From nobody Tue Aug 01 21:06:41 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RFnjR3XXXz4prMb; Tue, 1 Aug 2023 21:06:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RFnjF6G73z3Lwv; Tue, 1 Aug 2023 21:06:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1690924002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BGRhHKYDhaCjMZ5k0XwbCByr3fYPhheANOYcq+i/kf4=; b=cepKhTk7GouMnfwfMj2H0hmQsU0ZluY+e9f9qYEgZqRtNYO8PeaYpjiXsJ/zDb9/W8Sgwk zBRFTj5uUhrou7CRj177ncsAU6JTz8obfFJd3lnzANvPQYDHody8e2CCF9R66pNbm5qTDD st8mpUZkdI9rIFQzQKpC/WSq1NU9hYbqe85MmLiERx/aSQO9EJ2h3i1gRquCxTFj/4ZFwt ARfl7l49kKfFrOGKFbYLi3aLBwQ5CapeZFb9bf5vp3FvSHUezMMoT3C4okypQUos5DDwTb S8l49cnxQZ1NacfW7zyvUaxxbym+8eZgKSn0vwlC7ranAJ4GXY4PacEpAAUJNA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1690924002; a=rsa-sha256; cv=none; b=m0Cvs65nyYr+ylO29/iEtvqsuNWNiuHnFBrogC7iO9mDZ/XjnImRMPgiz9+6D+A2NcGIDK 5cI+Ob3hGUeABfZsBeFnh/uNQp5E4SIT4z2SYsy44DAvhIU1nXghbr7IpWNhrSy7IGTUc1 MxlJWl0cy9kGpqEls+5YnFNQmbwgWkBpFwBObNTGhdIDHw91USYchyL8lB5iIBzQbYB6CG jpiW8RXioTeB/h9ECO53Hpzpm4NngJixzswYaba57UXgVr5iFvaW+2p0N3mweZjd5n6cMw k8y9Dujv9eadTuEtVgjtCfhwxFkyY37DNA487Au3hM2pCqH3zhZJb5LmMWlRcw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1690924002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BGRhHKYDhaCjMZ5k0XwbCByr3fYPhheANOYcq+i/kf4=; b=cqb0RbsQUuAmyIyuoAhuqjf9Wq1X/pRUX2D2RZRRvZdbH0WiWCmyf7wFQLmKhYPrHiw1Hl 6RERMR7kEcsXfw6Xtpxip2cLDRDOUgNgMXOZW9Cg8x81fzHH/HmMIjcXA8FaAlGU3KdPEP xCzw9LVbF0931FqCOJM+V7OQoEQA1CXRip7gsuNF868OhVWk5v05XFkhf++5K/UG+8Tv/L djruGxqq1v6M6GUP2V8eEkfwdf+oi+aPlgJ1eUY8FIwkbU79pmXXEaGps4x2fEnQ/vKABk ofShZsESIQ9f84qBBb8g5Uck1sUGlmlAviTysGx6pR4rLQ77ojKgdhPDzrYYmQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RFnjF3Fm1zsjq; Tue, 1 Aug 2023 21:06:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 371L6fDr013718; Tue, 1 Aug 2023 21:06:41 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 371L6fMv013717; Tue, 1 Aug 2023 21:06:41 GMT (envelope-from git) Date: Tue, 1 Aug 2023 21:06:41 GMT Message-Id: <202308012106.371L6fMv013717@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jessica Clarke Subject: git: 5f4efa6c9a0e - stable/13 - certctl: Introduce a new -d option List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jrtc27 X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 5f4efa6c9a0e02bcc50a5cbff52868ceb5958fe7 Auto-Submitted: auto-generated The branch stable/13 has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=5f4efa6c9a0e02bcc50a5cbff52868ceb5958fe7 commit 5f4efa6c9a0e02bcc50a5cbff52868ceb5958fe7 Author: Jessica Clarke AuthorDate: 2022-07-14 00:23:42 +0000 Commit: Jessica Clarke CommitDate: 2023-08-01 20:42:50 +0000 certctl: Introduce a new -d option This will be used by Makefile.inc1 to fix -DNO_ROOT distributeworld, which needs to split out DESTDIR from DISTBASE so the METALOG file includes the base/ prefix. Reviewed by: kevans Obtained from: CheriBSD MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D35808 (cherry picked from commit 232cf6be4bc493412f1c8b80a4cdc00fe53075c6) --- usr.sbin/certctl/certctl.8 | 19 ++++++++++++------- usr.sbin/certctl/certctl.sh | 14 ++++++++------ 2 files changed, 20 insertions(+), 13 deletions(-) diff --git a/usr.sbin/certctl/certctl.8 b/usr.sbin/certctl/certctl.8 index 4387745462f9..6eff3b910bbe 100644 --- a/usr.sbin/certctl/certctl.8 +++ b/usr.sbin/certctl/certctl.8 @@ -26,7 +26,7 @@ .\" .\" $FreeBSD$ .\" -.Dd January 7, 2021 +.Dd July 13, 2022 .Dt CERTCTL 8 .Os .Sh NAME @@ -60,6 +60,8 @@ Flags: .Bl -tag -width 4n .It Fl D Ar destdir Specify the DESTDIR (overriding values from the environment). +.It Fl d Ar distbase +Specify the DISTBASE (overriding values from the environment). .It Fl M Ar metalog Specify the path of the METALOG file (default: $DESTDIR/METALOG). .It Fl n @@ -96,24 +98,27 @@ Remove the specified file from the blacklist. .Bl -tag -width BLACKLISTDESTDIR .It Ev DESTDIR Alternate destination directory to operate on. +.It Ev DISTBASE +Additional path component to include when operating on certificate directories. .It Ev TRUSTPATH List of paths to search for trusted certificates. Default: -.Pa /usr/share/certs/trusted -.Pa /usr/local/share/certs /usr/local/etc/ssl/certs +.Pa /usr/share/certs/trusted +.Pa /usr/local/share/certs +.Pa /usr/local/etc/ssl/certs .It Ev BLACKLISTPATH List of paths to search for blacklisted certificates. Default: -.Pa /usr/share/certs/blacklisted -.Pa /usr/local/etc/ssl/blacklisted +.Pa /usr/share/certs/blacklisted +.Pa /usr/local/etc/ssl/blacklisted .It Ev CERTDESTDIR Destination directory for symbolic links to trusted certificates. Default: -.Pa /etc/ssl/certs +.Pa /etc/ssl/certs .It Ev BLACKLISTDESTDIR Destination directory for symbolic links to blacklisted certificates. Default: -.Pa /etc/ssl/blacklisted +.Pa /etc/ssl/blacklisted .It Ev EXTENSIONS List of file extensions to read as certificate files. Default: *.pem *.crt *.cer *.crl *.0 diff --git a/usr.sbin/certctl/certctl.sh b/usr.sbin/certctl/certctl.sh index fb966df95c55..1324ca00d6f3 100755 --- a/usr.sbin/certctl/certctl.sh +++ b/usr.sbin/certctl/certctl.sh @@ -30,6 +30,7 @@ ############################################################ CONFIGURATION : ${DESTDIR:=} +: ${DISTBASE:=} : ${FILEPAT:="\.pem$|\.crt$|\.cer$|\.crl$"} : ${VERBOSE:=0} @@ -254,7 +255,7 @@ usage() echo " List trusted certificates" echo " $SCRIPTNAME [-v] blacklisted" echo " List blacklisted certificates" - echo " $SCRIPTNAME [-nUv] [-D ] [-M ] rehash" + echo " $SCRIPTNAME [-nUv] [-D ] [-d ] [-M ] rehash" echo " Generate hash links for all certificates" echo " $SCRIPTNAME [-nv] blacklist " echo " Add to the list of blacklisted certificates" @@ -265,9 +266,10 @@ usage() ############################################################ MAIN -while getopts D:M:nUv flag; do +while getopts D:d:M:nUv flag; do case "$flag" in D) DESTDIR=${OPTARG} ;; + d) DISTBASE=${OPTARG} ;; M) METALOG=${OPTARG} ;; n) NOOP=1 ;; U) UNPRIV=1 ;; @@ -280,10 +282,10 @@ shift $(( $OPTIND - 1 )) INSTALLFLAGS= [ $UNPRIV -eq 1 ] && INSTALLFLAGS="-U -M ${METALOG} -D ${DESTDIR}" : ${LOCALBASE:=$(sysctl -n user.localbase)} -: ${TRUSTPATH:=${DESTDIR}/usr/share/certs/trusted:${DESTDIR}${LOCALBASE}/share/certs:${DESTDIR}${LOCALBASE}/etc/ssl/certs} -: ${BLACKLISTPATH:=${DESTDIR}/usr/share/certs/blacklisted:${DESTDIR}${LOCALBASE}/etc/ssl/blacklisted} -: ${CERTDESTDIR:=${DESTDIR}/etc/ssl/certs} -: ${BLACKLISTDESTDIR:=${DESTDIR}/etc/ssl/blacklisted} +: ${TRUSTPATH:=${DESTDIR}${DISTBASE}/usr/share/certs/trusted:${DESTDIR}${LOCALBASE}/share/certs:${DESTDIR}${LOCALBASE}/etc/ssl/certs} +: ${BLACKLISTPATH:=${DESTDIR}${DISTBASE}/usr/share/certs/blacklisted:${DESTDIR}${LOCALBASE}/etc/ssl/blacklisted} +: ${CERTDESTDIR:=${DESTDIR}${DISTBASE}/etc/ssl/certs} +: ${BLACKLISTDESTDIR:=${DESTDIR}${DISTBASE}/etc/ssl/blacklisted} [ $# -gt 0 ] || usage case "$1" in