From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
To: James Hilliard <james.hilliard1@gmail.com>,
Buildroot List <buildroot@buildroot.org>
Cc: Martin Bark <martin@barkynet.com>,
Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Subject: [Buildroot] [PATCH 1/7] package/ca-certificates: remove dependency on host-python-cryptography
Date: Fri, 7 Jan 2022 18:13:11 +0100 [thread overview]
Message-ID: <20220107171318.1423075-2-thomas.petazzoni@bootlin.com> (raw)
In-Reply-To: <20220107171318.1423075-1-thomas.petazzoni@bootlin.com>
The host-python-cryptography module is only used by ca-certificates
for a check of the expiration date of certificates, which is only a
warning not even causing the build to abort, i.e something that
Buildroot users are most likely never going to see.
Since the host-python-cryptography dependency would soon require a
dependency on rust, it's a lot simpler to just patch the
certdata2pem.py script to no longer require cryptography, but only
make use of it if available.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
...2pem.py-make-cryptography-module-opt.patch | 59 +++++++++++++++++++
package/ca-certificates/ca-certificates.mk | 2 +-
2 files changed, 60 insertions(+), 1 deletion(-)
create mode 100644 package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch
diff --git a/package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch b/package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch
new file mode 100644
index 0000000000..b76c1bfd7f
--- /dev/null
+++ b/package/ca-certificates/0001-mozilla-certdata2pem.py-make-cryptography-module-opt.patch
@@ -0,0 +1,59 @@
+From bf18b564122e8f976681a2398862fde1eafd84ba Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Thu, 6 Jan 2022 23:15:00 +0100
+Subject: [PATCH] mozilla/certdata2pem.py: make cryptography module optional
+
+The Python cryptography module is only used to verify if trusted
+certificates have expired, but this is only a warning. For some build
+systems and distributions, providing Python cryptography is costly,
+especially since it's now partly written in Rust.
+
+As the check is only a warning, it's anyway going to be overlooked by
+most people. This commit changes the check to be optional: if the
+cryptography Python module is there, we perform the check, otherwise
+the check is skipped.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+---
+ mozilla/certdata2pem.py | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
+index ede23d4..a6261f8 100644
+--- a/mozilla/certdata2pem.py
++++ b/mozilla/certdata2pem.py
+@@ -28,9 +28,6 @@ import sys
+ import textwrap
+ import io
+
+-from cryptography import x509
+-
+-
+ objects = []
+
+ # Dirty file parser.
+@@ -122,11 +119,16 @@ for obj in objects:
+ if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
+ continue
+
+- cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
+- if cert.not_valid_after < datetime.datetime.now():
+- print('!'*74)
+- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
+- print('!'*74)
++ try:
++ from cryptography import x509
++
++ cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
++ if cert.not_valid_after < datetime.datetime.now():
++ print('!'*74)
++ print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
++ print('!'*74)
++ except ImportError:
++ pass
+
+ bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
+ .replace(' ', '_')\
+--
+2.33.1
+
diff --git a/package/ca-certificates/ca-certificates.mk b/package/ca-certificates/ca-certificates.mk
index 7084ab781e..0b6962ab7b 100644
--- a/package/ca-certificates/ca-certificates.mk
+++ b/package/ca-certificates/ca-certificates.mk
@@ -7,7 +7,7 @@
CA_CERTIFICATES_VERSION = 20211016
CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20211022T144903Z/pool/main/c/ca-certificates
-CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3 host-python-cryptography
+CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
CA_CERTIFICATES_LICENSE = GPL-2.0+ (script), MPL-2.0 (data)
CA_CERTIFICATES_LICENSE_FILES = debian/copyright
--
2.33.1
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2022-01-07 17:13 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-07 17:13 [Buildroot] [PATCH 0/7] Bump of python-cryptography and other Rust related fun Thomas Petazzoni
2022-01-07 17:13 ` Thomas Petazzoni [this message]
2022-01-07 17:13 ` [Buildroot] [PATCH 2/7] package/python-cryptography: drop host variant Thomas Petazzoni
2022-01-07 17:13 ` [Buildroot] [PATCH 3/7] package/rustc: fix BR2_PACKAGE_HOST_RUSTC_ARCH for ARMv5 Thomas Petazzoni
2022-01-07 17:57 ` Thomas Petazzoni
2022-01-07 17:13 ` [Buildroot] [PATCH 4/7] package/rustc: fix the riscv64gc architecture handling Thomas Petazzoni
2022-01-08 0:23 ` Alistair Francis
2022-01-07 17:13 ` [Buildroot] [PATCH 5/7] support/download/cargo-post-process: make manifest path configurable Thomas Petazzoni
2022-01-07 17:13 ` [Buildroot] [PATCH 6/7] support/testing/tests: switch python-cryptography related tests to glibc Thomas Petazzoni
2022-01-07 17:13 ` [Buildroot] [PATCH 7/7] DO-NOT-APPLY package/python-cryptography: bump version to 36.0.1 Thomas Petazzoni
2022-01-08 16:52 ` [Buildroot] [PATCH 0/7] Bump of python-cryptography and other Rust related fun Arnout Vandecappelle
2022-01-09 11:16 ` Thomas Petazzoni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220107171318.1423075-2-thomas.petazzoni@bootlin.com \
--to=thomas.petazzoni@bootlin.com \
--cc=buildroot@buildroot.org \
--cc=james.hilliard1@gmail.com \
--cc=martin@barkynet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).