public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #125344 from helsinki-systems/bkp/21.05/cacert

Browse Source
This commit is contained in:
Martin Weinelt 2021-06-02 15:47:27 +02:00 committed by GitHub
commit 3308be986a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkgs/data/misc/cacert/default.nix
View File

@ -10,7 +10,7 @@
with lib;
let
version = "3.63";
version = "3.66";
underscoreVersion = builtins.replaceStrings ["."] ["_"] version;
in
@ -20,7 +20,7 @@ stdenv.mkDerivation {
src = fetchurl {
url = "mirror://mozilla/security/nss/releases/NSS_${underscoreVersion}_RTM/src/nss-${version}.tar.gz";
sha256 = "0892xbjcaw6g4rd2rs4qa37nbda248cjrgxa4faaw0licbpjyb8q";
sha256 = "1jfdnh5l4k57r2vb07s06hqi7m2qzk0d9x25lsdsrw3cflx9x9w9";
};
certdata2pem = fetchurl {

10
pkgs/data/misc/cacert/update.sh
View File

@ -12,6 +12,14 @@
#
# As of this writing there are a few magnitudes more packages depending on
# cacert than on nss.
#
# If the current nixpkgs revision contains the attribute `nss_latest` that will
# be used instead of `nss`. This is done to help the stable branch maintenance
# where (usually) after branch-off during the first Firefox upgrade that
# requries a new NSS version that attribute is introduced.
# By having this change in the unstable branch we can safely carry it from
# release to release without requiring more backport churn on those doing the
# stable maintenance.
set -ex
@ -20,7 +28,7 @@ BASEDIR="$(dirname "$0")/../../../.."
CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.overrideAttrs (_: { inherit (nss) src version; })).out")
PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; let nss_pkg = pkgs.nss_latest or pkgs.nss; in (cacert.overrideAttrs (_: { inherit (nss_pkg) src version; })).out")
# Check the hash of the etc subfolder
# We can't check the entire output as that contains the nix-support folder