mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
From: Michael Olbrich <m.olbrich@pengutronix.de>
To: ptxdist@pengutronix.de
Subject: Re: [ptxdist] [PATCH 2/2] curl: install root CA certificates option
Date: Thu, 26 Mar 2015 11:06:18 +0100	[thread overview]
Message-ID: <20150326100618.GB13271@pengutronix.de> (raw)
In-Reply-To: <1421409525-13713-2-git-send-email-bth@kamstrup.dk>

On Fri, Jan 16, 2015 at 12:58:45PM +0100, Bruno Thomsen wrote:
> From: Bruno Thomsen <bth@kamstrup.com>
> 
> Install a bundle of X.509 certificates of public Certificate Authorities (CA) in PEM format.
> The bundle is extracted from Mozilla's release tree by a host package called certdata.
> 
> Test case 1:
> openssl s_client -connect www.google.com:443 -CAfile /usr/share/ca-certificates/curl/ca-bundle.crt
> 
> Result:
> Verify return code: 0 (ok)
> 
> Test case 2:
> openssl s_client -connect www.google.com:443
> 
> Result:
> Verify return code: 20 (unable to get local issuer certificate)
> 
> Test case 3:
> curl https://www.google.com
> 
> Result:
> <HTML><HEAD>...
> 
> Test case 4:
> rm /usr/share/ca-certificates/curl/ca-bundle.crt
> curl https://www.google.com
> 
> Result:
> curl: (77) error setting certificate verify locations:
>   CAfile: /usr/share/ca-certificates/curl/ca-bundle.crt
>   CApath: none
> 
> Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
> ---
>  rules/libcurl.in   | 18 ++++++++++++++++--
>  rules/libcurl.make | 23 ++++++++++++++++++++++-
>  2 files changed, 38 insertions(+), 3 deletions(-)
> 
> diff --git a/rules/libcurl.in b/rules/libcurl.in
> index 0ad7fb4..11c3698 100644
> --- a/rules/libcurl.in
> +++ b/rules/libcurl.in
> @@ -5,8 +5,10 @@ menuconfig LIBCURL
>  	prompt "libcurl                       "
>  	select LIBC_RT
>  	select ZLIB
> -	select OPENSSL	if LIBCURL_SSL
> -	select LIBSSH2	if LIBCURL_LIBSSH2
> +	select HOST_SYSTEM_PERL	if LIBCURL_CA_BUNDLE
> +	select HOST_CERTDATA	if LIBCURL_CA_BUNDLE
> +	select OPENSSL		if LIBCURL_SSL
> +	select LIBSSH2		if LIBCURL_LIBSSH2
>  	help
>  	curl is a command line tool for transferring files with URL syntax, supporting
>  	FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS and FILE.
> @@ -20,6 +22,18 @@ if LIBCURL
>  config LIBCURL_CURL
>         bool "install curl program"
>  
> +config LIBCURL_CA_BUNDLE
> +	bool "install root CA certificates"
> +	help
> +	  Bundle of Root CA Certificates.
> +
> +	  This is a bundle of X.509 certificates of public Certificate Authorities (CA).
> +	  These were automatically extracted from Mozilla's root certificates
> +	  file (certdata.txt).
> +
> +	  It contains the certificates in PEM format and therefore
> +	  can be directly used with curl / libcurl / php_curl / strongswan.
> +
>  config LIBCURL_HTTP
>         bool "http"
>         default y
> diff --git a/rules/libcurl.make b/rules/libcurl.make
> index 5babcb0..7f83ca4 100644
> --- a/rules/libcurl.make
> +++ b/rules/libcurl.make
> @@ -62,7 +62,6 @@ LIBCURL_AUTOCONF := \
>  	--without-gssapi \
>  	--without-gnutls \
>  	--without-nss \
> -	--without-ca-bundle \
>  	--without-ca-path \
>  	--without-libidn \
>  	--without-axtls \
> @@ -82,6 +81,25 @@ else
>  LIBCURL_AUTOCONF += --without-ssl
>  endif
>  
> +ifdef PTXCONF_LIBCURL_CA_BUNDLE
> +LIBCURL_AUTOCONF += --with-ca-bundle=/usr/share/ca-certificates/curl/ca-bundle.crt
> +else
> +LIBCURL_AUTOCONF += --without-ca-bundle
> +endif
> +
> +# ----------------------------------------------------------------------------
> +# Compile
> +# ----------------------------------------------------------------------------
> +
> +$(STATEDIR)/libcurl.compile:
> +	@$(call targetinfo)
> +
> +ifdef PTXCONF_LIBCURL_CA_BUNDLE
> +	@cd $(HOST_CERTDATA_DIR)
> +	@$(LIBCURL_DIR)/lib/mk-ca-bundle.pl -i -n -v $(LIBCURL_DIR)/ca-bundle.crt
> +endif

This cannot work:
1. you removed the real compile, so nothing will be built
2. each line is separate, so the 'cd ...' is ignored.
Also, do this in 'install' to avoid referencing  LIBCURL_DIR in targetinstall:

	$(call world/install, LIBCURL)
	@cd $(PTXCONF_SYSROOT_HOST)/share/certdata &&
		$(LIBCURL_DIR)/lib/mk-ca-bundle.pl -i -n -v $(LIBCURL_PKGDIR)/usr/share/ca-certificates/curl/ca-bundle.crt

Untested. You might need to create
$(LIBCURL_PKGDIR)/usr/share/ca-certificates/curl/ first.

> +	@$(call touch)
> +
>  # ----------------------------------------------------------------------------
>  # Target-Install
>  # ----------------------------------------------------------------------------
> @@ -99,6 +117,9 @@ ifdef PTXCONF_LIBCURL_CURL
>  	@$(call install_copy, libcurl, 0, 0, 0755, -, /usr/bin/curl)
>  endif
>  	@$(call install_lib, libcurl, 0, 0, 0644, libcurl)
> +ifdef PTXCONF_LIBCURL_CA_BUNDLE
> +	@$(call install_copy, libcurl, 0, 0, 0444, $(LIBCURL_DIR)/ca-bundle.crt, /usr/share/ca-certificates/curl/ca-bundle.crt)

	@$(call install_copy, libcurl, 0, 0, 0444, -, \
		/usr/share/ca-certificates/curl/ca-bundle.crt)

Michael

> +endif
>  
>  	@$(call install_finish, libcurl)
>  
> -- 
> 1.9.1
> 
> 
> -- 
> ptxdist mailing list
> ptxdist@pengutronix.de
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

-- 
ptxdist mailing list
ptxdist@pengutronix.de

  reply	other threads:[~2015-03-26 10:06 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-01-16 11:58 [ptxdist] [PATCH 1/2] host-certdata: root CA certificate bundle downloader Bruno Thomsen
2015-01-16 11:58 ` [ptxdist] [PATCH 2/2] curl: install root CA certificates option Bruno Thomsen
2015-03-26 10:06   ` Michael Olbrich [this message]
2015-03-18 11:56 ` [ptxdist] [PATCH 1/2] host-certdata: root CA certificate bundle downloader Bruno Thomsen
2015-03-26 10:06   ` Michael Olbrich
2015-03-26 10:00 ` Michael Olbrich

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150326100618.GB13271@pengutronix.de \
    --to=m.olbrich@pengutronix.de \
    --cc=ptxdist@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox