diff options
Diffstat (limited to 'debian/changelog')
| -rw-r--r-- | debian/changelog | 1440 |
1 files changed, 1440 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 0000000..764b3f0 --- /dev/null +++ b/debian/changelog @@ -0,0 +1,1440 @@ +ca-certificates (20240203) unstable; urgency=medium + + [ Jeffrey Walton ] + * update-ca-certificates man page updates + * fix shellcheck warnings (closes: #1058658, #981663) + + [ Gioele Barabucci ] + * Use standard dh sequence (closes: #1050112) + + [ Julien Cristau ] + * Update Mozilla certificate authority bundle to version 2.64 + The following certificate authorities were added (+): + + Atos TrustedRoot Root CA ECC TLS 2021 + + Atos TrustedRoot Root CA RSA TLS 2021 + + BJCA Global Root CA1 + + BJCA Global Root CA2 + + CommScope Public Trust ECC Root-01 + + CommScope Public Trust ECC Root-02 + + CommScope Public Trust RSA Root-01 + + CommScope Public Trust RSA Root-02 + + Sectigo Public Server Authentication Root E46 + + Sectigo Public Server Authentication Root R46 + + SSL.com TLS ECC Root CA 2022 + + SSL.com TLS RSA Root CA 2022 + + TrustAsia Global Root CA G3 + + TrustAsia Global Root CA G4 + The following certificate authorities were removed (-): + - Autoridad de Certificacion Firmaprofesional CIF A62634068 + - E-Tugra Certification Authority (closes: #1032916) + - E-Tugra Global Root CA ECC v3 + - E-Tugra Global Root CA RSA v3 + - Hongkong Post Root CA 1 + - TrustCor ECA-1 + - TrustCor RootCert CA-1 + - TrustCor RootCert CA-2 (closes: #1023945) + + -- Julien Cristau <jcristau@debian.org> Sun, 04 Feb 2024 10:41:43 +0100 + +ca-certificates (20230311) unstable; urgency=medium + + [ Đoàn Trần Công Danh ] + * ca-certificates: compat with non-GNU mktemp (closes: #1000847) + + [ Ilya Lipnitskiy ] + * certdata2pem.py: use UTC time when checking cert validity + + [ Julien Cristau ] + * Update Mozilla certificate authority bundle to version 2.60 + The following certificate authorities were added (+): + + "Autoridad de Certificacion Firmaprofesional CIF A62634068" + + "Certainly Root E1" + + "Certainly Root R1" + + "D-TRUST BR Root CA 1 2020" + + "D-TRUST EV Root CA 1 2020" + + "DigiCert TLS ECC P384 Root G5" + + "DigiCert TLS RSA4096 Root G5" + + "E-Tugra Global Root CA ECC v3" + + "E-Tugra Global Root CA RSA v3" + + "HARICA TLS ECC Root CA 2021" + + "HARICA TLS RSA Root CA 2021" + + "HiPKI Root CA - G1" + + "ISRG Root X2" + + "Security Communication ECC RootCA1" + + "Security Communication RootCA3" + + "Telia Root CA v2" + + "TunTrust Root CA" + + "vTrus ECC Root CA" + + "vTrus Root CA" + The following certificate authorities were removed (-): + - "Cybertrust Global Root" (expired) + - "EC-ACC" + - "GlobalSign Root CA - R2" (expired) + - "Hellenic Academic and Research Institutions RootCA 2011" + - "Network Solutions Certificate Authority" + - "Staat der Nederlanden EV Root CA" (expired) + * Drop trailing space from debconf template causing misformatting + (closes: #980821) + + [ Wataru Ashihara ] + * Make certdata2pem.py compatible with cryptography >= 35 (closes: #1008244) + + -- Julien Cristau <jcristau@debian.org> Sat, 11 Mar 2023 09:47:05 +0100 + +ca-certificates (20211016) unstable; urgency=low + + [ Michael Shuler ] + * Fix error on install when TEMPBUNDLE missing. Closes: #996005 + + -- Julien Cristau <jcristau@debian.org> Sat, 16 Oct 2021 18:09:43 +0200 + +ca-certificates (20211004) unstable; urgency=low + + [ Debian Janitor ] + * Fix day-of-week for changelog entry 20090624. + + [ Julien Cristau ] + * Create temporary ca-certificates.crt on the same file system. + Closes: #923784 + * Don't remove ca-certificates.crt before updating it, so it doesn't + go missing for a short while (closes: #920348). Thanks, Dimitris + Aragiorgis! + * Bump package priority from optional to standard. + * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority + bundle to version 2.50 + The following certificate authorities were added (+): + + "AC RAIZ FNMT-RCM SERVIDORES SEGUROS" + + "GlobalSign Root R46" + + "GlobalSign Root E46" + + "GLOBALTRUST 2020" + + "ANF Secure Server Root CA" + + "Certum EC-384 CA" + + "Certum Trusted Root CA" + The following certificate authorities were removed (-): + - "QuoVadis Root CA" + - "Sonera Class 2 Root CA" + - "GeoTrust Primary Certification Authority - G2" + - "VeriSign Universal Root Certification Authority" + - "Chambers of Commerce Root - 2008" + - "Global Chambersign Root - 2008" + - "Trustis FPS Root CA" + - "Staat der Nederlanden Root CA - G3" + * Blacklist expired root certificate "DST Root CA X3" (closes: #995432) + * mozilla/certdata2pem.py: print a warning for expired certificates. + + -- Julien Cristau <jcristau@debian.org> Thu, 07 Oct 2021 17:12:47 +0200 + +ca-certificates (20210119) unstable; urgency=medium + + [ Julien Cristau ] + * New maintainer (closes: #976406) + * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority + bundle to version 2.46. + The following certificate authorities were added (+): + + "certSIGN ROOT CA G2" + + "e-Szigno Root CA 2017" + + "Microsoft ECC Root Certificate Authority 2017" + + "Microsoft RSA Root Certificate Authority 2017" + + "NAVER Global Root Certification Authority" + + "Trustwave Global Certification Authority" + + "Trustwave Global ECC P256 Certification Authority" + + "Trustwave Global ECC P384 Certification Authority" + The following certificate authorities were removed (-): + - "EE Certification Centre Root CA" + - "GeoTrust Universal CA 2" + - "LuxTrust Global Root 2" + - "OISTE WISeKey Global Root GA CA" + - "Staat der Nederlanden Root CA - G2" (closes: #962079) + - "Taiwan GRCA" + - "Verisign Class 3 Public Primary Certification Authority - G3" + + [ Michael Shuler ] + * mozilla/blacklist: + Revert Symantec CA blacklist (#911289). Closes: #962596 + The following root certificates were added back (+): + + "GeoTrust Primary Certification Authority - G2" + + "VeriSign Universal Root Certification Authority" + + [ Gianfranco Costamagna ] + * debian/{rules,control}: + Merge Ubuntu patch from Matthias Klose to use Python3 during build. + Closes: #942915 + + -- Julien Cristau <jcristau@debian.org> Tue, 19 Jan 2021 11:11:04 +0100 + +ca-certificates (20200601) unstable; urgency=medium + + * debian/control: + Set Standards-Version: 4.5.0.2 + Set Build-Depends: debhelper-compat (= 13) + * debian/copyright: + Replace tabs in license text + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.40. + Closes: #956411, #955038 + * mozilla/blacklist.txt + Add distrusted Symantec CA list to blacklist for explicit removal. + Closes: #911289 + Blacklist expired root certificate, "AddTrust