Sync from SUSE:SLFO:Main ca-certificates-mozilla revision f79b2006864f2d60904a7830b442b56b

ca-certificates-mozilla-prebuilt.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package ca-certificates-mozilla-prebuilt
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed

ca-certificates-mozilla.changes

@@ -1,3 +1,28 @@
+-------------------------------------------------------------------
+Tue Feb  4 09:55:01 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- remove extensive signature printing in comments of the cert
+  bundle
+
+-------------------------------------------------------------------
+Thu Jan 23 08:23:15 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Define two macros to break a build cycle with p11-kit.
+
+-------------------------------------------------------------------
+Sun Dec 15 21:07:58 UTC 2024 - Dirk Müller <dmueller@suse.com>
+
+- Updated to 2.72 state of Mozilla SSL root CAs (bsc#1234798)
+  Removed:
+  - SecureSign RootCA11
+  - Security Communication RootCA3
+  Added:
+  - TWCA CYBER Root CA
+  - TWCA Global Root CA G2
+  - SecureSign Root CA12
+  - SecureSign Root CA14
+  - SecureSign Root CA15
+
 -------------------------------------------------------------------
 Mon Jul  8 15:19:02 UTC 2024 - Marcus Meissner <meissner@suse.com>
 

ca-certificates-mozilla.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package ca-certificates-mozilla
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -33,11 +33,14 @@
 %endif
 %endif
 #
+# Taken from p11-kit, to avoid a build cycle
+%define pkidir_static    %{_datadir}/pki
+%define trustdir_static  %{pkidir_static}/trust
 %define certdir %{trustdir_static}
 Name:           ca-certificates-mozilla
 # Version number is NSS_BUILTINS_LIBRARY_VERSION in this file:
 # http://hg.mozilla.org/projects/nss/file/default/lib/ckfw/builtins/nssckbi.h
-Version:        2.68
+Version:        2.72
 Release:        0
 Summary:        CA certificates for OpenSSL
 License:        MPL-2.0
@@ -61,7 +64,6 @@ Source11:       %{name}.COPYING
 Source12:       compareoldnew
 BuildRequires:  ca-certificates
 BuildRequires:  openssl
-BuildRequires:  p11-kit-devel
 BuildRequires:  python3-base
 # for update-ca-certificates
 Requires(post): ca-certificates

certdata2pem.py

@@ -280,7 +280,7 @@ for tobj in objects:
             # obtain certificate information suitable as a comment
             comment_fname = "comment-" + fname
             fcout = open(comment_fname, "w")
-            comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text"]
+            comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text", "-certopt", "no_pubkey,no_sigdump"]
             subprocess.call(comment_command, stdout=fcout)
             fcout.close()
             sed_command = ["sed", "--in-place", "s/^/#/", comment_fname]

nssckbi.h

@@ -46,8 +46,8 @@
  * It's recommend to switch back to 0 after having reached version 98/99.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 68
-#define NSS_BUILTINS_LIBRARY_VERSION "2.68"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 72
+#define NSS_BUILTINS_LIBRARY_VERSION "2.72"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1