[Pkg-sympa-commits] [SCM] sympa Debian packaging branch, master, updated. debian/6.1.11_dfsg-5-12-gc847c76

[Emmanuel Bouthenot]

The following commit has been merged in the master branch:
commit 7ab6b9b7de9ec7cd27ebf2d8046f7ea227b583a6
Author: Emmanuel Bouthenot <kolter at openics.org>
Date:   Tue Jul 2 19:29:22 2013 +0000

    Add a patch to raise a warning instead of an error when the CA bundle file is not readable (#706965)

diff --git a/debian/patches/2001_ca_bundle_check_as_warning.patch b/debian/patches/2001_ca_bundle_check_as_warning.patch
new file mode 100644
index 0000000..b45c490
--- /dev/null
+++ b/debian/patches/2001_ca_bundle_check_as_warning.patch
@@ -0,0 +1,50 @@
+Description: Raise a warning instead of an error when the CA bundle file is not readable.
+  For its internal usage (to make https request and verify smime mail signatures) Sympa
+  needs access to the Certificates Authorities installed on the system.
+
+  Certificates Authorities are available in the package ca-certificates and
+  this package also provides a single file with all the CA concatenated.
+  The location of this file is /etc/ssl/certs/ca-certificates.crt
+
+  Sympa package provides a symlink from /usr/share/sympa/default/ca-bundle.crt
+  to /etc/ssl/certs/ca-certificates.crt
+
+  Recently, to fix bug #537051 the ca-certificates package maintainer has
+  decided to replace the CA bundle generation
+  (/etc/ssl/certs/ca-certificates.crt) in the postinst by a trigger.
+
+  During installation of Sympa, if ca-certificates is not present, it is
+  installed as a Sympa dependency but the sympa postinst will always be
+  executed before the ca-certificates triggers.
+  It means that Sympa start will fail with an error because
+  /etc/ssl/certs/ca-certificates.crt does not exists (not yet generated by the
+  ca-certificates trigger).
+
+  The following patch tries to detect if the CA bundle configured in sympa is a
+  symlink to /etc/ssl/certs/ca-certificates.crt. In that case, a warning raised
+  instead of en error.
+
+  This is a purely Debian specific fix, which is quite ugly but it works.
+
+  A better patch will be very much appreciated.
+Author: Emmanuel Bouthenot <kolter at debian.org>
+Bug-Debian: http://bugs.debian.org/706965
+Forwarded: not-needed
+Last-Update: 2013-07-02
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/src/lib/Conf.pm
++++ b/src/lib/Conf.pm
+@@ -920,7 +920,11 @@
+ 
+     ## Check cafile and capath access
+     if (defined $Conf{'cafile'} && $Conf{'cafile'}) {
+-	unless (-f $Conf{'cafile'} && -r $Conf{'cafile'}) {
++	my $debian_ca_bundle = '/etc/ssl/certs/ca-certificates.crt';
++	if (-l $Conf{'cafile'} && ! -r $Conf{'cafile'} && readlink($Conf{'cafile'}) == $debian_ca_bundle) {
++		&do_log('warning', 'cafile (%s) is a symlink to the Debian CA certificates bundle (%s) which is not yet installed yet (see #706965)', $Conf{'cafile'}, $debian_ca_bundle);
++	}
++	elsif (! -f $Conf{'cafile'} || ! -r $Conf{'cafile'}) {
+ 	    &do_log('err', 'Cannot access cafile %s', $Conf{'cafile'});
+ 	    unless (&List::send_notify_to_listmaster('cannot_access_cafile', $Conf{'domain'}, [$Conf{'cafile'}])) {
+ 		&do_log('err', 'Unable to send notify "cannot access cafile" to listmaster');	
diff --git a/debian/patches/series b/debian/patches/series
index f5a650f..9031979 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -10,6 +10,7 @@
 1013_fix_wording_sympa_wizard_manpage.patch
 1014_fix_unknown_parameter_ldap_force_canonical_email.patch
 1015_locales_fallback.path
+2001_ca_bundle_check_as_warning.patch
 2002_wizard_drop_localedir.patch
 #2003_sanitize_make_all.patch
 2005_disable_build_non_dfsg_po_files.patch

-- 
sympa Debian packaging