External Root" + Closes: #961907 + The following certificate authorities were added (+): + + "Certigna Root CA" + + "emSign ECC Root CA - C3" + + "emSign ECC Root CA - G3" + + "emSign Root CA - C1" + + "emSign Root CA - G1" + + "Entrust Root Certification Authority - G4" + + "GTS Root R1" + + "GTS Root R2" + + "GTS Root R3" + + "GTS Root R4" + + "Hongkong Post Root CA 3" + + "UCA Extended Validation Root" + + "UCA Global G2 Root" + The following certificate authorities were removed (-): + - "AddTrust External Root" + - "Certinomis - Root CA" + - "Certplus Class 2 Primary CA" + - "Deutsche Telekom Root CA 2" + - "GeoTrust Global CA" + - "GeoTrust Primary Certification Authority" + - "GeoTrust Primary Certification Authority - G2" + - "GeoTrust Primary Certification Authority - G3" + - "GeoTrust Universal CA" + - "thawte Primary Root CA" + - "thawte Primary Root CA - G2" + - "thawte Primary Root CA - G3" + - "VeriSign Class 3 Public Primary Certification Authority - G4" + - "VeriSign Class 3 Public Primary Certification Authority - G5" + - "VeriSign Universal Root Certification Authority" + + -- Michael Shuler <michael@pbandjelly.org> Mon, 01 Jun 2020 11:45:49 -0500 + +ca-certificates (20190110) unstable; urgency=high + + * debian/control: + Depend on openssl (>= 1.1.1). + Set Standards-Version: 4.3.0.1. + Set Build-Depends: debhelper-compat (= 12); drop d/compat + Remove trailing whitespace from d/changelog. + * debian/ca-certificates.postinst: + Fix permissions on /usr/local/share/ca-certificates when using symlinks. + Closes: #916833 + * sbin/update-ca-certificates: + Remove orphan symlinks found in /etc/ssl/certs to prevent `openssl + rehash` from exiting with an error. Closes: #895482, #895473 + This will also fix removal of user CA certificates from /usr/local without + needing to run --fresh. Closes: #911303 + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.28. + The following certificate authorities were added (+): + + "GlobalSign Root CA - R6" + + "OISTE WISeKey Global Root GC CA" + The following certificate authorities were removed (-): + - "Certplus Root CA G1" + - "Certplus Root CA G2" + - "OpenTrust Root CA G1" + - "OpenTrust Root CA G2" + - "OpenTrust Root CA G3" + - "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" + - "Visa eCommerce Root" + + -- Michael Shuler <michael@pbandjelly.org> Thu, 10 Jan 2019 19:31:31 -0600 + +ca-certificates (20180409) unstable; urgency=medium + + [ Michael Shuler ] + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.22. + The following certificate authorities were added (+): + + "GDCA TrustAUTH R5 ROOT" + + "SSL.com EV Root Certification Authority ECC" + + "SSL.com EV Root Certification Authority RSA R2" + + "SSL.com Root Certification Authority ECC" + + "SSL.com Root Certification Authority RSA" + + "TrustCor ECA-1" + + "TrustCor RootCert CA-1" + + "TrustCor RootCert CA-2" + The following certificate authorities were removed (-): + - "ACEDICOM Root" + - "AddTrust Low-Value Services Root" + - "AddTrust Public Services Root" + - "AddTrust Qualified Certificates Root" + - "CA Disig Root R1" + - "CNNIC ROOT" + - "Camerfirma Chambers of Commerce Root" + - "Camerfirma Global Chambersign Root" + - "Certinomis - Autorité Racine" + - "Certum Root CA" + - "China Internet Network Information Center EV Certificates Root" + - "Comodo Secure Services root" + - "Comodo Trusted Services root" + - "DST ACES CA X6" + - "GeoTrust Global CA 2" + - "PSCProcert" + - "Security Communication EV RootCA1" + - "Swisscom Root CA 1" + - "Swisscom Root CA 2" + - "Swisscom Root EV CA 2" + - "TURKTRUST Certificate Services Provider Root 2007" + - "TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3" + - "UTN USERFirst Hardware Root CA" + * mozilla/blacklist.txt + Update blacklist to remove certificates no longer in certdata.txt and + explicitly ignore distrusted certificates. + * debian/copyright: + Fix lintian insecure-copyright-format-uri with https URL. + * debian/changelog: + Fix lintian file-contains-trailing-whitespace. + * debian/{compat,control}: + Set to debhelper compat 11. + * Update openssl dependency to >= 1.1.0 to support `openssl rehash` and drop + usage of `c_rehash` script. Closes: #895075 + + [ Thijs Kinkhorst ] + * Remove Christian Perrier from uploaders at his request (closes: #894070). + * Checked for policy 4.1.4, no changes. + + -- Michael Shuler <michael@pbandjelly.org> Mon, 09 Apr 2018 18:43:49 -0500 + +ca-certificates (20170717) unstable; urgency=medium + + * Update to Standards-Version: 4.0.1 + * debian/ca-certificates.postinst: + Prevent postinst failure on read-only /usr/local. Closes: #843722 + * mozilla/certdata2pem.py: + Remove email-only roots from mozilla trust store. Closes: #721976 + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.14. + Closes: #858064 + The following certificate authorities were added (+): + + "AC RAIZ FNMT-RCM" + + "Amazon Root CA 1" + + "Amazon Root CA 2" + + "Amazon Root CA 3" + + "Amazon Root CA 4" + + "D-TRUST Root CA 3 2013" + + "LuxTrust Global Root 2" + + "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1" + The following certificate authorities were removed (-): + - "AC Raiz Certicamara S.A." + - "ApplicationCA - Japanese Government" + - "Buypass Class 2 CA 1" + - "ComSign CA" + - "EBG Elektronik Sertifika Hizmet Saglayicisi" + - "Equifax Secure CA" + - "Equifax Secure eBusiness CA 1" + - "Equifax Secure Global eBusiness CA" + - "IGC/A" + - "Juur-SK" + - "Microsec e-Szigno Root CA" + - "Root CA Generalitat Valenciana" + - "RSA Security 2048 v3" + - "S-TRUST Authentication and Encryption Root CA 2005 PN" + - "S-TRUST Universal Root CA" + - "SwissSign Platinum CA - G2" + - "TC TrustCenter Class 3 CA II" + - "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H6" + - "UTN USERFirst Email Root CA" + - "Verisign Class 1 Public Primary Certification Authority" + - "Verisign Class 1 Public Primary Certification Authority - G3" + - "Verisign Class 2 Public Primary Certification Authority - G2" + - "Verisign Class 2 Public Primary Certification Authority - G3" + - "Verisign Class 3 Public Primary Certification Authority" + - "WellsSecure Public Root Certificate Authority" + + -- Michael Shuler <michael@pbandjelly.org> Thu, 20 Jul 2017 00:18:08 -0500 + +ca-certificates (20161130+nmu1) unstable; urgency=medium + + * Non-maintainer upload. + * Add StartCom and WoSign certificates to mozilla/blacklist.txt as they are + now untrusted by the major browser vendors. Closes: #858539 + + -- Chris Lamb <lamby@debian.org> Fri, 19 May 2017 16:53:16 +0200 + +ca-certificates (20161130) unstable; urgency=medium + + [ Philipp Kern ] + * Add ca-certificates udeb package. Closes: #845456 + + [ Michael Shuler ] + * debian/{compat,control}: + Update to compat level 10 and debhelper (>= 10) + Shorten package description. + * debian/po/id.po + Update Indonesian debconf translation file for build time line reorder + + -- Michael Shuler <michael@pbandjelly.org> Wed, 30 Nov 2016 21:20:53 -0600 + +ca-certificates (20161102) unstable; urgency=medium + + [ Michael Shuler ] + * debian/control: + Update to Standards-Version: 3.9.8 + Update to Vcs-Browser/Vcs-Git: https URLs + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.9. + Thanks for the initial 2.7 patch, Jonathan Wiltshire. Closes: #828845 + The following certificate authorities were added (+): + + "Certplus Root CA G1" + + "Certplus Root CA G2" + + "Certum Trusted Network CA 2" + + "Hellenic Academic and Research Institutions ECC RootCA 2015" + + "Hellenic Academic and Research Institutions RootCA 2015" + + "ISRG Root X1" + + "OpenTrust Root CA G1" + + "OpenTrust Root CA G2" + + "OpenTrust Root CA G3" + + "SZAFIR ROOT CA2" + The following certificate authorities were removed (-): + - "CA Disig" + - "NetLock Business (Class B) Root" + - "NetLock Express (Class C) Root" + - "NetLock Notary (Class A) Root" + - "NetLock Qualified (Class QA) Root" + - "Sonera Class 1 Root CA" + - "Staat der Nederlanden Root CA" + - "Verisign Class 1 Public Primary Certification Authority - G2" + - "Verisign Class 3 Public Primary Certification Authority" + - "Verisign Class 3 Public Primary Certification Authority - G2" + + [ Andreas Beckmann ] + * debian/postinst: + Run update-certificates without hooks to initially populate + /etc/ssl/certs. (The hooks are deferred to the noawait trigger.) + Closes: #825730 + + [ Izharul Haq ] + * debian/po/id.po: + Add Indonesian debconf translation. Thank you, Izharul! Closes: #835156 + + -- Michael Shuler <michael@pbandjelly.org> Wed, 02 Nov 2016 21:15:03 -0500 + +ca-certificates (20160104) unstable; urgency=medium + + * debian/rules: + Sort certificate list for reproducible builds. Closes: #808711 + * mozilla/certdata2pem.py: + Drop old CK*_NETSCAPE trust flag checks + + -- Michael Shuler <michael@pbandjelly.org> Mon, 04 Jan 2016 11:08:26 -0600 + +ca-certificates (20151214) unstable; urgency=medium + + * Removed SPI CA. Closes: #796208 + * debian/{compat,control}: + Updated d/compat to version 9 and updated Build-Depends. + * debian/postinst: + Handle /usr/local/share/ca-certificates permissions and ownership on + upgrade. Closes: #611501 + * mozilla/certdata2pem.py: + Add Python 3 support to ca-certificates. + Thanks to Andrew Wilcox and Richard Ipsum for the patch! Closes: #789753 + * sbin/update-ca-certificates: + Update local certificates directory when calling --fresh. + Thanks for the patch, Daniel Lutz! Closes: #783615 + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.6. + The following certificate authorities were added (+): + + "CA WoSign ECC Root" + + "Certification Authority of WoSign G2" + + "Certinomis - Root CA" + + "OISTE WISeKey Global Root GB CA" + + "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" + + "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H6" + The following certificate authorities were removed (-): + - "A-Trust-nQual-03" + - "Buypass Class 3 CA 1" + - "ComSign Secured CA" + - "Digital Signature Trust Co. Global CA 1" + - "Digital Signature Trust Co. Global CA 3" + - "SG TRUST SERVICES RACINE" + - "TC TrustCenter Class 2 CA II" + - "TC TrustCenter Universal CA I" + - "TURKTRUST Certificate Services Provider Root 1" + - "TURKTRUST Certificate Services Provider Root 2" + - "UTN DATACorp SGC Root CA" + - "Verisign Class 4 Public Primary Certification Authority - G3" + + -- Michael Shuler <michael@pbandjelly.org> Mon, 14 Dec 2015 18:51:50 -0600 + +ca-certificates (20150426) unstable; urgency=medium + + * debian/postinst: + Set mode and group of /usr/local/share/ca-certificates based on current + /usr/local permissions and ownership. Closes: #611501 + * sbin/update-ca-certificates: + Allow customisation of the paths used by update-ca-certificates. + Add an option to set the certs in a directory to the defaults. + Thanks for the patches, Paul Wise. Closes: #774059, #774201 + Fix shellcheck warnings and a little indentation. + * sbin/update-ca-certificates.8: + Correct concatenated file name in man page from certificates.crt to + ca-certificates.crt. Closes: #782230 + * mozilla/{certdata.txt,nssckbi.h}: + Update Mozilla certificate authority bundle to version 2.4. + The following certificate authorities were added (+): + + "CFCA EV ROOT" + + "COMODO RSA Certification Authority" + + "Entrust Root Certification Authority - EC1" + + "Entrust Root Certification Authority - G2" + + "GlobalSign ECC Root CA - R4" + + "GlobalSign ECC Root CA - R5" + + "IdenTrust Commercial Root CA 1" + + "IdenTrust Public Sector Root CA 1" + + "S-TRUST Universal Root CA" + + "Staat der Nederlanden EV Root CA" + + "Staat der Nederlanden Root CA - G3" + + "USERTrust ECC Certification Authority" + + "USERTrust RSA Certification Authority" Closes: #762709 + The following certificate authorities were removed (-): + - "America Online Root Certification Authority 1" + - "America Online Root Certification Authority 2" + - "E-Guven Kok Elektronik Sertifika Hizmet Saglayicisi" + - "GTE CyberTrust Global Root" + - "Thawte Premium Server CA" + - "Thawte Server CA" + + -- Michael Shuler <michael@pbandjelly.org> Sun, 26 Apr 2015 10:37:48 -0500 + +ca-certificates (20141019) unstable; urgency=medium + + * debian/copyright: + Add coverage for all files reported by lintian + file-without-copyright-information warning. + * debian/source/lintian-overrides: + Add file-without-copyright-information override for SPI certificate file. + * sbin/update-ca-certificates: + Restore SELinux label after generating ca-certificates.crt file. + Thanks to Laurent Bigonville for the patch. Closes: #742957 + Tidy indentation whitespace. + Thanks to Antonio Terceiro for the patch. Closes: #742663 + * debian/control: + Update to Standards-Version: 3.9.6 (no other changes needed). + Update Vcs-Browser link to cgit URL. + + -- Michael Shuler <michael@pbandjelly.org> Sun, 19 Oct 2014 10:36:49 -0500 + +ca-certificates (20140927) unstable; urgency=medium + + * Update Mozilla certificate authority bundle to version 2.1. + The following certificate authorities were added (+): + + "DigiCert Assured ID Root G2" + + "DigiCert Assured ID Root G3" + + "DigiCert Global Root G2" + + "DigiCert Global Root G3" + + "DigiCert Trusted Root G4" + + "QuoVadis Root CA 1 G3" + + "QuoVadis Root