Commit: bdbcbde41da8e59f8edd4f3430adea87b26fec6d - LFScripts (git)

Commit MetaInfo

• Revision: bdbcbde41da8e59f8edd4f3430adea87b26fec6d (tree)
• Time: 2012-02-26 19:08:47
• Author: matsuand <matsuand@user...>
• Commiter: matsuand

Log Message

Added cacerts.sh, git.sh.

Change Summary

• add: BLFS/cacerts.sh
• add: BLFS/git.sh

Incremental Difference

--- /dev/null
+++ b/BLFS/cacerts.sh
@@ -0,0 +1,270 @@
+#!/bin/sh
+
+TARGET=cacerts
+TARGETDIR=$TARGET
+
+. ./_blfsset.sh
+
+echo Check Required...
+./_checkRequired.sh openssl || exit 1
+if test "$1" == "check"; then
+  exit 0
+fi
+
+if test "$1" == "check"; then
+  exit 0
+fi
+
+cd $SRC
+
+echo $TARGET
+
+echo \ \ Removing old directory...
+rm -fr $TARGETDIR
+
+echo \ \ Creating directory
+mkdir -pv $TARGETDIR
+
+cd $TARGETDIR
+
+cat > /bin/make-cert.pl << "EOF"
+#!/usr/bin/perl -w
+
+# Used to generate PEM encoded files from Mozilla certdata.txt.
+# Run as ./mkcrt.pl > certificate.crt
+#
+# Parts of this script courtesy of RedHat (mkcabundle.pl)
+#
+# This script modified for use with single file data (tempfile.cer) extracted
+# from certdata.txt, taken from the latest version in the Mozilla NSS source.
+# mozilla/security/nss/lib/ckfw/builtins/certdata.txt
+#
+# Authors: DJ Lucas
+#          Bruce Dubbs
+#
+# Version 20120211
+
+my $certdata = './tempfile.cer';
+
+open( IN, "cat $certdata|" )
+    || die "could not open $certdata";
+
+my $incert = 0;
+
+while ( <IN> ) 
+{
+    if ( /^CKA_VALUE MULTILINE_OCTAL/ ) 
+    {
+        $incert = 1;
+        open( OUT, "|openssl x509 -text -inform DER -fingerprint" )
+            || die "could not pipe to openssl x509";
+    } 
+    
+    elsif ( /^END/ && $incert ) 
+    {
+        close( OUT );
+        $incert = 0;
+        print "\n\n";
+    } 
+    
+    elsif ($incert) 
+    {
+        my @bs = split( /\\/ );
+        foreach my $b (@bs) 
+        {
+            chomp $b;
+            printf( OUT "%c", oct($b) ) unless $b eq '';
+        }
+    }
+}
+EOF
+
+paco -p $TARGET "touch /bin/make-cert.pl"
+chmod +x /bin/make-cert.pl
+
+cat > /bin/make-ca.sh << "EOF"
+#!/bin/bash
+# Begin make-ca.sh
+# Script to populate OpenSSL's CApath from a bundle of PEM formatted CAs
+#
+# The file certdata.txt must exist in the local directory
+# Version number is obtained from the version of the data.
+#
+# Authors: DJ Lucas
+#          Bruce Dubbs
+#
+# Version 20120211
+
+certdata="certdata.txt"
+
+if [ ! -r $certdata ]; then
+  echo "$certdata must be in the local directory"
+  exit 1
+fi
+
+REVISION=$(grep CVS_ID $certdata | cut -f4 -d'$')
+
+if [ -z "${REVISION}" ]; then
+  echo "$certfile has no 'Revision' in CVS_ID"
+  exit 1
+fi
+
+VERSION=$(echo $REVISION | cut -f2 -d" ")
+
+TEMPDIR=$(mktemp -d)
+TRUSTATTRIBUTES="CKA_TRUST_SERVER_AUTH"
+BUNDLE="BLFS-ca-bundle-${VERSION}.crt"
+CONVERTSCRIPT="make-cert.pl"
+SSLDIR="/etc/ssl"
+
+mkdir "${TEMPDIR}/certs"
+
+# Get a list of staring lines for each cert
+CERTBEGINLIST=$(grep -n "^# Certificate" "${certdata}" | cut -d ":" -f1)
+
+# Get a list of ending lines for each cert
+CERTENDLIST=`grep -n "^CKA_TRUST_STEP_UP_APPROVED" "${certdata}" | cut -d ":" -f 1`
+
+# Start a loop
+for certbegin in ${CERTBEGINLIST}; do
+  for certend in ${CERTENDLIST}; do
+    if test "${certend}" -gt "${certbegin}"; then
+      break
+    fi
+  done
+
+  # Dump to a temp file with the name of the file as the beginning line number
+  sed -n "${certbegin},${certend}p" "${certdata}" > "${TEMPDIR}/certs/${certbegin}.tmp"
+done
+
+unset CERTBEGINLIST CERTDATA CERTENDLIST certebegin certend
+
+mkdir -p certs
+rm certs/*      # Make sure the directory is clean
+
+for tempfile in ${TEMPDIR}/certs/*.tmp; do
+  # Make sure that the cert is trusted...
+  grep "CKA_TRUST_SERVER_AUTH" "${tempfile}" | \
+    egrep "TRUST_UNKNOWN|NOT_TRUSTED" > /dev/null
+
+  if test "${?}" = "0"; then
+    # Throw a meaningful error and remove the file
+    cp "${tempfile}" tempfile.cer
+    "${CONVERTSCRIPT}" > tempfile.crt
+    keyhash=$(openssl x509 -noout -in tempfile.crt -hash)
+    echo "Certificate ${keyhash} is not trusted!  Removing..."
+    rm -f tempfile.cer tempfile.crt "${tempfile}"
+    continue
+  fi
+
+  # If execution made it to here in the loop, the temp cert is trusted
+  # Find the cert data and generate a cert file for it
+
+  cp "${tempfile}" tempfile.cer
+  "${CONVERTSCRIPT}" > tempfile.crt
+  keyhash=$(openssl x509 -noout -in tempfile.crt -hash)
+  mv tempfile.crt "certs/${keyhash}.pem"
+  rm -f tempfile.cer "${tempfile}"
+  echo "Created ${keyhash}.pem"
+done
+
+# Remove blacklisted files
+# MD5 Collision Proof of Concept CA
+if test -f certs/8f111d69.pem; then
+  echo "Certificate 8f111d69 is not trusted!  Removing..."
+  rm -f certs/8f111d69.pem
+fi
+
+# Finally, generate the bundle and clean up.
+cat certs/*.pem >  ${BUNDLE}
+rm -r "${TEMPDIR}"
+EOF
+
+paco -p+ $TARGET "touch /bin/make-ca.sh"
+chmod +x /bin/make-ca.sh
+
+cat > /bin/remove-expired-certs.sh << "EOF"
+#!/bin/bash
+# Begin /bin/remove-expired-certs.sh
+#
+# Version 20120211
+
+# Make sure the date is parsed correctly on all systems
+function mydate()
+{
+  local y=$( echo $1 | cut -d" " -f4 )
+  local M=$( echo $1 | cut -d" " -f1 )
+  local d=$( echo $1 | cut -d" " -f2 )
+  local m
+
+  if [ ${d} -lt 10 ]; then d="0${d}"; fi
+
+  case $M in
+    Jan) m="01";;
+    Feb) m="02";;
+    Mar) m="03";;
+    Apr) m="04";;
+    May) m="05";;
+    Jun) m="06";;
+    Jul) m="07";;
+    Aug) m="08";;
+    Sep) m="09";;
+    Oct) m="10";;
+    Nov) m="11";;
+    Dec) m="12";;
+  esac
+
+  certdate="${y}${m}${d}"
+}
+
+OPENSSL=/usr/bin/openssl
+DIR=/etc/ssl/certs
+
+if [ $# -gt 0 ]; then
+  DIR="$1"
+fi
+
+certs=$( find ${DIR} -type f -name "*.pem" -o -name "*.crt" )
+today=$( date +%Y%m%d )
+
+for cert in $certs; do
+  notafter=$( $OPENSSL x509 -enddate -in "${cert}" -noout )
+  date=$( echo ${notafter} |  sed 's/^notAfter=//' )
+  mydate "$date"
+
+  if [ ${certdate} -lt ${today} ]; then
+     echo "${cert} expired on ${certdate}! Removing..."
+     rm -f "${cert}"
+  fi
+done
+EOF
+
+paco -p+ $TARGET "touch /bin/remove-expired-certs.sh"
+chmod +x /bin/remove-expired-certs.sh
+
+certhost='http://mxr.mozilla.org'
+certdir='/mozilla/source/security/nss/lib/ckfw/builtins'
+url="$certhost$certdir/certdata.txt?raw=1"
+
+wget --output-document certdata.txt $url
+unset certhost certdir url 
+make-ca.sh
+remove-expired-certs.sh certs
+
+SSLDIR=/etc/ssl
+
+paco -p+ $TARGET "\
+install -d ${SSLDIR}/certs"
+
+paco -p+ $TARGET "\
+cp -v certs/*.pem ${SSLDIR}/certs"
+
+c_rehash
+
+paco -p+ $TARGET "\
+install BLFS-ca-bundle*.crt ${SSLDIR}/ca-bundle.crt"
+
+unset SSLDIR
+
+rm -r certs BLFS-ca-bundle*
+

