src/secure, branch releng/12.2 FreeBSD source tree Root certificate bundle update. 2021-11-03T20:35:48+00:00 Gordon Tetlow gordon@FreeBSD.org 2021-11-03T20:34:51+00:00 a8c4f99a6723ec7a9de6830c47f650ba2f978f31 Approved by: so Security: EN-21:27.caroot 
Approved by:	so
Security:	EN-21:27.caroot
Fix OpenSSL 1.1.1e API functions not being exported. 2021-08-24T17:27:05+00:00 Gordon Tetlow gordon@FreeBSD.org 2021-08-24T17:27:05+00:00 01819b58294a6d39b606d17a970f4a9fa5f73df8 Approved by: so Security: EN-21:24.libcrypto 
Approved by:	so
Security:	EN-21:24.libcrypto
MFC r368555: caroot: update bundle 2021-02-24T01:42:01+00:00 Kyle Evans kevans@FreeBSD.org 2020-12-15T21:50:05+00:00 efc9549ba0c2caffd45e1f7f88fdd75a0225e568 Summary: - One (1) added - Ten (10) removed Approved by: so Security: FreeBSD-EN-21:07.caroot (cherry picked from commit e4e8ecaf63ba6f2767680a7b4666461243d88749) 
Summary:
- One (1) added
- Ten (10) removed

Approved by:	so
Security:	FreeBSD-EN-21:07.caroot

(cherry picked from commit e4e8ecaf63ba6f2767680a7b4666461243d88749)
MFS: r366176 2020-09-25T22:43:14+00:00 Jung-uk Kim jkim@FreeBSD.org 2020-09-25T22:43:14+00:00 7fc1f569abf7c799c6334297ee020a01b5d3d71e Merge OpenSSL 1.1.1h. Approved by: re (gjb) 
Merge OpenSSL 1.1.1h.

Approved by:	re (gjb)
MFS r365986: caroot: update base store 2020-09-23T17:42:19+00:00 Kyle Evans kevans@FreeBSD.org 2020-09-23T17:42:19+00:00 370e97a40767c5a1dc09e78e406d9f05ebde6d94 Count: - Two (2) removed - Three (3) added Approved by: re (gjb) 
Count:
- Two (2) removed
- Three (3) added

Approved by:	re (gjb)
MFC r365248: caroot: properly remove old distrusted roots 2020-09-05T02:22:07+00:00 Kyle Evans kevans@FreeBSD.org 2020-09-05T02:22:07+00:00 eab694ead88a85134a6ab464eb5c7364e4c46dc1 The proper procedure was not followed in r364943; all of these that were deleted should have instead been moved over to the blacklist so that certctl can DTRT. Users must still `certctl rehash` after this, but this should generally be done by one of mergemaster/etcupdate/freebsd-update/pkgbase already; note that freebsd-update doesn't come into play for this particular update, as these have not yet made it into a release. Future work (after svn -> git) will likely change the script that updatecert invokes to facilitate the process, rather than trusting that kevans or whomever updates in the future will remember. 
The proper procedure was not followed in r364943; all of these that were
deleted should have instead been moved over to the blacklist so that certctl
can DTRT.

Users must still `certctl rehash` after this, but this should generally be
done by one of mergemaster/etcupdate/freebsd-update/pkgbase already; note
that freebsd-update doesn't come into play for this particular update, as
these have not yet made it into a release.

Future work (after svn -> git) will likely change the script that updatecert
invokes to facilitate the process, rather than trusting that kevans or
whomever updates in the future will remember.
MFC r364943: carrot: update bundle 2020-09-02T01:35:45+00:00 Kyle Evans kevans@FreeBSD.org 2020-09-02T01:35:45+00:00 f8ba83fb0ea9a57e63cb4cd403006f00f8885f8d Stats: - Seven (7) removed - Four (4) added 
Stats:
- Seven (7) removed
- Four (4) added
MFC: r364822, r364823 2020-08-29T18:11:37+00:00 Jung-uk Kim jkim@FreeBSD.org 2020-08-29T18:11:37+00:00 557f58c53e44939879356e247a70e288ad806512 Fix Clang version detection and regen X86 assembly files. 
Fix Clang version detection and regen X86 assembly files.
MFC r364600: caroot: switch to using echo+shell glob to enumerate certs 2020-08-26T00:50:27+00:00 Kyle Evans kevans@FreeBSD.org 2020-08-26T00:50:27+00:00 34f9e604294e0d500f2b040e65c1b5d2f6b0c2aa This solves an issue on stable/12 that causes certs to not get installed. ls is apparently not in PATH during installworld, so TRUSTED_CERTS ends up blank and nothing gets installed. We don't really require anything ls-specific, though, so let's just simplify it. 
This solves an issue on stable/12 that causes certs to not get installed.
ls is apparently not in PATH during installworld, so TRUSTED_CERTS ends up
blank and nothing gets installed. We don't really require anything
ls-specific, though, so let's just simplify it.
MFC r353095, r355376: add root bundle 2020-04-27T21:41:00+00:00 Kyle Evans kevans@FreeBSD.org 2020-04-27T21:41:00+00:00 d2771738e488759c015086cd6775509e48c396be r353095: caroot: commit initial bundle Interested users can blacklist any/all of these with certctl(8), examples: - mv /usr/share/certs/trusted/... /usr/share/certs/blacklisted/...; \ certctl rehash - certctl blacklist /usr/share/certs/trusted/*; \ certctl rehash Certs can be easily examined after installation with `certctl list`, and certctl blacklist will accept the hashed filename as output by list or as seen in /etc/ssl/certs r355376: caroot update to latest tip: one (1) addition, none (0) removed Added: - Entrust Root Certification Authority - G4 Relnotes: yes, please 
r353095:
caroot: commit initial bundle

Interested users can blacklist any/all of these with certctl(8), examples:

- mv /usr/share/certs/trusted/... /usr/share/certs/blacklisted/...; \
    certctl rehash
- certctl blacklist /usr/share/certs/trusted/*; \
    certctl rehash

Certs can be easily examined after installation with `certctl list`, and
certctl blacklist will accept the hashed filename as output by list or as
seen in /etc/ssl/certs

r355376:
caroot update to latest tip: one (1) addition, none (0) removed

Added:
- Entrust Root Certification Authority - G4

Relnotes:	yes, please