Fri Jun 10 13:14:10 2022 UTC ()

security/ca-certificates: Clarify and adjust language

Point out that this is from Debian and that Debian's policy is unclear
(it's not on HOMEPAGE at least; they probably do have one).

Note that modification outside of the package's files is either to
base or to pkgsrc openssl.

Clarify that there's a supported way to exclude particular certs as
trust anchors.


(gdt)

diff -r1.3 -r1.4 pkgsrc/security/ca-certificates/DESCR

--- pkgsrc/security/ca-certificates/DESCR 2021/07/20 12:59:06 1.3
+++ pkgsrc/security/ca-certificates/DESCR 2022/06/10 13:14:10 1.4

 @@ -1,12 +1,20 @@
-This package provides the certificates distributed by the Mozilla
+This package provides the root certificates distributed by the Mozilla
-Project and will, by default, install certificates trusted by the
+Project as curated by Debian in their package of the same name, along
-Mozilla Project in the system OpenSSL certificate store.  Modification
+with tools to manage the set of configured trust anchors for openssl.
 of system configuration files is very irregular as pkgsrc should not
 write anything outside of ${PREFIX}.
-The sysadmin can configure the list of trusted certificates and also
+\todo Explain if Debian adds or removes, or if this is exactly the
-add local certificates as needed by editing ca-certificates.conf and
+same set.
 re-running update-ca-certificates.
 NB: Installing this package will modify the configuration of the
 openssl implementation used by pkgsrc, which is either the base system
 openssl or pkgsrc openssl.  The modification is configuring every
 certificate as a trust anchor.  Modification of system configuration
 files is very irregular as pkgsrc should not write anything outside of
 ${PREFIX}.
 The sysadmin can exclude CA certificates from the list of trust
 anchors and also add local certificates as configured trust anchors by
 editing ca-certificates.conf and re-running update-ca-certificates.
 See also the mozilla-rootcerts and mozilla-rootcerts-openssl packages
 for an alternative approach.