# Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
# Contributor: William Pitcock <nenolod@dereferenced.org>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=ca-certificates
pkgver=20180924
pkgrel=0
pkgdesc="Common CA certificates PEM files"
url="https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/"
arch="all"
license="MPL-2.0 GPL-2.0-or-later"
depends=""
makedepends="python3 libressl-dev"
subpackages="$pkgname-doc"
# c_rehash is either in libcrypto1.0 or openssl depending on package, grr.  replace both of them
replaces="libcrypto1.0 openssl openssl1.0"
options="!fhs !check"
triggers="ca-certificates.trigger=/usr/share/ca-certificates:/usr/local/share/ca-certificates:/etc/ssl/certs:/etc/ca-certificates/update.d"
install="$pkgname.post-deinstall"
source="https://git.alpinelinux.org/cgit/ca-certificates/snapshot/ca-certificates-$pkgver.tar.bz2
	0001-update-ca-fix-build-with-newer-musl.patch"
builddir="$srcdir/ca-certificates-$pkgver"

build() {
	cd "$builddir"
	make
}

package() {
	cd "$builddir"
	make install DESTDIR="$pkgdir"

	(
		echo "# Automatically generated by ${pkgname}-${pkgver}-${pkgrel}"
		echo "# $(date -u)"
		echo "# Do not edit."
		cd "$pkgdir"/usr/share/ca-certificates
		find . -name '*.crt' | sort | cut -b3-
	) > "$pkgdir"/etc/ca-certificates.conf

	mkdir -p "$pkgdir"/etc/apk/protected_paths.d
	cat > "$pkgdir"/etc/apk/protected_paths.d/ca-certificates.list <<-EOF
		-etc/ssl/certs/ca-certificates.crt
		-etc/ssl/certs/ca-cert-*.pem
		-etc/ssl/certs/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[r0-9]*
	EOF

	cat > "$pkgdir"/etc/ca-certificates/update.d/certhash <<-EOF
		#!/bin/sh
		exec /usr/bin/c_rehash /etc/ssl/certs
	EOF
	chmod +x "$pkgdir"/etc/ca-certificates/update.d/certhash
}

sha512sums="dbcd786a1c8d17132cceac8100ceac3902cd2360ba6773d0a65739da39a932f50e59d830b1060776ba89b778f451ab12bd879971e370a30b21e367951935ed3a  ca-certificates-20180924.tar.bz2
e0b7c0dafb5e9e5ff58c7db7a0c5805617197a549d7af1c117406eeda063aee7806000d686e15536c69e026d00fd3ca68dfc37a7dad839b90e754858ff6096dd  0001-update-ca-fix-build-with-newer-musl.patch"