freebsd

0 Fork 0

mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00

Files

T

History

Michael Osipov 4357ae1174 libfetch: don't rely on ca_root_nss for certificate validation

Before certctl(8), there was no system trust store, and libfetch
relied on the CA certificate bundle from the ca_root_nss port to
verify peers.

We now have a system trust store and a reliable mechanism for
manipulating it (to explicitly add, remove, or revoke certificates),
but if ca_root_nss is installed, libfetch will still prefer that to
the system trust store.

With this change, unless explicitly overridden, libfetch will rely on
OpenSSL to pick up the default system trust store.

PR:		256902
MFC after:	3 days
Reviewed by:	kevans
Differential Revision:	https://reviews.freebsd.org/D42059
Approved by:	re (gjb)

(cherry picked from commit 09f5c1e118)
(cherry picked from commit fb058a9a40)

2023-10-05 17:52:43 +02:00

common.c

libfetch: don't rely on ca_root_nss for certificate validation

2023-10-05 17:52:43 +02:00

common.h

Remove $FreeBSD$: two-line .h pattern

2023-08-16 11:54:16 -06:00

fetch.3

Remove $FreeBSD$: two-line nroff pattern

2023-08-16 11:55:10 -06:00

fetch.c

Remove $FreeBSD$: one-line .c pattern