CA 2 G3" + + "QuoVadis Root CA 3 G3" + + "WoSign" + + "WoSign China" + The following certificate authorities were removed (-): + - "Entrust.net Secure Server CA" + - "RSA Root Certificate 1" + - "TDC Internet Root CA" + - "ValiCert Class 1 VA" + - "ValiCert Class 2 VA" + * Include clear list of CAs added/removed, as above, and include better note + in README.Debian for trust reconfiguration. Closes: #743365 + * Remove debian/config in debian/rules clean target. + * Include d/{changelog,NEWS} entries in 20140223 for duplicate CKA_LABEL + rename of "StartCom Certification Authority"_2. + + -- Michael Shuler <michael@pbandjelly.org> Sat, 27 Sep 2014 15:14:00 -0500 + +ca-certificates (20140325) unstable; urgency=medium + + * Update mozilla/certdata.txt to version 1.97+revert_of_936304 + Mozilla reverted the removal of 1024-bit root certificates for + Entrust.net, GTE CyberTrust, and ValiCert (RSA), but did not update the + version number in nssckbi.h. + Certificates added (+) (none removed): + + "Entrust.net Secure Server CA" + + "GTE CyberTrust Global Root" + + "RSA Root Certificate 1" + + "ValiCert Class 1 VA" + + "ValiCert Class 2 VA" + + -- Michael Shuler <michael@pbandjelly.org> Tue, 25 Mar 2014 13:28:19 -0500 + +ca-certificates (20140223) unstable; urgency=medium + + * No longer ship cacert.org certificates. Closes: #718434, LP: #1258286 + * Fix certdata2pem.py for multiple CAs using the same CKA_LABEL. Thanks + to Marc Deslauriers for the patch. Closes: #683403, LP: #1031333 + * Sort local CA certificates on update-ca-certificates runs. Thanks to + Vaclav Ovsik for the suggestion and patch. Closes: #727136 + * Add trailing newline to certificate, if it is missing. Closes: #635570 + * Update mozilla/certdata.txt to version 1.97. + Certificates added (+), removed (-), and renamed (~): + + "ACCVRAIZ1" + + "Atos TrustedRoot 2011" + + "E-Tugra Certification Authority" + + "SG TRUST SERVICES RACINE" + + "StartCom Certification Authority" + ~ "StartCom Certification Authority"_2 + (both StartCom CAs now included with duplicate CKA_LABEL fix) + + "T-TeleSec GlobalRoot Class 2" + + "TWCA Global Root CA" + + "TeliaSonera Root CA v1" + + "Verisign Class 3 Public Primary Certification Authority" + ~ "Verisign Class 3 Public Primary Certification Authority"_2 + (both Verisign Class 3 CAs now included with duplicate CKA_LABEL fix) + - "Entrust.net Secure Server CA" + - "Firmaprofesional Root CA" + - "GTE CyberTrust Global Root" + - "RSA Root Certificate 1" + - "TDC OCES Root CA" + - "ValiCert Class 1 VA" + - "ValiCert Class 2 VA" + - "Wells Fargo Root CA" + + -- Michael Shuler <michael@pbandjelly.org> Sun, 23 Feb 2014 23:22:29 -0600 + +ca-certificates (20130906) unstable; urgency=low + + * Add ca-certificates-local source package example to documentation + * Update local certificate handling in README.Debian. + Closes: #718173, LP: #487845 + * Update CA inclusion policy for ca-certificates in README.Debian. With + the exception of SPI and CAcert, only those CAs included in Mozilla's + trust store will be included in ca-certificates in Debian. + Closes: #647848, LP: #103074 + * Clarify that not all software that uses SSL uses ca-certificates in + README.Debian. Closes: #664769 + * Add mozilla/nssckbi.h to source, since certdata.txt no longer contains + a version number. + * Update debian/copyright to "Copyright: Mozilla Contributors" for + mozilla/{certdata.txt,nssckbi.h}. + * Update mozilla/certdata.txt to version 1.94 + Certificates added (+) and removed (-): + + "CA Disig Root R1" + + "CA Disig Root R2" + + "China Internet Network Information Center EV Certificates Root" + + "D-TRUST Root Class 3 CA 2 2009" + + "D-TRUST Root Class 3 CA 2 EV 2009" + + "PSCProcert" + + "Swisscom Root CA 2" + + "Swisscom Root EV CA 2" + + "TURKTRUST Certificate Services Provider Root 2007" + - "Equifax Secure eBusiness CA 2" + - "TC TrustCenter Universal CA III" + + -- Michael Shuler <michael@pbandjelly.org> Fri, 06 Sep 2013 11:31:06 -0500 + +ca-certificates (20130610) unstable; urgency=low + + [ Michael Shuler ] + * Install CAcert root and class3 certificates individually, no longer + installing the concatenation of the two. The individual certificates + are installed as cacert.org_root.crt and cacert.org_class3.crt for ease + of identification. Additionally, this allows openssl maintainers to drop + a problematic patch to c_rehash for handling multi-certificate files. + (see #642314) Closes: #692323 + * Update Vcs-* fields for lintian vcs-field-not-canonical + * Update to machine-readable debian/copyright file v1.0 + + [ Thijs Kinkhorst ] + * Drop upgrading code for upgrades from Debian Etch and earlier. + * Remove obsolete debconf.org CA certificate. DebConf now uses an + intermediate certificate signed by SPI. (Closes: #693405) + * Remove obsolete SPI CA certiticate. + * Update Standards-Version: 3.9.4 (no changes needed) + * Clean up man page (LP: #850997). + + -- Thijs Kinkhorst <thijs@debian.org> Mon, 10 Jun 2013 19:52:15 +0200 + +ca-certificates (20130119) unstable; urgency=low + + * Update mozilla/certdata.txt to version 1.87 Closes: #697366 + Certificates removed (-) (none added): + - "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı" + * Remove unneeded and confusing usage of interest-noawait; remove unneeded + Pre-Depends on dpkg. Thanks to Guillem Jover for the help and patch. + Closes: #537051 + + -- Michael Shuler <michael@pbandjelly.org> Sat, 19 Jan 2013 14:02:09 -0600 + +ca-certificates (20121114) unstable; urgency=low + + [ Don Armstrong ] + * Breaks ca-certificates-java (<<20121112+nmu1); partially fixing #537051. + * Provide update-ca-certificates and update-ca-certificates-fresh + triggers. + * Call the triggers using no-await so that the configuration files from + the newer version of ca-certificates-java are in places before the + upgrade. Closes: #537051. + + [ Michael Shuler ] + * Add note to previous mozilla/certdata.txt changelog entry to document + CKT_NSS_MUST_VERIFY_TRUST changes. + + -- Michael Shuler <michael@pbandjelly.org> Wed, 14 Nov 2012 23:58:59 -0600 + +ca-certificates (20121105) unstable; urgency=low + + * Update mozilla/certdata.txt to version 1.86 Closes: #683728 + - Replace legacy "no explicit trust" flag of CKT_NSS_TRUST_UNKNOWN for + CKT_NSS_MUST_VERIFY_TRUST, instead of a mix of both flags: + https://bugzilla.mozilla.org/show_bug.cgi?id=757189 + This upstream fix does not change the CA certificates installed in + ca-certificates as both flags are ignored. Only those CA certificates + with the CKT_NSS_TRUSTED_DELEGATOR flag in certdata.txt are installed. + Certificates added (+) (none removed): + + "Actalis Authentication Root CA" + + "Trustis FPS Root CA" + + "StartCom Certification Authority" (renewal/rehash) + + "StartCom Certification Authority G2" + + "Buypass Class 2 Root CA" + + "Buypass Class 3 Root CA" + + "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı" + + "T-TeleSec GlobalRoot Class 3" + + "EE Certification Centre Root CA" + * Correct piuparts package remove/purge behavior Closes: #682125 + - Remove deletes of /etc/ssl{,/certs} from debian/postrm + + -- Michael Shuler <michael@pbandjelly.org> Mon, 05 Nov 2012 10:56:05 -0600 + +ca-certificates (20120623) unstable; urgency=low + + * Add Polish translation, thanks to Michał Kułach. Closes: #660002 + * Add Turkish translation, thanks to Atila KOÇ. Closes: #661785 + * Correct update-ca-certificates(8) alignment Closes: #666932 + * Add note to update-ca-certificates(8) about .crt extension needed for + CA certificates in /usr/local/share/ca-certificates Closes: #595279 + * Update mozilla/certdata.txt to version 1.83 + Mozilla Public License updated to v2.0 + (no added/removed CAs) + * Update debian/copyright to: + - reflect MPL v2.0 update for mozilla/certdata.txt + - specify GPL-2 instead of GPL symlink + * Update debian/NEWS with added/removed certs from 20111211 and 20120212 + * Update to Standards-Version: 3.9.3 (no changes needed) + + -- Michael Shuler <michael@pbandjelly.org> Sat, 23 Jun 2012 09:16:54 -0500 + +ca-certificates (20120212) unstable; urgency=low + + * Update mozilla/certdata.txt to version 1.81 + Certificates added (+) and removed (-): + + "Security Communication RootCA2" + + "EC-ACC" + + "Hellenic Academic and Research Institutions RootCA 2011" + - "Verisign Class 2 Public Primary Certification Authority" + - "Verisign Class 4 Public Primary Certification Authority - G2" + - "TC TrustCenter, Germany, Class 2 CA" + - "TC TrustCenter, Germany, Class 3 CA" + * Add notice to README.Debian deprecating CA inclusions and refer to + #647848 for Debian CA Certificate Policy discussion. + + -- Michael Shuler <michael@pbandjelly.org> Sun, 12 Feb 2012 15:12:59 -0600 + +ca-certificates (20111211) unstable; urgency=low + + * Clarify CA audit note in package description and README.debian. Thanks + to C.J. Adams-Collier for the patch. Closes: #594383 + * Remove French Government IGC/A CA certificates. The RSA certificate is + included in the Mozilla bundle and the DSA certificate is not in use. + Closes: #646767 + * Remove expired signet.pl CAs. Closes: #647849 + * Remove expired brasil.gov.br CA. + * Edit 20111025 changelog/NEWS entries to correctly list installed CAs + * Use 'set -e' in body of debian/postinst + * Update mozilla/certdata.txt to version 1.80 + (no added/removed CAs) + * Update mozilla/certdata2pem.py to parse NETSCAPE or NSS data + + -- Michael Shuler <michael@pbandjelly.org> Sun, 11 Dec 2011 19:05:32 -0600 + +ca-certificates (20111025) unstable; urgency=low + + [ Michael Shuler ] + * Add 3.0 (native) source format + * Add Vcs-Git/Browser fields + * Add myself as new Maintainer with Uploaders Closes: #588219 + * Update mozilla/certdata.txt to latest (NSS branch version 1.64.2.13) + Certificates added (+) and removed (-): + + "AffirmTrust Commercial" + + "AffirmTrust Networking" + + "AffirmTrust Premium" + + "AffirmTrust Premium ECC" + + "A-Trust-nQual-03" + + "Certinomis - Autorité Racine" + + "Certum Trusted Network CA" + + "Go Daddy Root Certificate Authority - G2" + + "Root CA Generalitat Valenciana" + + "Starfield Root Certificate Authority - G2" + + "Starfield Services Root Certificate Authority - G2" + + "TWCA Root Certification Authority" + - "AOL Time Warner Root Certification Authority 1" + - "AOL Time Warner Root Certification Authority 2" + - "DigiNotar Root CA" + - "Entrust.net Global Secure Personal CA" + - "Entrust.net Global Secure Server CA" + - "Entrust.net Secure Personal CA" + - "IPS Chained CAs root" + - "IPS CLASE1 root" + - "IPS CLASE3 root" + - "IPS CLASEA1 root" + - "IPS CLASEA3 root" + - "IPS Timestamping root" + - "Thawte Personal Freemail CA" + - "Thawte Time Stamping CA" + * Update CAcert-Class 3-Subroot-certificate Closes: #630232 + + [ Steve Langasek ] + * sbin/update-ca-certificates: move the ca-certificates.crt bundle out of + the way before calling c_rehash, so that symlinks don't accidentally get + pointed here, breaking openssl certificate verification LP: #854927 + + [ Loïc Minier ] + * Drop bogus c_rehash on upgrades, which caused issue when + ca-certificates.crt was still in place; instead, call + update-ca-certificates --fresh on upgrades to this version, and + the usual update-ca-certificates otherwise Closes: #643667, #537382 + + -- Michael Shuler <michael@pbandjelly.org> Tue, 25 Oct 2011 09:12:10 -0500 + +ca-certificates (20111022) unstable; urgency=low + + * QA upload. + * Fix pending l10n issues. Debconf translations: + - German (Helge Kreutzmann). Closes: #634000 + - French (Christian Perrier). Closes: #634092 + - Russian (Yuri Kozlov). Closes: #635146 + - Swedish (Martin Bagge / brother). Closes: #640622 + - Slovak (Slavko). Closes: #641987 + - Spanish; (Javier Fernández-Sanguino). Closes: #642359 + - Japanese (Kenshi Muto). Closes: #644828 + - Czech (Miroslav Kure). Closes: #644843 + - Danish (Joe Hansen). Closes: #644854 + - Italian (Luca Monducci). Closes: #645004 + - Dutch; (Jeroen Schot). Closes: #645090 + - Portuguese (Miguel Figueiredo). Closes: #645126 + - Galician (Jorge Barreiro). Closes: #645138 + - Catalan; (Jordi Mallach). Closes: #645182 + - Brazilian Portuguese (Adriano Rafael Gomes). Closes: #645526 + * Split Choices in debconf templates + * Add build-arch and build-indep build targets + * Bump debhelper compatibility level to 8 + * Bump Standards to 3.9.2 (checked) + * Replace "dh_clean -k" by dh_prep + + -- Christian Perrier <bubulle@debian.org> Sat, 22 Oct 2011 14:24:00 +0200 + +ca-certificates (20110502+nmu1) unstable; urgency=high + + * Non-maintainer upload by the Security Team. + * Blacklist "DigiNotar Root CA" (Closes: #639744) + + -- Raphael Geissert <geissert@debian.org> Tue, 30 Aug 2011 21:00:55 -0500 + +ca-certificates (20110502) unstable; urgency=low + + * QA upload. + * Mark the package as multi-arch:foreign. (Closes: #622323) + * Use db_settitle in config script to allow translations of the + dialog title; thanks to Frans Pop. (Closes: #560314) + + -- Philipp Kern <pkern@debian.org> Mon, 02 May 2011 19:27:50 +0200 + +ca-certificates (20110421) unstable; urgency=low + + * QA upload. + * Package is orphaned, set maintainer to QA group + * Depend on openssl 1.0.0 and force a call of c_rehash so that we have + both the old and new style of symlinks. (Closes: #611102) + * Remove libssl0.9.8 from enhances + * Update mozilla certdata.txt file to the latest version. + Removed: + - ABAecom_=sub.