make-ca

164 Commits 1 Branch 0 Tags

3 Commits

Author	SHA1	Message	Date
Xi Ruoyao	d3562bc2f0	verify hg.mozilla.org with bundled CA root Before this, make-ca does not verify the certificate of hg.mozilla.org at all. It makes sense as make-ca often runs on systems without trust anchor. But, a MIM can easily fake hg.mozilla.org and completely hijack the trust anchor of a BLFS system. To improve the situation, we ship the certificate of the CA root for hg.mozilla.org (DigiCert Global Root CA) in the make-ca package, and use it to verify hg.mozilla.org.	2022-01-31 19:07:08 +08:00
Xi Ruoyao	151af87198	make-ca: use --filter=ca-anchors for all stores Fixes #19.	2022-01-09 00:00:22 +08:00
Xℹ Ruoyao	84d5ba706c	Makefile: add dependency so "make install" won't need -j1 Now due to a missing dependency, "make install" will fail if MAKEFLAGS="-j N" is set to $N > 1$. Add an additional dependency to fix it.	2020-02-05 14:47:02 +08:00

Author

SHA1

Message

Date

Xi Ruoyao

d3562bc2f0

verify hg.mozilla.org with bundled CA root

Before this, make-ca does not verify the certificate of hg.mozilla.org
at all.  It makes sense as make-ca often runs on systems without trust
anchor.  But, a MIM can easily fake hg.mozilla.org and completely hijack
the trust anchor of a BLFS system.

To improve the situation, we ship the certificate of the CA root for
hg.mozilla.org (DigiCert Global Root CA) in the make-ca package, and use
it to verify hg.mozilla.org.

2022-01-31 19:07:08 +08:00

Xi Ruoyao

151af87198

make-ca: use --filter=ca-anchors for all stores

Fixes #19.

2022-01-09 00:00:22 +08:00

Xℹ Ruoyao

84d5ba706c

Makefile: add dependency so "make install" won't need -j1

Now due to a missing dependency, "make install" will fail if
MAKEFLAGS="-j N" is set to $N > 1$.  Add an additional dependency to
fix it.

2020-02-05 14:47:02 +08:00