### this file is sourced not run
PKGVER=1.7
PKGBUILD=1
PKGARCH=noarch

# source: BLFS 9.0 + james
TARBALL=make-ca-$PKGVER.tar.gz
MD5SUM=b79b3c49bfa6982c0147c6a248f8d1e3
SRC_URL=https://github.com/djlucas/make-ca/archive/v$PKGVER.tar.gz
BUNDLE=

SLACKREQ=
SLACKDESC="make-ca: make-ca $PKGVER (LFS tools to make CA certs)
make-ca: 
make-ca: make-ca is a utility to deliver and manage a complete PKI
make-ca: configuration for workstations and servers using only standard Unix
make-ca: utilities and OpenSSL. It will optionally generate keystores for
make-ca: OpenJDK and NSS if already installed, using a Mozilla cacerts.txt or
make-ca: like formatted file.
make-ca: 
make-ca: https://github.com/djlucas/make-ca/
make-ca: 
make-ca: 
"

### standard pkg_download
### standard pkg_prepare
### standard pkg_prepare

### build
pkg_build() {
	cd /tmp/make-ca* &&
	install -dm755 /etc/ssl/local &&
		
	make && make install &&
	pkg_build_slackdesc
}

<< "EOF"

BLFS 9.0 Notes
==============

Configuring make-ca
---

For most users, no additional configuration is necessary, however,
the default certdata.txt file provided by make-ca is obtained from
the mozilla-release branch, and is modified to provide a Mercurial revision.
This will be the correct version for most systems.

There are several other variants of the file available for use that
might be preferred for one reason or another, including the files
shipped with Mozilla products in this book. RedHat and OpenSUSE,
for instance, use the version included in NSS-3.48.

Additional upstream downloads are available at the links included in
/etc/make-ca.conf.dist. Simply copy the file to /etc/make-ca.conf and
edit as appropriate.

About Trust Arguments
---

There are three trust types that are recognized by the make-ca script,
SSL/TLS, S/Mime, and code signing. For OpenSSL, these are
serverAuth, emailProtection, and codeSigning respectively.
If one of the three trust arguments is omitted, the certificate is
neither trusted, nor rejected for that role. Clients that use OpenSSL
or NSS encountering this certificate will present a warning to the user.
Clients using GnuTLS without p11-kit support are not aware of trusted
certificates. To include this CA into the ca-bundle.crt,
email-ca-bundle.crt, or objsign-ca-bundle.crt files (the GnuTLS legacy bundles),
it must have the appropriate trust arguments.

Adding Additional CA Certificates
---

The /etc/ssl/local directory is available to add additional
CA certificates to the system. For instance, you might need to add an
organization or government CA certificate. Files in this directory
must be in the OpenSSL trusted certificate format. To create an OpenSSL
trusted certificate from a regular PEM encoded file, you need to add
trust arguments to the openssl command, and create a new certificate.
For example, using the CAcert roots, if you want to trust both for
all three roles, the following commands will create appropriate
OpenSSL trusted certificates (run as the root user after
Wget-1.20.3 is installed):

wget http://www.cacert.org/certs/root.crt &&
wget http://www.cacert.org/certs/class3.crt &&
openssl x509 -in root.crt -text -fingerprint -setalias "CAcert Class 1 root" \
        -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
        > /etc/ssl/local/CAcert_Class_1_root.pem &&
openssl x509 -in class3.crt -text -fingerprint -setalias "CAcert Class 3 root" \
        -addtrust serverAuth -addtrust emailProtection -addtrust codeSigning \
        > /etc/ssl/local/CAcert_Class_3_root.pem &&
/usr/sbin/make-ca -r -f

Overriding Mozilla Trust
---

Occasionally, there may be instances where you don't agree with
Mozilla's inclusion of a particular certificate authority. If you'd like
to override the default trust of a particular CA, simply create a copy
of the existing certificate in /etc/ssl/local with different trust arguments.
For example, if you'd like to distrust the "Makebelieve_CA_Root" file,
run the following commands:

openssl x509 -in /etc/ssl/certs/Makebelieve_CA_Root.pem \
             -text \
             -fingerprint \
             -setalias "Disabled Makebelieve CA Root" \
             -addreject serverAuth \
             -addreject emailProtection \
             -addreject codeSigning \
       > /etc/ssl/local/Disabled_Makebelieve_CA_Root.pem &&
/usr/sbin/make-ca -r -f

EOF