__Am._Bankers_Assn.=_Root_CA.crt + - beTRUSTed_Root_CA-Baltimore_Implementation.crt + - beTRUSTed_Root_CA.crt + - beTRUSTed_Root_CA_-_Entrust_Implementation.crt + - beTRUSTed_Root_CA_-_RSA_Implementation.crt + - Digital_Signature_Trust_Co._Global_CA_2.crt + - Digital_Signature_Trust_Co._Global_CA_4.crt + - Entrust.net_Global_Secure_Personal_CA.crt + - Entrust.net_Global_Secure_Server_CA.crt + - Entrust.net_Secure_Personal_CA.crt + - GTE_CyberTrust_Root_CA.crt + - IPS_Chained_CAs_root.crt + - IPS_CLASE1_root.crt + - IPS_CLASE3_root.crt + - IPS_CLASEA1_root.crt + - IPS_CLASEA3_root.crt + - IPS_Servidores_root.crt + - IPS_Timestamping_root.crt + - RSA_Security_1024_v3.crt + - StartCom_Ltd..crt + - Thawte_Personal_Basic_CA.crt + - Thawte_Personal_Premium_CA.crt + - UTN-USER_First-Network_Applications.crt + - Verisign_RSA_Secure_Server_CA.crt + - Verisign_Time_Stamping_Authority_CA.crt + - Visa_International_Global_Root_2.crt + Added: + - ACEDICOM_Root.crt + - AC_Raíz_Certicámara_S.A..crt + - ApplicationCA_-_Japanese_Government.crt + - Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt + - Buypass_Class_2_CA_1.crt + - Buypass_Class_3_CA_1.crt + - CA_Disig.crt + - Certigna.crt + - certSIGN_ROOT_CA.crt + - Chambers_of_Commerce_Root_-_2008.crt + - CNNIC_ROOT.crt + - ComSign_CA.crt + - ComSign_Secured_CA.crt + - Cybertrust_Global_Root.crt + - Deutsche_Telekom_Root_CA_2.crt + - EBG_Elektronik_Sertifika_Hizmet_Sağlayıcısı.crt + - E-Guven_Kok_Elektronik_Sertifika_Hizmet_Saglayicisi.crt + - ePKI_Root_Certification_Authority.crt + - GeoTrust_Primary_Certification_Authority_-_G2.crt + - GeoTrust_Primary_Certification_Authority_-_G3.crt + - Global_Chambersign_Root_-_2008.crt + - GlobalSign_Root_CA_-_R3.crt + - Hongkong_Post_Root_CA_1.crt + - IGC_A.crt + - Izenpe.com.crt + - Juur-SK.crt + - Microsec_e-Szigno_Root_CA_2009.crt + - Microsec_e-Szigno_Root_CA.crt + - NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt + - OISTE_WISeKey_Global_Root_GA_CA.crt + - SecureSign_RootCA11.crt + - Security_Communication_EV_RootCA1.crt + - Staat_der_Nederlanden_Root_CA_-_G2.crt + - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN.crt + - TÜBİTAK_UEKAE_Kök_Sertifika_Hizmet_Sağlayıcısı_-_Sürüm_3.crt + - TC_TrustCenter_Class_2_CA_II.crt + - TC_TrustCenter_Class_3_CA_II.crt + - TC_TrustCenter_Universal_CA_I.crt + - TC_TrustCenter_Universal_CA_III.crt + - thawte_Primary_Root_CA_-_G2.crt + - thawte_Primary_Root_CA_-_G3.crt + - VeriSign_Class_3_Public_Primary_Certification_Authority_-_G4.crt + - VeriSign_Universal_Root_Certification_Authority.crt + Changed: + - Verisign_Class_1_Public_Primary_Certification_Authority.crt + - Verisign_Class_3_Public_Primary_Certification_Authority.crt + * Remove telesec.de/deutsche-telekom-root-ca-2.crt, now in mozilla. + * String decode the mozilla certdata.txt so the filenames show up as + proper UTF-8 strings. + + -- Kurt Roeckx <kurt@roeckx.be> Thu, 21 Apr 2011 18:56:08 +0200 + +ca-certificates (20090814+nmu3) unstable; urgency=low + + * Non-maintainer upload. + * Fix pending l10n issues. Debconf translations: + - French (Christian Perrier). Closes: #594231 + - Danish (Joe Hansen). Closes: #601129 + - Catalan (Jordi Mallach). Closes: #601089 + - Brazilian Portuguese (Adriano Rafael Gomes). Closes: #618633 + + -- Christian Perrier <bubulle@debian.org> Sat, 19 Mar 2011 07:47:00 +0100 + +ca-certificates (20090814+nmu2) unstable; urgency=low + + * Non-maintainer upload. + * Fixes buggy shell functions included in the postinst script. + (Closes: #591607) + + -- Maximiliano Curia <maxy@debian.org> Fri, 13 Aug 2010 20:16:21 -0300 + +ca-certificates (20090814+nmu1) unstable; urgency=low + + * Non-maintainer upload. + * Preserve user changes to the /etc/ca-certificates.conf. + (Closes: #514220) + + -- Maximiliano Curia <maxy@debian.org> Fri, 30 Jul 2010 12:55:28 -0400 + +ca-certificates (20090814) unstable; urgency=low + + * Call Debconf and its db_purge as early as possible in postrm. + (Closes: #541275) + + -- Philipp Kern <pkern@debian.org> Fri, 14 Aug 2009 11:10:00 +0200 + +ca-certificates (20090709) unstable; urgency=low + + * Fix purge by checking for `/etc/ssl/certs' first. (Closes: #536331) + + -- Philipp Kern <pkern@debian.org> Thu, 09 Jul 2009 10:35:39 +0200 + +ca-certificates (20090708) unstable; urgency=low + + * Removed CA files: + - cacert.org/root.crt and cacert.org/class3.crt: + Both certificate files were deprecated with 20080809. Users of these + root certificates are encouraged to switch to + `cacert.org/cacert.org.crt' which contains both class 1 and class 3 + roots joined in a single file. + - quovadis.bm/QuoVadis_Root_Certification_Authority.crt: + This certificate has been added into the Mozilla truststore and + is available as `mozilla/QuoVadis_Root_CA.crt'. + * Do not redirect c_rehash error messages to /dev/null. + (Closes: #495224) + * Remove dangling symlinks on purge, which also gets rid of the hash + symlink for ca-certificates.crt. (Closes: #475240) + * Use subshells when grepping for certificates in config, avoiding + SIGPIPE because of grep's immediate exit after it finds the pattern. + (Closes: #486737) + * Fix VERBOSE_ARG usage in update-ca-certificates. Thanks to + Robby Workman of Slackware. + * Updated Standards-Version and FSF portal address in the copyright file. + + -- Philipp Kern <pkern@debian.org> Wed, 08 Jul 2009 23:19:56 +0200 + +ca-certificates (20090701) unstable; urgency=low + + * Reactivated "Equifax Secure Global eBusiness CA". (Closes: #534674) + Rationale: The rogue collision CA has its validity period in the past. + Thus it does not impose a risk upon us at the moment. + * Restrict search for local certificates to add on files ending with '.crt'. + * Canonicalize PEM names by applying the same set of substitions to + local and other certificates like the Mozilla certdata dumper does. + + -- Philipp Kern <pkern@debian.org> Wed, 01 Jul 2009 14:50:00 +0200 + +ca-certificates (20090624) unstable; urgency=low + + * Allow local certificate installation. All certificates found + in `/usr/local/share/ca-certificates' will be automatically added + to the list of trusted certificates in `/etc/ssl/certs'. + (Closes: #352637, #419491, #473677, #476663, #511150) + * Updated Mozilla certificates from nss 3.12.3-1 (certdata.txt revision + 1.51): + + COMODO ECC Certification Authority + + DigiNotar Root CA + + Network Solutions Certificate Authority + + WellsSecure Public Root Certificate