### this file is sourced not run
PKGVER=2024.06
PKGBUILD=1
PKGARCH=noarch

TARBALL=
MD5SUM=
SRC_URL=
BUNDLE=

SLACKREQ= # make-ca built-time only
SLACKDESC="lfs-cacert: lfs-cacert $PKGVER (CA Certificates)  
lfs-cacert:  
lfs-cacert: These are Certificate Authority (CA) certificates build from 
lfs-cacert: Mozilla collections. Used in conjunction with SSL/TLS and other 
lfs-cacert: crypto-protected programs, it can be used to confirm whether a 
lfs-cacert: site is what it claims it is.  
lfs-cacert: 
lfs-cacert: 
lfs-cacert: 
lfs-cacert: 
lfs-cacert:
"
SLACKSUG=make-ca

### prepare
pkg_prepare() {
	: nothing to prepare
}

### default pkg_package

### build
pkg_build() {
	echo "nameserver 9.9.9.9" > /etc/resolv.conf &&
	make-ca -g -f &&
	pkg_build_slackdesc &&
	rm -f /etc/resolv.conf &&

	# compat symlinks
	for p in ca-bundle.crt objsign-ca-bundle.crt email-ca-bundle.crt; do
		ln -s ../pki/tls/certs/$p /etc/ssl/$p
	done &&

	# Remove expired CA
	remove_expired_ca "DST_Root_CA_X3.pem" "Disabled DST Root CA X3" &&
	make-ca -r -f 
}

# $1 - CA filename, $2 - CA Text
remove_expired_ca() {
	local infile=/etc/ssl/certs/"$1"
	local outfile=/etc/ssl/local/"Disabled_$1"
	if [ -e "$infile" ]; then
		openssl x509 -in "$infile" \
			-text                      \
			-fingerprint               \
			-setalias "$2"             \
			-addreject serverAuth      \
			-addreject emailProtection \
			-addreject codeSigning     \
			> "$outfile"
	fi
}
