security/ca-certificates: Update to 20211016

ca-certificates (20211016) unstable; urgency=low

  [ Michael Shuler ]
  * Fix error on install when TEMPBUNDLE missing. Closes: #996005

 -- Julien Cristau <jcristau@debian.org>  Sat, 16 Oct 2021 18:09:43 +0200

ca-certificates (20211004) unstable; urgency=low

  [ Debian Janitor ]
  * Fix day-of-week for changelog entry 20090624.

  [ Julien Cristau ]
  * Create temporary ca-certificates.crt on the same file system.
    Closes: #923784
  * Don't remove ca-certificates.crt before updating it, so it doesn't
    go missing for a short while (closes: #920348).  Thanks, Dimitris
    Aragiorgis!
  * Bump package priority from optional to standard.
  * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority
    bundle to version 2.50
    The following certificate authorities were added (+):
    + "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
    + "GlobalSign Root R46"
    + "GlobalSign Root E46"
    + "GLOBALTRUST 2020"
    + "ANF Secure Server Root CA"
    + "Certum EC-384 CA"
    + "Certum Trusted Root CA"
    The following certificate authorities were removed (-):
    - "QuoVadis Root CA"
    - "Sonera Class 2 Root CA"
    - "GeoTrust Primary Certification Authority - G2"
    - "VeriSign Universal Root Certification Authority"
    - "Chambers of Commerce Root - 2008"
    - "Global Chambersign Root - 2008"
    - "Trustis FPS Root CA"
    - "Staat der Nederlanden Root CA - G3"
  * Blacklist expired root certificate "DST Root CA X3" (closes: #995432)
  * mozilla/certdata2pem.py: print a warning for expired certificates.

 -- Julien Cristau <jcristau@debian.org>  Thu, 07 Oct 2021 17:12:47 +0200

ca-certificates (20210119) unstable; urgency=medium

  [ Julien Cristau ]
  * New maintainer (closes: #976406)
  * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority
    bundle to version 2.46.
    The following certificate authorities were added (+):
    + "certSIGN ROOT CA G2"
    + "e-Szigno Root CA 2017"
    + "Microsoft ECC Root Certificate Authority 2017"
    + "Microsoft RSA Root Certificate Authority 2017"
    + "NAVER Global Root Certification Authority"
    + "Trustwave Global Certification Authority"
    + "Trustwave Global ECC P256 Certification Authority"
    + "Trustwave Global ECC P384 Certification Authority"
    The following certificate authorities were removed (-):
    - "EE Certification Centre Root CA"
    - "GeoTrust Universal CA 2"
    - "LuxTrust Global Root 2"
    - "OISTE WISeKey Global Root GA CA"
    - "Staat der Nederlanden Root CA - G2" (closes: #962079)
    - "Taiwan GRCA"
    - "Verisign Class 3 Public Primary Certification Authority - G3"

  [ Michael Shuler ]
  * mozilla/blacklist:
    Revert Symantec CA blacklist (#911289). Closes: #962596
    The following root certificates were added back (+):
    + "GeoTrust Primary Certification Authority - G2"
    + "VeriSign Universal Root Certification Authority"

  [ Gianfranco Costamagna ]
  * debian/{rules,control}:
    Merge Ubuntu patch from Matthias Klose to use Python3 during build.
    Closes: #942915

 -- Julien Cristau <jcristau@debian.org>  Tue, 19 Jan 2021 11:11:04 +0100

3 files changed, 24 insertions, 22 deletions

diff --git a/security/ca-certificates/Makefile b/security/ca-certificates/Makefile
index dfb192b905e..30be19699d0 100644
--- a/security/ca-certificates/Makefile
+++ b/security/ca-certificates/Makefile
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.3 2020/10/12 21:52:30 kim Exp $
+# $NetBSD: Makefile,v 1.4 2022/02/28 05:48:44 kim Exp $
 
-PKGNAME=	ca-certificates-20200601
-PKGREVISION=	1
+PKGNAME=	ca-certificates-20211016
 DISTNAME=	${PKGNAME_NOREV:C/-([^-]*)$/_\1/}
 CATEGORIES=	security
 MASTER_SITES=	http://deb.debian.org/debian/pool/main/c/ca-certificates/
@@ -15,6 +14,8 @@ LICENSE=	gnu-gpl-v2 AND mpl-2.0
 NO_CONFIGURE=		yes
 PYTHON_FOR_BUILD_ONLY=	yes
 
+BUILD_DEPENDS+=	${PYPKGPREFIX}-cryptography-[0-9]*:../../security/py-cryptography
+
 USE_TOOLS=	echo:run find:run ln:run openssl:run rm:run sed:run sort:run wc:run
 
