# Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=ca-certificates
pkgver=20161130
pkgrel=2
pkgdesc="Common CA certificates PEM files"
url="http://packages.debian.org/sid/ca-certificates"
arch="all"
license="MPL 2.0 GPL2+"
depends=""
makedepends="python2 libressl-dev"
subpackages="$pkgname-doc"
# c_rehash is either in libcrypto1.0 or openssl depending on package, grr.  replace both of them
replaces="libcrypto1.0 openssl"
options="!fhs"
triggers="ca-certificates.trigger=/usr/share/ca-certificates:/usr/local/share/ca-certificates:/etc/ssl/certs:/etc/ca-certificates/update.d"
install="$pkgname.post-deinstall"
source="http://ftp.no.debian.org/debian/pool/main/c/$pkgname/${pkgname}_${pkgver}.tar.xz
	fix-manpage.patch
	update-ca.c
	c_rehash.c
	"
builddir="$srcdir/$pkgname"

build () {
	cd "$builddir"
	make || return 1

	${CC:-gcc} ${CFLAGS} -o update-ca-certificates "$srcdir"/update-ca.c \
		${LDFLAGS} || return 1
	${CC:-gcc} ${CFLAGS} -o c_rehash "$srcdir"/c_rehash.c -lcrypto \
		${LDFLAGS} || return 1
}

package() {
	cd "$builddir"

	install -d -m755 "$pkgdir"/etc/ca-certificates/update.d \
		"$pkgdir"/usr/bin \
		"$pkgdir"/usr/sbin \
		"$pkgdir"/usr/share/ca-certificates \
		"$pkgdir"/usr/local/share/ca-certificates \
		"$pkgdir"/etc/ssl/certs \
		|| return 1

	make DESTDIR="$pkgdir" install || return 1
	install -D -m644 sbin/update-ca-certificates.8 \
		"$pkgdir"/usr/share/man/man8/update-ca-certificates.8 \
		|| return 1

	(
		echo "# Automatically generated by ${pkgname}-${pkgver}-${pkgrel}"
		echo "# $(date -u)"
		echo "# Do not edit."
		cd "$pkgdir"/usr/share/ca-certificates
		find . -name '*.crt' | sort | cut -b3-
	) > "$pkgdir"/etc/ca-certificates.conf

	# http://bugs.alpinelinux.org/issues/2715
	# http://bugs.alpinelinux.org/issues/2846
	install -m755 update-ca-certificates "$pkgdir"/usr/sbin \
		|| return 1

	install -m755 c_rehash "$pkgdir"/usr/bin \
		|| return 1

	mkdir -p "$pkgdir"/etc/apk/protected_paths.d
	cat > "$pkgdir"/etc/apk/protected_paths.d/ca-certificates.list <<-EOF
		-etc/ssl/certs/ca-certificates.crt
		-etc/ssl/certs/ca-cert-*.pem
		-etc/ssl/certs/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[r0-9]*
	EOF

	cat > "$pkgdir"/etc/ca-certificates/update.d/certhash <<-EOF
		#!/bin/sh
		exec /usr/bin/c_rehash /etc/ssl/certs
	EOF
	chmod +x "$pkgdir"/etc/ca-certificates/update.d/certhash || return 1
}

md5sums="1a0a3a1b3390dc83affed4b0c2ae1c05  ca-certificates_20161130.tar.xz
0c3d9f5d795c7475b997e18498b7aec8  fix-manpage.patch
a6539b875e599cbd4e779983d4a57a14  update-ca.c
2b64084b5d8e01f5b745c4e1f053a899  c_rehash.c"
sha256sums="04bca9e142a90a834aca0311f7ced237368d71fee7bd5c9f68ef7f4611aee471  ca-certificates_20161130.tar.xz
60b36c4881bb367891df038a0736456c2d170496de8c339026671008b1caa09b  fix-manpage.patch
a8e938fdd8e177d78935fc974777c4d375d93b53c0fa82626336cb3869f78e6b  update-ca.c
68f70afada0cd8fc2289102145c11d5d8b6d2421ed4b7624094bcf5dfce7d2f5  c_rehash.c"
sha512sums="8395f27d2369d694b069e1bb250b06df05f732bd9f4a4dc8652091e9c96ad1a84003e28f59cb9e13fdfd22ca5818f495d80149692e74b2d63e34db4f6a95ee9f  ca-certificates_20161130.tar.xz
690d6bb434fb3ccce931d7ee6a167124f9c2d2e7e7a016d85f7b72a5f7f7c34db8c6133f3575e962a91981a32a88f8961776fe5fd907e57f59c03a32f2fcced3  fix-manpage.patch
b3122866eabaccab248142a3a0131c763757da0f851941a28741bf2f9b377e3bcea08efa91865d6bec5b3525398a662054b291dd00cf80ad52ab69c3be30f361  update-ca.c
ce32e104f995818f237c21ec09c4252c3c0e7421a6eabaab9a7a82e6abf66814d412db43d16ff51dee119b824e7418334f6919f621afa75e03a23c31dccacfcc  c_rehash.c"