Re: [arch-dev-public] Rethinking our CA certificate setup

2014-11-16 Thread Guillaume ALAUX
On 16 November 2014 16:13, Jan Alexander Steffens wrote: > On Sun, Nov 16, 2014 at 3:54 PM, Guillaume Alaux wrote: >> So the "ca-certificates-utils" from testing (20140923-5) declares a >> "provides" and "conflict" on "ca-certificates-java". Unfortunately jre >> and jdk packages use a "init-jks-k

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-11-16 Thread Jan Alexander Steffens
On Sun, Nov 16, 2014 at 3:54 PM, Guillaume Alaux wrote: > So the "ca-certificates-utils" from testing (20140923-5) declares a > "provides" and "conflict" on "ca-certificates-java". Unfortunately jre > and jdk packages use a "init-jks-keystore" script provided by > "ca-certificates-java" but not "c

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-11-16 Thread Guillaume Alaux
On 26 August 2014 21:15, Jan Alexander Steffens wrote: > On Sun, Aug 24, 2014 at 11:47 AM, Jan Alexander Steffens > wrote: >> Hi guys, >> >> I'm currently at FrOSCon with Pierre and an expert from CAcert.org and >> we're thinking of changes to our certificate setup. >> >> >> The current issues ar

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-08-26 Thread Jan Alexander Steffens
On Sun, Aug 24, 2014 at 11:47 AM, Jan Alexander Steffens wrote: > Hi guys, > > I'm currently at FrOSCon with Pierre and an expert from CAcert.org and > we're thinking of changes to our certificate setup. > > > The current issues are: > - Mozilla NSS uses its own root store and not /etc/ssl/certs >

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-08-24 Thread Felix Yan
On Sunday, August 24, 2014 11:47:56 Jan Alexander Steffens wrote: > The current issues are: > - Mozilla NSS uses its own root store and not /etc/ssl/certs > - ca-certificates ships outdated Mozilla roots > - Shipping additional roots outside ca-certificates is difficult, > requiring patching /etc/c

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-08-24 Thread Jan Alexander Steffens
On Sun, Aug 24, 2014 at 12:06 PM, Gaetan Bisson wrote: > [2014-08-24 11:47:56 +0200] Jan Alexander Steffens: >> - Ship the update-ca-certificates script in a ca-certificates-utils >> package, which the certificate packages depend on >> - ca-certificates becomes a metapackage depending on the -mozi

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-08-24 Thread Massimiliano Torromeo
On Sun, Aug 24, 2014 at 11:47 AM, Jan Alexander Steffens < jan.steff...@gmail.com> wrote: > > The current issues are: > - Mozilla NSS uses its own root store and not /etc/ssl/certs > - ca-certificates ships outdated Mozilla roots > - Shipping additional roots outside ca-certificates is difficult, >

Re: [arch-dev-public] Rethinking our CA certificate setup

2014-08-24 Thread Gaetan Bisson
[2014-08-24 11:47:56 +0200] Jan Alexander Steffens: > - Ship the update-ca-certificates script in a ca-certificates-utils > package, which the certificate packages depend on > - ca-certificates becomes a metapackage depending on the -mozilla and > -cacert packages So we'd have three ca-certificate

[arch-dev-public] Rethinking our CA certificate setup

2014-08-24 Thread Jan Alexander Steffens
Hi guys, I'm currently at FrOSCon with Pierre and an expert from CAcert.org and we're thinking of changes to our certificate setup. The current issues are: - Mozilla NSS uses its own root store and not /etc/ssl/certs - ca-certificates ships outdated Mozilla roots - Shipping additional roots outs