Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.maint.java > #12576
| Path | csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod |
|---|---|
| From | Thorsten Glaser <t.glaser@tarent.de> |
| Newsgroups | linux.debian.maint.java |
| Subject | Re: ca-certificate-java/openjdk installation issues |
| Date | Tue, 21 Feb 2023 22:40:01 +0100 |
| Message-ID | <G1IwF-7y5I-11@gated-at.bofh.it> (permalink) |
| References | <FWBFv-4dUm-5@gated-at.bofh.it> <G1HqW-7xt9-5@gated-at.bofh.it> <G1I3D-7xWb-13@gated-at.bofh.it> |
| X-Mailbox-Line | From debian-java-request@lists.debian.org Tue Feb 21 21:30:24 2023 |
| Old-Return-Path | <t.glaser@tarent.de> |
| X-Amavis-Spam-Status | No, score=-5.6 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, BODY_8BITS=1.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no |
| X-Policyd-Weight | NOT_IN_SBL_XBL_SPAMHAUS=-1.5 CL_IP_EQ_HELO_IP=-2 (check from: .tarent. - helo: .mail-wm1-x332.google. - helo-domain: .google.) FROM/MX_MATCHES_HELO(DOMAIN)=-2; rate: -5.5 |
| X-Gm-Message-State | AO0yUKXkKqVXQM4OI5zjKgKwfz9KJbLnCfBsQm2+O62ppe5gg0L6zgTr wfQ1cHprZDx48tMadHPnk4MAyw== |
| X-Google-SMTP-Source | AK7set+Jpt6w8XKIWAKDS+t56/bq66k4vaKyp34qduf3ngJqL3vi6db3EjUvFD2Q/BCKCrbjyUZKBA== |
| X-Received | by 2002:a05:600c:35cf:b0:3dc:53da:328b with SMTP id r15-20020a05600c35cf00b003dc53da328bmr5101975wmq.14.1677015001870; Tue, 21 Feb 2023 13:30:01 -0800 (PST) |
| Content-Language | de-DE-1901 |
| MIME-Version | 1.0 |
| Content-Type | text/plain; charset=UTF-8 |
| Content-Transfer-Encoding | QUOTED-PRINTABLE |
| X-Mailing-List | <debian-java@lists.debian.org> archive/latest/23231 |
| List-ID | <debian-java.lists.debian.org> |
| List-URL | <https://lists.debian.org/debian-java/> |
| List-Archive | https://lists.debian.org/msgid-search/665f66a6-347d-18ce-457a-548d7fcd2c@tarent.de |
| Approved | robomod@news.nic.it |
| Lines | 42 |
| Organization | linux.* mail to news gateway |
| Sender | robomod@news.nic.it |
| X-Original-Cc | debian-java@lists.debian.org |
| X-Original-Date | Tue, 21 Feb 2023 22:30:00 +0100 (CET) |
| X-Original-Message-ID | <665f66a6-347d-18ce-457a-548d7fcd2c@tarent.de> |
| X-Original-References | <CALFf3kckwyx6X93=1JNjcnBdyctJe9AtfXYQsOoJf5qeUUjNEw@mail.gmail.com> <c2ec8737fb5a03f1039a2e90ab925594@apache.org> <CALFf3kdPbsbF-TJkPTF6VaQXphy-xCKiJ9WRLFk6KRD-OsufWg@mail.gmail.com> |
| Xref | csiph.com linux.debian.maint.java:12576 |
Show key headers only | View raw
On Wed, 22 Feb 2023, Vladimir Petko wrote:
>Just a small clarification, openssl itself allows importing a single
>certificate and its chain and overwrites the store in the process, so
>we need something like p11-kit.
>Another grey area is ORACLE_TrustedKeyUsage attribute - at the moment
Ugh.
How about doing it the “low-tech” way:
– ship a minimal JKS keystore with bin:ca-certificates-java,
generated at build time, that contains a manually vetted
list of roots, perhaps just what’s relevant for Debian
– use a Recommends to get at a JRE
– with trigger, generate a full keystore, once a JRE is there
(The shipped one would need to be in /usr/share/!(doc) and
copied so overwriting it with the generated one works and
we’ll probably need to track hashes of shipped ones so we
can honour admin choices to override the keystore if needed.)
bye,
//mirabilos
--
Infrastrukturexperte • tarent solutions GmbH
Am Dickobskreuz 10, D-53121 Bonn • http://www.tarent.de/
Telephon +49 228 54881-393 • Fax: +49 228 54881-235
HRB AG Bonn 5168 • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg
****************************************************
/⁀\ The UTF-8 Ribbon
╲ ╱ Campaign against Mit dem tarent-Newsletter nichts mehr verpassen:
╳ HTML eMail! Also, https://www.tarent.de/newsletter
╱ ╲ header encryption!
****************************************************
Back to linux.debian.maint.java | Previous | Next — Previous in thread | Next in thread | Find similar
ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-07 20:20 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-07 20:40 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-07 20:40 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-07 21:10 +0100
Re: ca-certificate-java/openjdk installation issues Emmanuel Bourg <ebourg@apache.org> - 2023-02-21 21:30 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-21 21:40 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-21 22:10 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-21 22:40 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-21 23:00 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-21 23:00 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-21 23:40 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-22 00:00 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-22 00:00 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-23 04:00 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-23 20:50 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-23 21:00 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-23 21:00 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-24 05:20 +0100
Re: ca-certificate-java/openjdk installation issues Thorsten Glaser <t.glaser@tarent.de> - 2023-02-24 06:30 +0100
Re: ca-certificate-java/openjdk installation issues Vladimir Petko <vladimir.petko@canonical.com> - 2023-02-27 08:20 +0100
csiph-web