CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/22 12:06:25
Modified files:
usr.sbin : Tag: OPENBSD_7_9 Makefile
distrib/sets/lists/base: Tag: OPENBSD_7_9 mi
distrib/sets/lists/man: Tag: OPENBSD_7_9 mi
lib/libcrypto : Tag: OPENBSD_7_9 cert.pem
Added files:
usr.sbin/dbupdate: Tag: OPENBSD_7_9 Makefile dbupdate.8
dbupdate.sh
Log message:
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
from beck@; OK tb@ sthen@
update cert.pem based on newer mozilla ca root store
from sthen@; OK tb@
dbupdate: Be consistent with name in messages.
from dgl@; OK deraadt@
force umask
from @deraadt
comment on why cachedir is created
from @deraadt
manually detect if this release has no databases available (yet)
with a nice error message compared to errexit
from @deraadt
copyright
from @deraadt
must be run as root
pointed out by florian
from @deraadt
ksh #!, and use consistent $(..) rather than mostly that and a few ``
from sthen@
in dry mode, do not update the hashes remembered for next time
from deraadt@
extract zoneinfo into /, lost during refactoring
pointed out by dgl
from deraadt@
move to /var/dbupdate directory
from deraadt@
initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem
from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory. We can't
do this nicely with syspatch(8) because it requires patches in sequence
so a new tool had to be written. It is intentionally kept very simple
so that it can be studied because we intend to run this in root cron,
(the non-simple parts figure out quickly when not to update).
looked at by sthen beck lucas dgl
from deraadt@
Xr zic
from deraadt@
enter dbupdate
from deraadt@
this is errata/7.9/040_dbupdate.patch.sig