--- /dev/null
+++ b/BLFS/git.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+
+. ./_blfsset.sh
+
+VER=1.7.9.2
+TARGET=git-$VER
+TARGETBALL=$TARGET.tar.gz
+TARGETDIR=$TARGET
+
+echo Check Required...
+./_checkRequired.sh openssl expat curl python || exit 1
+if test "$1" == "check"; then
+  exit 0
+fi
+
+if test "$1" == "check"; then
+  exit 0
+fi
+
+cd $SRC
+
+echo $TARGET
+
+echo \ \ Removing old directory...
+rm -fr $TARGETDIR
+
+echo \ \ Extracting...
+tar xf $DLD/$TARGETBALL || (echo Tarball not found && exit 1)
+
+cd $TARGETDIR
+
+echo \ \ Configuring...
+./configure --prefix=/usr     \
+        --sysconfdir=/etc     \
+	--libexecdir=/usr/lib \
+	--with-openssl --with-curl --with-expat \
+	1> $LOG/$TARGET.1_conf.log 2>&1
+
+echo \ \ Making...
+make \
+	1> $LOG/$TARGET.2_make.log 2>&1
+
+echo \ \ Installing...
+paco -p $TARGET 'make install' \
+	1> $LOG/$TARGET.3_install.log 2>&1
+
+echo -n \ \ Pacoing:\   && paco -a1 | grep $TARGET || echo none
+
+echo \ \ Removing directory...
+cd .. && rm -fr $TARGETDIR
+