ca-certificates (20230311) [PTS] [DDPO]

COMMITS: VCS has seen 11 commits since the debian/20211016 tag

Git: https://salsa.debian.org/debian/ca-certificates.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: master
Path: debian/changelog
Repo size: 7602176
Browser: https://salsa.debian.org/debian/ca-certificates
Last scan: 2023-12-09 19:39:14+00
Next scan: 2023-12-15 06:00:00+00
Merge requests: 4

Debian changelog in Git:

ca-certificates (20230311) unstable; urgency=medium

  [ Đoàn Trần Công Danh ]
  * ca-certificates: compat with non-GNU mktemp (closes: #1000847)

  [ Ilya Lipnitskiy ]
  * certdata2pem.py: use UTC time when checking cert validity

  [ Julien Cristau ]
  * Update Mozilla certificate authority bundle to version 2.60
    The following certificate authorities were added (+):
    + "Autoridad de Certificacion Firmaprofesional CIF A62634068"
    + "Certainly Root E1"
    + "Certainly Root R1"
    + "D-TRUST BR Root CA 1 2020"
    + "D-TRUST EV Root CA 1 2020"
    + "DigiCert TLS ECC P384 Root G5"
    + "DigiCert TLS RSA4096 Root G5"
    + "E-Tugra Global Root CA ECC v3"
    + "E-Tugra Global Root CA RSA v3"
    + "HARICA TLS ECC Root CA 2021"
    + "HARICA TLS RSA Root CA 2021"
    + "HiPKI Root CA - G1"
    + "ISRG Root X2"
    + "Security Communication ECC RootCA1"
    + "Security Communication RootCA3"
    + "Telia Root CA v2"
    + "TunTrust Root CA"
    + "vTrus ECC Root CA"
    + "vTrus Root CA"
    The following certificate authorities were removed (-):
    - "Cybertrust Global Root" (expired)
    - "EC-ACC"
    - "GlobalSign Root CA - R2" (expired)
    - "Hellenic Academic and Research Institutions RootCA 2011"
    - "Network Solutions Certificate Authority"
    - "Staat der Nederlanden EV Root CA" (expired)
  * Drop trailing space from debconf template causing misformatting
    (closes: #980821)

  [ Wataru Ashihara ]
  * Make certdata2pem.py compatible with cryptography >= 35 (closes: #1008244)

 -- Julien Cristau <jcristau@debian.org>  Sat, 11 Mar 2023 09:47:05 +0100

This branch is 11 commits ahead of tag debian/20211016

Git log:

commit 2c507f8c5aac8b50e35291739ffd40676ab08993
Author: Julien Cristau <jcristau@debian.org>
Date:   Sat Mar 11 09:47:10 2023 +0100

    Upload to unstable

commit 7eee62eaf1095953b79a312901aae5ec74012444
Author: Julien Cristau <jcristau@debian.org>
Date:   Sat Mar 11 09:35:49 2023 +0100

    Update Mozilla certificate authority bundle to version 2.60

commit 88d98d1082e5d2d1f85e5cb42811da813db981c9
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Dec 6 10:35:18 2022 +0100

    Add changelog entry

commit c7a3136aa0290f09080ff90d2c21d43b70710310
Author: Wataru Ashihara <wsh@iij.ad.jp>
Date:   Fri Mar 25 17:44:43 2022 +0900

    Make certdata2pem.py work with newer cryptography versions
    
    certdata2pem.py is incompatible the cryptography package version 2.
    
        $ pip3 install -U cryptography~=2.0  # 2.9.2
        ...
    
        $ python3 certdata2pem.py
        ...
        Traceback (most recent call last):
          File "certdata2pem.py", line 125, in <module>
            cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
        TypeError: load_der_x509_certificate() missing 1 required positional argument: 'backend'
    
        $ pip3 install -U cryptography~=3.0  # 3.4.8
        ...
    
        $ python3 certdata2pem.py  # ok
        ...
    
    I think this should be noted in README.
    
    cryptography>=35.0 is also incompatible:
    
        $ pip3 install -U cryptography~=35.0
        ...
    
        $ python3 certdata2pem.py
        Traceback (most recent call last):
          File "certdata2pem.py", line 125, in <module>
            cert = x509.load_der_x509_certificate(obj['CKA_VALUE'])
          File "/home/wsh/.local/lib/python3.8/site-packages/cryptography/x509/base.py", line 443, in load_der_x509_certificate
            return rust_x509.load_der_x509_certificate(data)
        TypeError: argument 'data': 'bytearray' object cannot be converted to 'PyBytes'

commit ac305ca929f9617de8c237a63ea05dc9fa5ead1c
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Feb 22 10:18:48 2022 +0100

    Drop trailing space from debconf template causing misformatting
    
    Closes: #980821

commit bbc989212eb0df43aaa213b68614f64eb5f94e17
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Jan 11 14:18:11 2022 +0100

    Update Mozilla certificate authority bundle to version 2.52

commit 7ceea873db3c45704aeb3d35d355aa930a419dab
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Jan 11 14:33:49 2022 +0100

    Blacklist expired CAs

commit 4823764900caa687451cd588f76585aa9e3abbb6
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Jan 11 14:14:40 2022 +0100

    Add changelog entry

commit 15229cb234becd05577c87b4e8a4522bab740f2f
Merge: 4784cf2 17b759d
Author: Julien Cristau <jcristau@debian.org>
Date:   Tue Dec 14 10:09:40 2021 +0000

    Merge branch 'busybox-compat' into 'master'
    
    update-ca-certificates: compat with non-GNU mktemp(1)
    
    See merge request debian/ca-certificates!8

commit 4784cf2dac3b6a10f4747423ee8c7f912804feb2
Author: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Date:   Mon Dec 13 13:13:52 2021 -0800

    mozilla/certdata2pem.py: use UTC time when checking cert validity
    
    x509.not_valid_after returns naive UTC datetime and so does
    datetime.utcnow(), so keep the time consistent when performing the
    comparison.
    
    Fixes: 8033d5225917 ("mozilla/certdata2pem.py: print a warning for expired certificates.")
    Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
    Signed-off-by: Julien Cristau <jcristau@debian.org>

commit 17b759d6975b8bfb3fbdddabd429680b6fa78939
Author: Đoàn Trần Công Danh <congdanhqx@gmail.com>
Date:   Tue Nov 30 17:26:24 2021 +0700

    update-ca-certificates: compat with non-GNU mktemp(1)
    
    BSD and BusyBox lacks --tmpdir support.
    
    Emulate it with -p instead.
    
    Close bugs #1000847
    
    Signed-off-by: Đoàn Trần Công Danh <congdanhqx@gmail.com>