git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/blob

   1 From 630736f427c0a1bd0be0b5a2f6d51d63b2c4c9fd Mon Sep 17 00:00:00 2001
   2 From: Alexander Kanavin <alex@linutronix.de>
   3 Date: Mon, 18 Oct 2021 12:05:49 +0200
   4 Subject: [PATCH] Revert "mozilla/certdata2pem.py: print a warning for expired
   5  certificates."
   6
   7 This avoids a dependency on python3-cryptography, and only checks
   8 for expired certs (which is upstream concern, but not ours).
   9
  10 Upstream-Status: Inappropriate [oe-core specific]
  11 Signed-off-by: Alexander Kanavin <alex@linutronix.de>
  12 ---
  13  debian/changelog        |  1 -
  14  debian/control          |  2 +-
  15  mozilla/certdata2pem.py | 11 -----------
  16  3 files changed, 1 insertion(+), 13 deletions(-)
  17
  18 diff --git a/debian/changelog b/debian/changelog
  19 index 52d41ca..bdb2c8a 100644
  20 --- a/debian/changelog
  21 +++ b/debian/changelog
  22 @@ -138,7 +138,6 @@ ca-certificates (20211004) unstable; urgency=low
  23      - "Trustis FPS Root CA"
  24      - "Staat der Nederlanden Root CA - G3"
  25    * Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
  26 -  * mozilla/certdata2pem.py: print a warning for expired certificates.
  27
  28   -- Julien Cristau <jcristau@debian.org>  Thu, 07 Oct 2021 17:12:47 +0200
  29
  30 diff --git a/debian/control b/debian/control
  31 index b5f2ab0..d0e830e 100644
  32 --- a/debian/control
  33 +++ b/debian/control
  34 @@ -3,7 +3,7 @@ Section: misc
  35  Priority: optional
  36  Maintainer: Julien Cristau <jcristau@debian.org>
  37  Build-Depends: debhelper-compat (= 13), po-debconf
  38 -Build-Depends-Indep: python3, openssl, python3-cryptography
  39 +Build-Depends-Indep: python3, openssl
  40  Standards-Version: 4.6.2
  41  Rules-Requires-Root: no
  42  Vcs-Git: https://salsa.debian.org/debian/ca-certificates.git
  43 diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
  44 index 4df86a2..7d796f1 100644
  45 --- a/mozilla/certdata2pem.py
  46 +++ b/mozilla/certdata2pem.py
  47 @@ -21,16 +21,12 @@
  48  # USA.
  49
  50  import base64
  51 -import datetime
  52  import os.path
  53  import re
  54  import sys
  55  import textwrap
  56  import io
  57
  58 -from cryptography import x509
  59 -
  60 -
  61  objects = []
  62
  63  # Dirty file parser.
  64 @@ -121,13 +117,6 @@ for obj in objects:
  65      if obj['CKA_CLASS'] == 'CKO_CERTIFICATE':
  66          if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
  67              continue
  68 -
  69 -        cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
  70 -        if cert.not_valid_after < datetime.datetime.utcnow():
  71 -            print('!'*74)
  72 -            print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
  73 -            print('!'*74)
  74 -
  75          bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
  76                                        .replace(' ', '_')\
  77                                        .replace('(', '=')\