[Bug 283932] www/p5-Tiny-HTTP: uses security/ca_root_nss but certctl is useless

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=283932

            Bug ID: 283932
           Summary: www/p5-Tiny-HTTP: uses security/ca_root_nss but
                    certctl is useless
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: Individual Port(s)
          Assignee: ports-secteam@FreeBSD.org
          Reporter: dvl@FreeBSD.org
             Flags: maintainer-feedback?(ports-secteam@FreeBSD.org)
          Assignee: ports-secteam@FreeBSD.org

One of the goals of certctl is to manage trusted certificates, in our case a
private CA we use in-house.

Using cerctl, tools which use OpenSSL succeed, tools which do not fail. I'm
opening this PR in the hopes of improving those which do not.

Case in point, p5-Tiny-HTTP will use the first file it finds in this list (from
https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/blob/master/lib/HTTP/Tiny.pm#L1667):

   foreach my $ca_bundle (
        "/etc/ssl/certs/ca-certificates.crt",     # Debian/Ubuntu/Gentoo etc.
        "/etc/pki/tls/certs/ca-bundle.crt",       # Fedora/RHEL
        "/etc/ssl/ca-bundle.pem",                 # OpenSUSE
        "/etc/openssl/certs/ca-certificates.crt", # NetBSD
        "/etc/ssl/cert.pem",                      # OpenBSD
        "/usr/local/share/certs/ca-root-nss.crt", # FreeBSD/DragonFly
        "/etc/pki/tls/cacert.pem",                # OpenELEC
        "/etc/certs/ca-certificates.crt",         # Solaris 11.2+
    ) {
        return ( SSL_ca_file => $ca_bundle ) if -e $ca_bundle;
    }

Based on the above, the first item Tiny::HTTP will find on FreeBSD is the
"OpenBSD" file:

$ ls -l /etc/ssl/cert.pem
-rw-r--r--  1 root  wheel  748902 Apr 18  2024 /etc/ssl/cert.pem
$ pkg which /etc/ssl/cert.pem
/etc/ssl/cert.pem was installed by package ca_root_nss-3.93_2

It will ignore what's in /etc/ssl/certs which is where certctl puts the private
CA for us. OpenSSL users will find and honor the private CA, but not Tiny::HTTP
orders.

I do have a patch which "fixes" Tiny::HTTP at the expense of mangling
security/ca_root_nss

$ git diff
diff --git a/security/ca_root_nss/Makefile b/security/ca_root_nss/Makefile
index ce23fe17c535..75c02ef56968 100644
--- a/security/ca_root_nss/Makefile
+++ b/security/ca_root_nss/Makefile
@@ -39,6 +39,7 @@ do-build:
                ${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \
            < ${WRKSRC}/${CERTDATA_TXT_PATH} > \
            ${WRKDIR}/ca-root-nss.crt
+       cat ${FILESDIR}/our-ca.pem >> ${WRKDIR}/ca-root-nss.crt

 do-install:
        ${MKDIR} ${STAGEDIR}${PREFIX}/${CERTDIR}
$ 

Where our-ca.pem is our private CA

-- 
You are receiving this mail because:
You are the assignee for the bug.