From 73c979f2b87771b98d5b75e4b57f05bc729a789c Mon Sep 17 00:00:00 2001
From: DJ Lucas <dj@lucasit.com>
Date: Tue, 1 Jan 2019 20:09:21 -0600
Subject: [PATCH] Update README and minor text modification

---
 README                  | 38 +++-----------------------------------
 copy-trust-modifcations |  3 ++-
 2 files changed, 5 insertions(+), 36 deletions(-)

diff --git a/README b/README
index 7cb5fb2..3a33b95 100644
--- a/README
+++ b/README
@@ -42,43 +42,11 @@ Additionally, for the p11-kit distro hook, remove the "not configured" and
 commands:
 
 ===============================================================================
-# Use make-ca to manage certificates
-if [ -f /etc/make-ca.conf ]; then
-    . /etc/make-ca.conf
-else
-    #Use defaults if make-ca.conf does not exist
-    ANCHORDIR="/etc/pki/anchors"
-    ANCHORLIST="/etc/pki/anchors.txt"
-    LOCALDIR="/etc/ssl/local"
-    CERTLIST=""
-fi
-
-# Create a list of certificates not present at previous run
-for ca in `/bin/ls -1 --color=none "${ANCHORDIR}"` ; do
-    /bin/grep "${ca}" "${ANCHORLIST}" 2>&1>/dev/null || \
-        CERTLIST="${CERTLIST} ${ca}"
-done
-
-# Dump to a temporary directory
-TEMPDIR=`mktemp -d`
-/usr/bin/trust extract --filter=certificates --format=openssl-directory \
-                       --overwrite "${TEMPDIR}"
-
-# Copy new certificates to LOCALDIR
-for certificate in `echo "${CERTLIST}"` ; do
-    LABEL=`/bin/grep -m 1 "label:" "${ANCHORDIR}/${certificate}"`
-    LABELNEW=`echo "${LABEL}" | \
-                   /bin/sed -e 's@^label: @@' -e 's@"@@g' -e 's@ @_@g'`
-    cp -v "${TEMPDIR}/${LABELNEW}.pem" "${LOCALDIR}"
-    unset LABEL LABELNEW
-done
-
-# Clean up
-rm -rf "${TEMPDIR}"
-unset ANCHORDIR ANCHORLIST LOCALDIR CERTLIST TEMPDIR
+# Copy existing modifications to local store
+/usr/libexec/make-ca/copy-trust-modifications
 
 # Generate a new trust store
-/usr/sbin/make-ca -f
+/usr/sbin/make-ca -f -g
 EOF
 ===============================================================================
 
diff --git a/copy-trust-modifcations b/copy-trust-modifcations
index 941c60c..14003ac 100644
--- a/copy-trust-modifcations
+++ b/copy-trust-modifcations
@@ -19,12 +19,13 @@ TEMPDIR=`mktemp -d`
                        --overwrite \
                        "${TEMPDIR}"
 
-# Create a list of certificates not present at, or modified since previous run
+# Create a list of anchors that were not present or have been modified
 "${MD5SUM}" "${ANCHORDIR}"/*.pem > "${TEMPDIR}/anchors.md5sums"
 diff -au "${ANCHORLIST}" "${TEMPDIR}/anchors.md5sums" > "${TEMPDIR}/diff"
 grep "^+[a-z,0-9]" "${TEMPDIR}/diff" | cut -d " " -f 3 > "${TEMPDIR}/certlist"
 
 echo -e "\nThe following certificates have local modifications:\n"
+
 # Copy new certificates to LOCALDIR
 for certificate in `cat "${TEMPDIR}/certlist"` ; do
     LABEL=`grep -m 1 "label:" "${certificate}"`