehashing. - When not running in unprivileged mode, rehash will construct an entire new /etc/ssl and then swap out the old one, instead of deleting it before generating the new one. This means it will fail gracefully, and although the double rename is not atomic, the window in which we are left without a trust store is much shorter. - We no longer attempt to link to the original files. - We now generate a trust bundle in addition to the hashed diretory. - The C version is approximately two orders of magnitude faster than the sh version, with rehash taking ~100 ms vs ~5-25 s depending on whether ca_root_nss is installed.

This is a work in progress. Currently, only the rehash, list, and untrusted commands are implemented. Notable changes include: - We no longer forget manually untrusted certificates when rehashing. - When not running in unprivileged mode, rehash will construct an entire new /etc/ssl and then swap out the old one, instead of deleting it before generating the new one. This means it will fail gracefully, and although the double rename is not atomic, the window in which we are left without a trust store is much shorter. - We no longer attempt to link to the original files. - We now generate a trust bundle in addition to the hashed diretory. - The C version is approximately two orders of magnitude faster than the sh version, with rehash taking ~100 ms vs ~5-25 s depending on whether ca_root_nss is installed.

This is a work in progress. Currently, only the rehash command is, list, and untrusted commands are implemented. Notable changes include: - We no longer forget manually untrusted certificates when rehashing. - When not running in unprivileged mode, rehash will construct an entire new /etc/ssl and then swap out the old one, instead of deleting it before generating the new one. This means it will fail gracefully, and although the double rename is not atomic, the window in which we are left without a trust store is much shorter. - We no longer attempt to link to the original files. - We now generate a trust bundle in addition to the hashed diretory. - The C version is approximately two orders of magnitude faster than the sh version, with rehash taking ~100 ms vs ~5-25 s depending on whether ca_root_nss is installed.