 WRKSRC=		${WRKDIR}/${PKGNAME_NOREV}
diff --git a/security/ca-certificates/PLIST b/security/ca-certificates/PLIST
index 348015a37da..7af927be6b5 100644
--- a/security/ca-certificates/PLIST
+++ b/security/ca-certificates/PLIST
@@ -1,8 +1,10 @@
-@comment $NetBSD: PLIST,v 1.3 2020/10/12 21:52:30 kim Exp $
+@comment $NetBSD: PLIST,v 1.4 2022/02/28 05:48:44 kim Exp $
 man/man8/update-ca-certificates.8
 sbin/update-ca-certificates
 share/ca-certificates/mozilla/ACCVRAIZ1.crt
 share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt
+share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt
+share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt
 share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt
 share/ca-certificates/mozilla/AffirmTrust_Commercial.crt
 share/ca-certificates/mozilla/AffirmTrust_Networking.crt
@@ -24,14 +26,14 @@ share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt
 share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt
 share/ca-certificates/mozilla/Certigna.crt
 share/ca-certificates/mozilla/Certigna_Root_CA.crt
+share/ca-certificates/mozilla/Certum_EC-384_CA.crt
 share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt
 share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt
-share/ca-certificates/mozilla/Chambers_of_Commerce_Root_-_2008.crt
+share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt
 share/ca-certificates/mozilla/Comodo_AAA_Services_root.crt
 share/ca-certificates/mozilla/Cybertrust_Global_Root.crt
 share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt
 share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt
-share/ca-certificates/mozilla/DST_Root_CA_X3.crt
 share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt
 share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt
 share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt
@@ -42,25 +44,25 @@ share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt
 share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt
 share/ca-certificates/mozilla/E-Tugra_Certification_Authority.crt
 share/ca-certificates/mozilla/EC-ACC.crt
-share/ca-certificates/mozilla/EE_Certification_Centre_Root_CA.crt
 share/ca-certificates/mozilla/Entrust.net_Premium_2048_Secure_Server_CA.crt
 share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt
 share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt
 share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt
 share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G4.crt
 share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt
+share/ca-certificates/mozilla/GLOBALTRUST_2020.crt
 share/ca-certificates/mozilla/GTS_Root_R1.crt
 share/ca-certificates/mozilla/GTS_Root_R2.crt
 share/ca-certificates/mozilla/GTS_Root_R3.crt
 share/ca-certificates/mozilla/GTS_Root_R4.crt
-share/ca-certificates/mozilla/GeoTrust_Universal_CA_2.crt
 share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt
 share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt
 share/ca-certificates/mozilla/GlobalSign_Root_CA.crt
 share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R2.crt
 share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt
 share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt
-share/ca-certificates/mozilla/Global_Chambersign_Root_-_2008.crt
+share/ca-certificates/mozilla/GlobalSign_Root_E46.crt
+share/ca-certificates/mozilla/GlobalSign_Root_R46.crt
 share/ca-certificates/mozilla/Go_Daddy_Class_2_CA.crt
 share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt
 share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt
@@ -72,14 +74,14 @@ share/ca-certificates/mozilla/ISRG_Root_X1.crt
 share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt
 share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt
 share/ca-certificates/mozilla/Izenpe.com.crt
-share/ca-certificates/mozilla/LuxTrust_Global_Root_2.crt
 share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt
+share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt
+share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt
+share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt
 share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt
 share/ca-certificates/mozilla/Network_Solutions_Certificate_Authority.crt
-share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GA_CA.crt
 share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt
 share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt
-share/ca-certificates/mozilla/QuoVadis_Root_CA.crt
 share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt
 share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt
 share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt
@@ -95,10 +97,7 @@ share/ca-certificates/mozilla/SecureTrust_CA.crt
 share/ca-certificates/mozilla/Secure_Global_CA.crt
 share/ca-certificates/mozilla/Security_Communication_RootCA2.crt
 share/ca-certificates/mozilla/Security_Communication_Root_CA.crt
-share/ca-certificates/mozilla/Sonera_Class_2_Root_CA.crt
 share/ca-certificates/mozilla/Staat_der_Nederlanden_EV_Root_CA.crt
-share/ca-certificates/mozilla/Staat_der_Nederlanden_Root_CA_-_G2.crt
-share/ca-certificates/mozilla/Staat_der_Nederlanden_Root_CA_-_G3.crt
 share/ca-certificates/mozilla/Starfield_Class_2_CA.crt
 share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt
 share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt
@@ -109,19 +108,21 @@ share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt
 share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt
 share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt
 share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt
-share/ca-certificates/mozilla/Taiwan_GRCA.crt
 share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt
 share/ca-certificates/mozilla/TrustCor_ECA-1.crt
 share/ca-certificates/mozilla/TrustCor_RootCert_CA-1.crt
 share/ca-certificates/mozilla/TrustCor_RootCert_CA-2.crt
-share/ca-certificates/mozilla/Trustis_FPS_Root_CA.crt
+share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt
+share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt
+share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt
 share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt
 share/ca-certificates/mozilla/UCA_Global_G2_Root.crt
 share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt
 share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt
-share/ca-certificates/mozilla/Verisign_Class_3_Public_Primary_Certification_Authority_-_G3.crt
 share/ca-certificates/mozilla/XRamp_Global_CA_Root.crt
 share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt
+share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt
+share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt
 share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt
 share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt
 share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt
diff --git a/security/ca-certificates/distinfo b/security/ca-certificates/distinfo
index 14f32d2385e..f200da28007 100644
--- a/security/ca-certificates/distinfo
+++ b/security/ca-certificates/distinfo
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.4 2021/10/26 11:17:01 nia Exp $
+$NetBSD: distinfo,v 1.5 2022/02/28 05:48:44 kim Exp $
 
-BLAKE2s (ca-certificates_20200601.tar.xz) = 9532328cd77238d8a1fca155eab7b91d411dcdb0cd32b6026ddab5e06eab3732
-SHA512 (ca-certificates_20200601.tar.xz) = 7bfd3122430be0a46bd10dcb0e0664561d1e0b2656b9f37677d89f71a1dcb0e668c25ffe08412888125fa9a53ee8245a4b3fc1004c419a159766665b1241113c
-Size (ca-certificates_20200601.tar.xz) = 245668 bytes
+BLAKE2s (ca-certificates_20211016.tar.xz) = ee1b82472068aef176dbc9dab2099848e299dbcc92ac309ba5a906a98414731d
+SHA512 (ca-certificates_20211016.tar.xz) = bedf072c8aa1b05b249ea272f5cecfe16bdcd762c02c712323f12ac7a278e8814453f5f3caad86a2581e451788b292ed3a76a6a81620926459bb890133cffde1
+Size (ca-certificates_20211016.tar.xz) = 239608 bytes