freebsd-skq/secure/caroot/Makefile

# $FreeBSD$

CLEANFILES+=	certdata.txt

SUBDIR+=	trusted
SUBDIR+=	blacklisted

.include <bsd.obj.mk>

# To be used by secteam@ to update the trusted certificates
fetchcerts: .PHONY
	fetch --no-sslv3 --no-tlsv1 -o certdata.txt 'https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt'

cleancerts: .PHONY
	@${MAKE} -C ${.CURDIR}/trusted ${.TARGET}

updatecerts: .PHONY cleancerts fetchcerts
	perl ${.CURDIR}/MAca-bundle.pl -i certdata.txt -o ${.CURDIR}/trusted
[1/3] Initial infrastructure for SSL root bundle in base This setup will add the trusted certificates from the Mozilla NSS bundle to base. This commit includes: - CAROOT option to opt out of installation of certs - mtree amendments for final destinations - infrastructure to fetch/update certs, along with instructions A follow-up commit will add a certctl(8) utility to give the user control over trust specifics. Another follow-up commit will actually commit the initial result of updatecerts. This work was done primarily by allanjude@, with minor contributions by myself. No objection from: secteam Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16856 2019-10-02 01:05:29 +00:00			`# $FreeBSD$`

			`CLEANFILES+= certdata.txt`

			`SUBDIR+= trusted`
			`SUBDIR+= blacklisted`

caroot: use bsd.obj.mk, not bsd.prog.mk This directory stages certdata into .OBJDIR and processes it, but does not actually build a prog-shaped object; bsd.obj.mk provides the minimal support that we actually need, an .OBJDIR and descent into subdirs. This is admittedly the nittiest of nits. 2020-01-24 16:43:02 +00:00			`.include <bsd.obj.mk>`
[1/3] Initial infrastructure for SSL root bundle in base This setup will add the trusted certificates from the Mozilla NSS bundle to base. This commit includes: - CAROOT option to opt out of installation of certs - mtree amendments for final destinations - infrastructure to fetch/update certs, along with instructions A follow-up commit will add a certctl(8) utility to give the user control over trust specifics. Another follow-up commit will actually commit the initial result of updatecerts. This work was done primarily by allanjude@, with minor contributions by myself. No objection from: secteam Relnotes: yes Differential Revision: https://reviews.freebsd.org/D16856 2019-10-02 01:05:29 +00:00
			`# To be used by secteam@ to update the trusted certificates`
			`fetchcerts: .PHONY`
			`fetch --no-sslv3 --no-tlsv1 -o certdata.txt 'https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt'`

			`cleancerts: .PHONY`
			`@${MAKE} -C ${.CURDIR}/trusted ${.TARGET}`

			`updatecerts: .PHONY cleancerts fetchcerts`
			`perl ${.CURDIR}/MAca-bundle.pl -i certdata.txt -o ${.CURDIR}/trusted`