sergioandClaude Opus 4.8
21ac060c4b
Cosecha desatendida de la campaña harkaq. Cada dep de acá la denunció el audit de Landlock en un build real: el kernel vio al build usarla sin declararla, y el store del hub confirma qué artefacto la provee (deuda DECLARABLE, §4.5). Recetas:gettext-tiny giflib git gnupg gperf gzip htop iproute2 jq kbd libassuan libcap libevent libffi libgcrypt libgpg-error libksba libnl libpng libsass libsodium libssh2 libudev-zero libusb libwebp libxml2 libyaml linux-generic linux-headers linux-metal linux-pam linux lz4 mandoc mtools musl nano npth openssh openssl parted pciutils pcre2 pigz procps-ng python3 readline rsync samurai ca-certificates curl doas dosfstools e2fsprogs fontconfig freetype No se tocó ninguna receta con deuda IRREDUCIBLE: declarar algo que el store no provee rompería el build en vez de arreglarlo. Esas van a tandas/needs-review-harkaq. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
67 lines
2.3 KiB
TOML
67 lines
2.3 KiB
TOML
# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
|
|
# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
|
|
# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
|
|
name = "ca-certificates"
|
|
version = "20260611"
|
|
|
|
[source]
|
|
tarball = "https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/20260611/ca-certificates-20260611.tar.bz2"
|
|
# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
|
|
# sha512 = "f473a1111eb508ef5d1096489479dba07db6b0d76ef2b900b3473933d57419429061d83e9c1e881ab61c4b0f17c64859ec74d670da6fc1d83d9b0fa73e1b7d8d"
|
|
sha256 = "32ca73f2e81e2b88dc614f12e1ee04a82b1ec5a8e29d9f359ddf8905a0afcbb0"
|
|
|
|
[build]
|
|
compiler = "zig-cc"
|
|
target = "x86_64-linux-musl"
|
|
link = "static"
|
|
flags = []
|
|
|
|
# openssl aporta libcrypto.a al overlay del sandbox (/usr/lib) para enlazar c_rehash
|
|
# (`-lcrypto`). El resto del build (mk-ca-bundle.pl → cert.pem → split-ca-bundle.sh) usa
|
|
# el perl + coreutils del rootfs; no requiere el CLI de openssl.
|
|
[deps]
|
|
build = ["openssl", "perl"]
|
|
|
|
[build.phases]
|
|
# de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
|
|
compile = '''
|
|
_abuild_phase() {
|
|
make
|
|
}
|
|
_abuild_phase
|
|
'''
|
|
# de package() de Alpine (traducido $pkgdir→/out):
|
|
install = '''
|
|
_abuild_phase() {
|
|
make install DESTDIR="/out"
|
|
|
|
(
|
|
echo "# Automatically generated by ca-certificates-20260611-r$pkgrel"
|
|
echo "# $(date -ud@$SOURCE_DATE_EPOCH)"
|
|
echo "#"
|
|
cd "/out"/usr/share/ca-certificates
|
|
find . -name '*.crt' | sort | cut -b3-
|
|
) > "/out"/etc/ca-certificates.conf
|
|
|
|
# generate the bundle in similar way as update-ca-certificates would do
|
|
find -- *.crt | sort | while read -r i; do
|
|
cat "$i"
|
|
printf "\n"
|
|
done > "/out"/etc/ssl/certs/ca-certificates.crt
|
|
|
|
mkdir -p "/out"/etc/apk/protected_paths.d
|
|
cat > "/out"/etc/apk/protected_paths.d/ca-certificates.list <<-EOF
|
|
-etc/ssl/certs/ca-certificates.crt
|
|
-etc/ssl/certs/ca-cert-*.pem
|
|
-etc/ssl/certs/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[r0-9]*
|
|
EOF
|
|
|
|
cat > "/out"/etc/ca-certificates/update.d/certhash <<-EOF
|
|
#!/bin/sh
|
|
exec /usr/bin/c_rehash /etc/ssl/certs
|
|
EOF
|
|
chmod +x "/out"/etc/ca-certificates/update.d/certhash
|
|
}
|
|
_abuild_phase
|
|
'''
|