Name	ca-certificates
Description	Common CA certificates PEM files from Mozilla
Version	20250911-r0
Package Base	ca-certificates
Homepage	https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/
Maintainers	['Natanael Copa <ncopa@alpinelinux.org>']
Contributors	['Sören Tempel <soeren+alpine@soeren-tempel.net>']
Distro-repo	https://gitlab.alpinelinux.org/alpine/aports/-/tree/3.22-stable/main/ca-certificates
Sources	['https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/20250911-r0/ca-certificates-20250911-r0.tar.bz2']
Dependencies	['/bin/sh', 'libc.musl-x86_64.so.1', 'libcrypto.so.3']
Optional-Dependencies	[]
Build-Dependencies	[]
Provides	['cmd:c_rehash=20250911-r0', 'cmd:update-ca-certificates=20250911-r0']
Builddate	02-10-2025 17:39:11
Architecture	x86_64
Distro-Version	v3.22
Licenses	['MPL-2.0 AND MIT']
Hash	Q1BJBcjtDeI5JufxUXkfsXUD5uvxY=

# Contributor: Sören Tempel <soeren+alpine@soeren-tempel.net>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=ca-certificates
pkgver=20250911
pkgrel=0
pkgdesc="Common CA certificates PEM files from Mozilla"
url="https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/"
arch="all"
# There is a GPL-2.0-or-later script inside the source but it is not shipped
license="MPL-2.0 AND MIT"
makedepends_build="perl"
makedepends_host="openssl-dev>3"
subpackages="$pkgname-doc $pkgname-bundle::noarch"
replaces="openssl"
options="!fhs !check"
triggers="ca-certificates.trigger=/usr/share/ca-certificates:/usr/local/share/ca-certificates:/etc/ssl/certs:/etc/ca-certificates/update.d"
install="$pkgname.post-deinstall"
source="https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/$pkgver/ca-certificates-$pkgver.tar.bz2
	"

build() {
	make
}

package() {
	make install DESTDIR="$pkgdir"

	(
		echo "# Automatically generated by $pkgname-$pkgver-r$pkgrel"
		echo "# $(date -ud@$SOURCE_DATE_EPOCH)"
		echo "#"
		cd "$pkgdir"/usr/share/ca-certificates
		find . -name '*.crt' | sort | cut -b3-
	) > "$pkgdir"/etc/ca-certificates.conf

	# generate the bundle in similar way as update-ca-certificates would do
	find -- *.crt | sort | while read -r i; do
		cat "$i"
		printf "\n"
	done > "$pkgdir"/etc/ssl/certs/ca-certificates.crt

	mkdir -p "$pkgdir"/etc/apk/protected_paths.d
	cat > "$pkgdir"/etc/apk/protected_paths.d/ca-certificates.list <<-EOF
		-etc/ssl/certs/ca-certificates.crt
		-etc/ssl/certs/ca-cert-*.pem
		-etc/ssl/certs/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[r0-9]*
	EOF

	cat > "$pkgdir"/etc/ca-certificates/update.d/certhash <<-EOF
		#!/bin/sh
		exec /usr/bin/c_rehash /etc/ssl/certs
	EOF
	chmod +x "$pkgdir"/etc/ca-certificates/update.d/certhash
}

bundle() {
	pkgdesc="Pre generated bundle of Mozilla certificates"
	replaces="libressl2.7-libcrypto libcrypto1.1"
	provides="$pkgname-cacert=$pkgver-r$pkgrel"
	mkdir -p "$subpkgdir"/etc/ssl/certs
	mv "$pkgdir"/etc/ssl/certs/ca-certificates.crt \
		"$subpkgdir"/etc/ssl/certs/
	ln -s certs/ca-certificates.crt \
		"$subpkgdir"/etc/ssl/cert.pem

	# Symlinks for OpenSSL 1.1 compatibility
	mkdir -p "$subpkgdir"/etc/ssl1.1/
	ln -s /etc/ssl/certs "$subpkgdir"/etc/ssl1.1/
	ln -s /etc/ssl/cert.pem "$subpkgdir"/etc/ssl1.1/
}

sha512sums="
38bad06d33b85e20c2939b9699800b7fccabe2275120ca93fee4ef04f723b69646ad20180fb85f2cc9a7b73c5ef7e3d12c5551479634b05bfaed6d130db36073  ca-certificates-20250911.tar.bz2
"