9f5c8bd430
The impetus for this change was that wget fails to load pages signed by Let's Encrypt due to missing root certs. This version has the updated and correct certs. 0002-mozilla-certdata2pem.py-Fix-compat-with-cryptography.patch Patch dropped because the fix is incorporated upstream. Signed-off-by: Steve Hay <me@stevenhay.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
61 lines
2.1 KiB
Diff
61 lines
2.1 KiB
Diff
From a4e468a2a0afa80df174831c2f422184820bb0fa Mon Sep 17 00:00:00 2001
|
|
From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
Date: Thu, 6 Jan 2022 23:15:00 +0100
|
|
Subject: [PATCH] mozilla/certdata2pem.py: make cryptography module optional
|
|
|
|
The Python cryptography module is only used to verify if trusted
|
|
certificates have expired, but this is only a warning. For some build
|
|
systems and distributions, providing Python cryptography is costly,
|
|
especially since it's now partly written in Rust.
|
|
|
|
As the check is only a warning, it's anyway going to be overlooked by
|
|
most people. This commit changes the check to be optional: if the
|
|
cryptography Python module is there, we perform the check, otherwise
|
|
the check is skipped.
|
|
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
[Steve: refreshed to apply on ca-certificates version 20230311]
|
|
Signed-off-by: Steve Hay <me@stevenhay.com>
|
|
---
|
|
mozilla/certdata2pem.py | 17 ++++++++++-------
|
|
1 file changed, 10 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
|
|
index 4df86a2..3a6d7dc 100644
|
|
--- a/mozilla/certdata2pem.py
|
|
+++ b/mozilla/certdata2pem.py
|
|
@@ -28,8 +28,6 @@ import sys
|
|
import textwrap
|
|
import io
|
|
|
|
-from cryptography import x509
|
|
-
|
|
|
|
objects = []
|
|
|
|
@@ -122,11 +120,16 @@ for obj in objects:
|
|
if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
|
|
continue
|
|
|
|
- cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
|
|
- if cert.not_valid_after < datetime.datetime.utcnow():
|
|
- print('!'*74)
|
|
- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
|
|
- print('!'*74)
|
|
+ try:
|
|
+ from cryptography import x509
|
|
+
|
|
+ cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
|
|
+ if cert.not_valid_after < datetime.datetime.utcnow():
|
|
+ print('!'*74)
|
|
+ print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
|
|
+ print('!'*74)
|
|
+ except ImportError:
|
|
+ pass
|
|
|
|
bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
|
|
.replace(' ', '_')\
|
|
--
|
|
2.30.2
|
|
|