update-ca-certificates 2.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182
  1. #!/bin/sh
  2. #
  3. # update-ca-certificates script for embedded systems.
  4. #
  5. # Copyright (C) 2009 Phil Sutter <phil@nwl.cc>
  6. #
  7. # This program is free software; you can redistribute it and/or modify
  8. # it under the terms of the GNU General Public License as published by
  9. # the Free Software Foundation; either version 2 of the License, or
  10. # (at your option) any later version.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program; if not, write to the Free Software
  19. # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  20. CRTCONF=/etc/ca-certificates.conf
  21. CRTDIR=/usr/share/ca-certificates
  22. LNKDIR=/etc/ssl/certs
  23. OPENSSL="openssl"
  24. cert_type() { # (certfile)
  25. grep -qE '^-----BEGIN (X509 |TRUSTED |)CERTIFICATE-----' $1 && {
  26. echo "cert"
  27. return 0
  28. }
  29. grep -qE '^-----BEGIN X509 CRL-----' $1 && {
  30. echo "crl"
  31. return 0
  32. }
  33. echo "unknown"
  34. return 1
  35. }
  36. ${OPENSSL} version >/dev/null 2>&1 || {
  37. echo "Fatal: no openssl executable found, bailing out"
  38. exit 1
  39. }
  40. for l in $(ls ${DESTDIR}${LNKDIR}/* 2>/dev/null); do
  41. [ -L "$l" ] && rm -f "$l"
  42. done
  43. cat ${DESTDIR}$CRTCONF | while read crt; do
  44. [ -n "$crt" ] || continue
  45. [[ "$crt" = -* ]] && continue
  46. cname="$(basename $crt)"
  47. ln -s ${CRTDIR}/$crt ${DESTDIR}${LNKDIR}/$cname
  48. ctype="$(cert_type ${DESTDIR}${CRTDIR}/$crt)"
  49. case $ctype in
  50. cert)
  51. sslcmd="x509"
  52. pfx=""
  53. ;;
  54. crl)
  55. sslcmd="crl"
  56. pfx="r"
  57. ;;
  58. *)
  59. echo "Warning: ignoring unknown filetype ${DESTDIR}${CRTDIR}/$crt"
  60. continue
  61. ;;
  62. esac
  63. hsh="$(${OPENSSL} $sslcmd -hash -noout -in ${DESTDIR}${CRTDIR}/$crt)"
  64. idx=0
  65. while [ -e ${DESTDIR}${LNKDIR}/${hsh}.${pfx}${idx} ]; do
  66. let "idx++"
  67. done
  68. ln -s ${CRTDIR}/$crt ${DESTDIR}${LNKDIR}/${hsh}.${pfx}${idx}
  69. done
  70. cat /etc/ssl/certs/*.0 > /etc/ssl/cert.pem
  71. exit 0