* [Buildroot] [git commit] package/ca-certificates: remove dependency on host-python-cryptography
@ 2022-01-08 16:51 Arnout Vandecappelle
2022-01-27 7:23 ` Peter Korsgaard
0 siblings, 1 reply; 3+ messages in thread
From: Arnout Vandecappelle @ 2022-01-08 16:51 UTC (permalink / raw)
To: buildroot
commit: https://git.buildroot.net/buildroot/commit/?id=363dd649f31c7e7732f3cd509d43cebbb53e51ce
branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master
The host-python-cryptography module is only used by ca-certificates
for a check of the expiration date of certificates, which is only a
warning not even causing the build to abort, i.e something that
Buildroot users are most likely never going to see.
Since the host-python-cryptography dependency would soon require a
dependency on rust, it's a lot simpler to just patch the
certdata2pem.py script to no longer require cryptography, but only
make use of it if available.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
---
...tdata2pem.py-make-cryptography-module-opt.patch | 59 ++++++++++++++++++++++
package/ca-certificates/ca-certificates.mk | 2 +-
2 files changed, 60 insertions(+), 1 deletion(-)
diff --git a/package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch b/package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch
new file mode 100644
index 0000000000..b76c1bfd7f
--- /dev/null
+++ b/package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch
@@ -0,0 +1,59 @@
+From bf18b564122e8f976681a2398862fde1eafd84ba Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Thu, 6 Jan 2022 23:15:00 +0100
+Subject: [PATCH] mozilla/certdata2pem.py: make cryptography module optional
+
+The Python cryptography module is only used to verify if trusted
+certificates have expired, but this is only a warning. For some build
+systems and distributions, providing Python cryptography is costly,
+especially since it's now partly written in Rust.
+
+As the check is only a warning, it's anyway going to be overlooked by
+most people. This commit changes the check to be optional: if the
+cryptography Python module is there, we perform the check, otherwise
+the check is skipped.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ mozilla/certdata2pem.py | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
+index ede23d4..a6261f8 100644
+--- a/mozilla/certdata2pem.py
++++ b/mozilla/certdata2pem.py
+@@ -28,9 +28,6 @@ import sys
+ import textwrap
+ import io
+
+-from cryptography import x509
+-
+-
+ objects = []
+
+ # Dirty file parser.
+@@ -122,11 +119,16 @@ for obj in objects:
+ if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
+ continue
+
+- cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
+- if cert.not_valid_after < datetime.datetime.now():
+- print('!'*74)
+- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
+- print('!'*74)
++ try:
++ from cryptography import x509
++
++ cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
++ if cert.not_valid_after < datetime.datetime.now():
++ print('!'*74)
++ print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
++ print('!'*74)
++ except ImportError:
++ pass
+
+ bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
+ .replace(' ', '_')\
+--
+2.33.1
+
diff --git a/package/ca-certificates/ca-certificates.mk b/package/ca-certificates/ca-certificates.mk
index 7084ab781e..0b6962ab7b 100644
--- a/package/ca-certificates/ca-certificates.mk
+++ b/package/ca-certificates/ca-certificates.mk
@@ -7,7 +7,7 @@
CA_CERTIFICATES_VERSION = 20211016
CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20211022T144903Z/pool/main/c/ca-certificates
-CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3 host-python-cryptography
+CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
CA_CERTIFICATES_LICENSE = GPL-2.0+ (script), MPL-2.0 (data)
CA_CERTIFICATES_LICENSE_FILES = debian/copyright
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Buildroot] [git commit] package/ca-certificates: remove dependency on host-python-cryptography
2022-01-08 16:51 [Buildroot] [git commit] package/ca-certificates: remove dependency on host-python-cryptography Arnout Vandecappelle
@ 2022-01-27 7:23 ` Peter Korsgaard
2022-01-27 7:39 ` Thomas Petazzoni
0 siblings, 1 reply; 3+ messages in thread
From: Peter Korsgaard @ 2022-01-27 7:23 UTC (permalink / raw)
To: Arnout Vandecappelle, thomas.petazzoni; +Cc: buildroot
>>>>> "Arnout" == Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> writes:
Hi,
> commit: https://git.buildroot.net/buildroot/commit/?id=363dd649f31c7e7732f3cd509d43cebbb53e51ce
> branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/master
> The host-python-cryptography module is only used by ca-certificates
> for a check of the expiration date of certificates, which is only a
> warning not even causing the build to abort, i.e something that
> Buildroot users are most likely never going to see.
> Since the host-python-cryptography dependency would soon require a
> dependency on rust, it's a lot simpler to just patch the
> certdata2pem.py script to no longer require cryptography, but only
> make use of it if available.
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[snip]
> +++ b/package/ca-certificates/ca-certificates.mk
> @@ -7,7 +7,7 @@
> CA_CERTIFICATES_VERSION = 20211016
> CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
> CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20211022T144903Z/pool/main/c/ca-certificates
> -CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3 host-python-cryptography
> +CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
Can we then change to BR2_PYTHON3_HOST_DEPENDENCY instead of
host-python3 now that no extra python modules are used?
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Buildroot] [git commit] package/ca-certificates: remove dependency on host-python-cryptography
2022-01-27 7:23 ` Peter Korsgaard
@ 2022-01-27 7:39 ` Thomas Petazzoni
0 siblings, 0 replies; 3+ messages in thread
From: Thomas Petazzoni @ 2022-01-27 7:39 UTC (permalink / raw)
To: Peter Korsgaard; +Cc: buildroot
On Thu, 27 Jan 2022 08:23:04 +0100
Peter Korsgaard <peter@korsgaard.com> wrote:
> > +++ b/package/ca-certificates/ca-certificates.mk
> > @@ -7,7 +7,7 @@
> > CA_CERTIFICATES_VERSION = 20211016
> > CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
> > CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20211022T144903Z/pool/main/c/ca-certificates
> > -CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3 host-python-cryptography
> > +CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
>
> Can we then change to BR2_PYTHON3_HOST_DEPENDENCY instead of
> host-python3 now that no extra python modules are used?
Good point. I would say that yes, probably we could do that.
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-01-27 7:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-08 16:51 [Buildroot] [git commit] package/ca-certificates: remove dependency on host-python-cryptography Arnout Vandecappelle
2022-01-27 7:23 ` Peter Korsgaard
2022-01-27 7:39 ` Thomas Petazzoni
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.