Authority + - Equifax Secure Global eBusiness CA + - UTN USERFirst Object Root CA + * Reimplemented the Mozilla certdata parser mainly to exclude explicitly + untrusted certificates. This led to the exclusion of the + "MD5 Collisions Forged Rogue CA 23c3" and its parent + "Equifax Secure Global eBusiness CA". Furthermore code signing-only + certificates are no longer included neither. + * Remove the purging of old PEM files in postinst dating back to + versions earlier than 20030414. + * Hooks are now called at every invocation of `update-ca-certificates'. + If no changes were done to `/etc/ssl/certs', the input for the + hooks will be empty, though. Failure exit codes of hooks will not + tear down the upgrade process anymore. They are printed but ignored. + + -- Philipp Kern <pkern@debian.org> Wed, 24 Jun 2009 21:04:08 +0200 + +ca-certificates (20081127) unstable; urgency=low + + * Remove /etc/ssl{,/certs} in postrm to please piuparts. (Closes: + #454334) + + -- Philipp Kern <pkern@debian.org> Thu, 27 Nov 2008 19:13:17 +0100 + +ca-certificates (20080809) unstable; urgency=low + + * New cacert.org.pem joining both CACert Class 1 and Class 3 certificates. + This file can be used for proper certificate chaining if CACert + server certificates are used. The old class3.pem and root.pem + certificates are deprecated. This new file could safely serve as + a replacement for both. (Closes: #494343) + * This also reintroduces the old name for the CACert certificate, + thus closing a long-standing bug about its rename to root.crt. + (Closes: #413766) + + -- Philipp Kern <pkern@debian.org> Sat, 09 Aug 2008 14:58:24 -0300 + +ca-certificates (20080617) unstable; urgency=low + + * Added French Government's IGC/A CA (both DSA and RSA). + (Closes: #416470) + + -- Philipp Kern <pkern@debian.org> Mon, 23 Jun 2008 20:55:53 +0200 + +ca-certificates (20080616) unstable; urgency=low + + * Fix installation on pt_BR locales. The problem was caused by the + .templates choices strings being marked for translation, with pt_BR + being the only language which actually translated them. Thanks to + Ubuntu for the fix, which needs to be around until Lenny is released + or six months have passed, whichever is later. (Closes: #472507) + * Drop Fumitoshi from the list of maintainers. Farewell! + * Bump Standards-Version to 3.8.0. + + -- Philipp Kern <pkern@debian.org> Mon, 16 Jun 2008 17:41:50 +0200 + +ca-certificates (20080514) unstable; urgency=medium + + * Added the new SPI CA certificate, created in response to the latest + openssl security update. + * Removed old SPI CA certificates (2006, 2007) as CAs cannot be + revoked sensibly. Expired CA created in 2003, expired in 2007 left + around for reference. + * Updated the Galician translation, thanks to Glennie Vignarajah. + (Closes: #416470) + + -- Philipp Kern <pkern@debian.org> Wed, 14 May 2008 10:03:42 +0200 + +ca-certificates (20080411) unstable; urgency=low + + * Added the current SPI CA certificate, used by Debian's infrastructure. + * Added Deutsche Telekom Root CA 2, which is used by German institutions + through the DFN PKI. + * Updated mozilla certificates from trunk, which led to the following + adds (+) and removes (-): + + Camerfirma Chambers of Commerce Root + + Camerfirma Global Chambersign Root + + Certplus Class 2 Primary CA + + COMODO Certification Authority + + DigiCert Assured ID Root CA + + DigiCert Global Root CA + + DigiCert High Assurance EV Root CA + + DST ACES CA X6 + + DST Root CA X3 + + Entrust Root Certification Authority + + Firmaprofesional Root CA + + GeoTrust Global CA 2 + + GeoTrust Primary Certification Authority + + GeoTrust Universal CA + + GeoTrust Universal CA 2 + + GlobalSign Root CA - R2 + + Go Daddy Class 2 CA + + NetLock Business (Class B) Root + + NetLock Express (Class C) Root + + NetLock Notary (Class A) Root + + NetLock Qualified (Class QA) Root + + QuoVadis Root CA 2 + + QuoVadis Root CA 3 + + Secure Global CA + + SecureTrust CA + + Starfield Class 2 CA + + StartCom Certification Authority + + StartCom Ltd. + + Swisscom Root CA 1 + + SwissSign Gold CA - G2 + + SwissSign Platinum CA - G2 + + SwissSign Silver CA - G2 + + Taiwan GRCA + + thawte Primary Root CA + + TURKTRUST Certificate Services Provider Root 1 + + TURKTRUST Certificate Services Provider Root 2 + + VeriSign Class 3 Public Primary Certification Authority - G5 + + Wells Fargo Root CA + + XRamp Global CA Root + - Verisign Class 1 Public Primary OCSP Responder + - Verisign Class 2 Public Primary OCSP Responder + - Verisign Class 3 Public Primary OCSP Responder + - Verisign Secure Server OCSP Responder + (Closes: #447062, #456581) + * Updated the Russian debconf translation, thanks to Mikhail Gusarov. + (Closes: #434856) + * Reworded the description and made it static to ease translations. + * Reworded and amended README.Debian. + * Added myself to the uploaders of this package. + * Applied a patch by Martin F. Krafft to support hooks scripts + on add/remove of a certificate. (Closes: #377314) + + -- Philipp Kern <pkern@debian.org> Sat, 12 Apr 2008 17:35:26 +0200 + +ca-certificates (20070303-0.1) unstable; urgency=low + + * Non-maintainer upload to fix longstanding pending l10n issues. + * Debconf templates and debian/control reviewed by the debian-l10n- + english team as part of the Smith review project. + Closes: #432249, #434789 + * Debconf translation updates: + - Japanese. Closes:#433067 + - Basque. Closes: #433074 + - Spanish. Closes: #433078 + - Czech. Closes: #433100 + - Galician. Closes: #433215 + - Russian. Closes: #433224 + - Swedish. Closes: #433432 + - Vietnamese. Closes: #433792, #427000, #434992 + - Dutch. Closes: #434670 + - German. Closes: #434788 + - Italian. Closes: #435029 + * Portuguese. Closes: #435471 + * Finnish. Closes: #448826 + * Remove /etc/ssl when purging the package (only if that + directory is empty). Closes: #454334 + * [Lintian] Give a reference to the GPL text in debian/copyright + * [Lintian] No longer ignore errors from "make clean" + * [Lintian] Upgrade debhelper compatibility to 4 (with debian/compat). + + -- Christian Perrier <bubulle@debian.org> Thu, 14 Feb 2008 19:52:37 +0100 + +ca-certificates (20070303) unstable; urgency=low + + * Add debconf.org crt. closes: Bug#342088 + * Add cacert class3 crt. closes: Bug#350282 + * Add debian/po/pt.po. closes: Bug#408183 + * Update debian/po/ru.po. closes: Bug#410770 + * Update debian/po/pt_BR.po. closes: Bug#403824 + * Add debian/po/gl.po. closes: Bug#407951 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Sun, 4 Mar 2007 14:12:23 +0900 + +ca-certificates (20061027.2) unstable; urgency=low + + * Non-maintainer upload to fix an RC issue revealed by the last NMU. + * Avoid cd to /etc/ssl/certs to removing hash symlinks + Closes: #408469 + + -- Christian Perrier <bubulle@debian.org> Fri, 2 Feb 2007 07:23:27 +0100 + +ca-certificates (20061027.1) unstable; urgency=low + + * Non-maintainer upload to fix remaining l10n issues + * Debconf translation updates: + - Czech. Closes: #407807 + - Spanish. Closes: #401968 + - German. Closes: #396942 + * Add debconf-updatepo to the clean target in debian/rules + to guarantee up-to-date PO(T) files + + -- Christian Perrier <bubulle@debian.org> Mon, 22 Jan 2007 18:56:53 +0100 + + +ca-certificates (20061027) unstable; urgency=low + + * sbin/update-ca-certificates: + in fresh mode, rm symlinks only point to /usr/share/ca-certificates. + preserve other symlinks. closes: Bug#387089 + * debian/po/nl.po: updated + closes: Bug#386767 + * debian/po/fr.po: updated + closes: Bug#386806 + * debian/po/da.po: updated + closes: Bug#388018 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Sat, 28 Oct 2006 02:28:50 +0900 + +ca-certificates (20060816) unstable; urgency=low + + * debian/control: explicitly mention that trustworthiness of certificate + authorities is not evaluated. + closes: Bug#350726 + * debian/templates: refine messages + closes: Bug#309481 + * debian/postinst: remove tailing spaces to avoid unnecessary dpkg-old file. + closes: Bug#349346 + * debian/control: libssl0.9.7->libssl0.9.8 + closes: Bug#345197 + * debian/postrm: remove .dpkg-old files + closes: Bug#349351 + * debian/README.Debian: fix + closes: Bug#354509 + * debian/postinst: fix typo + closes: Bug#355271 + * debian/po/sv.po: added + closes: Bug#330984 + * debian/po/es.po: added + closes: Bug#334383 + * add new SPI CA certificate + submitted by Michael C. Schultheiss <schultmc@debian.org> + + -- Fumitoshi UKAI <ukai@debian.or.jp> Thu, 17 Aug 2006 13:12:27 +0900 + +ca-certificates (20050804) unstable; urgency=low + + * use ${misc:Depends} in debian/control for debconf + * update description in debian/control + closes: Bug#309547 + * update debian/po/vi.po + closes: Bug#313186 + * update debian/po/de.po + closes: Bug#313678 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Thu, 4 Aug 2005 01:29:38 +0900 + +ca-certificates (20050518) unstable; urgency=high + + * fix ca-certificates.crt generationumask-sensitive and racy + closes: Bug#296212 + * update mozilla/certdata.txt + add: "Certum Root CA", "Comodo AAA Services root" + "Comodo Secure Services root", + "Comodo Trusted Services root", + "IPS Chained CAs root", "IPS CLASE1 root", "IPS CLASE3 root", + "IPS CLASEA1 root", "IPS CLASEA3 root", "IPS Servidores root" + "IPS Timestamping root", + "QuoVadis Root CA", + "Security Communication Root CA", + "Sonera Class 1 Root CA", "Sonera Class 2 Root CA", + "Staat der Nederlanden Root CA", + "TDC Internet Root CA", "TDC OCES Root CA", + "UTN DATACorp SGC Root CA", "UTN USERFirst Email Root CA", + "UTN USERFirst Hardware Root CA", "UTN USERFirst Object Root CA" + * add CACert.org's Root CA + closes: Bug#213086, Bug#288293 + * add debian/po/vi.po + closes: Bug#309480 + * add debian/po/cs.po + closes: Bug#309019 + * write "How certificate will be accepted in ca-certificates package" + in README.Debain + + -- Fumitoshi UKAI <ukai@debian.or.jp> Wed, 18 May 2005 00:40:54 +0900 + +ca-certificates (20040809) unstable; urgency=low + + * previous version was not fixed Bug#255933 correctly. + update-ca-certificates now remove symlinks of deselected entries + in ca-certificates.conf + closes: Bug#255933 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Mon, 9 Aug 2004 03:23:20 +0900 + +ca-certificates (20040808) unstable; urgency=low + + * run update-ca-certificates by /bin/sh -e + closes: Bug#247581 + * update-ca-certificates remove symlinks of deselected entries + in ca-certificates.conf + closes: Bug#255933 + * change default of trust_new_crts from 'ask' to 'yes' + closes: Bug#218838, Bug#221527, Bug#236675, Bug#247509 + * refer libssl0.9.7 instead of libssl0.9.6 in Enhances: + closes: Bug#251158 + * add brasil.gov.br certs + closes: Bug#224612 + * add Signet CA Roots certs + closes: Bug#233206 + * add QuoVadis CA Roots certs + closes: Bug#250847 + * update pt_BR.po + closes: Bug#218812 + * add da.po + closes: Bug#235322 + * add ca.po + closes: Bug#237124 + * add nl.po + closes: Bug#23840 + * add de.po + closes: Bug#250785 + * fix quote characters in template + closes: Bug#255738 + * remove debian.org, because certs used in db.debian.org has been + revoked due to debian.org crack incidents. + db.debian.org uses certificates using spi-inc.org Root CA. + + -- Fumitoshi UKAI <ukai@debian.or.jp> Sun, 8 Aug 2004 10:58:30 +0900 + +ca-certificates (20031007.1) unstable; urgency=low + + * NMU + * Add brasil.gov.br/brasil.gov.br.crt, created from + http://www.icpbrasil.gov.br/certificadoACRaiz.crt + * Add debian/po/pt_BR.po: closes: Bug#224612 + + -- Otavio Salvador <otavio@debian.org> Thu, 5 Aug 2004 12:16:26 -0300 + +ca-certificates (20031007) unstable; urgency=low + + * add debian/po/ru.po: closes: Bug#214371 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Tue, 7 Oct 2003 03:06:06 +0900 + +ca-certificates (20030924) unstable; urgency=low + + * add debian/po/ja.po: closes: Bug#212565 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Wed, 24 Sep 2003 22:09:09 +0900 + +ca-certificates (20030916) unstable; urgency=low + + * add debian/po/fr.po: closes: Bug#211224, Bug#206769 + * debian/config: if new cert is asked, don't ask all available certs + closes: Bug#211199 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Wed, 17 Sep 2003 02:12:14 +0900 + +ca-certificates (20030915) unstable; urgency=low + + * debian/config.in: fix typo. closes: Bug#190990 + * add option for new CA certificates. closes: Bug#190989 + * switch to gettext-based debconf templates. closes: Bug#205782 + * update mozilla/certdata.txt from mozilla 1.4 release + + -- Fumitoshi UKAI <ukai@debian.or.jp> Mon, 15 Sep 2003 01:15:04 +0900 + +ca-certificates (20030420) unstable; urgency=low + + * add README.Debian and update-ca-certificates(8). closes: Bug#189604 + * fix broken English in debconf template. closes: Bug#189606 + * don't remove symlinks in /etc/ssl/certs. closes: Bug#189607 + * preserve comments in /etc/ca-certificates.conf when upgrading. + closes: Bug#189611 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Mon, 21 Apr 2003 00:06:01 +0900 + +ca-certificates (20030415) unstable; urgency=medium + + * fix upgrade problem + closes: Bug#188938, Bug#188940 + * purge debconf + + -- Fumitoshi UKAI <ukai@debian.or.jp> Mon, 14 Apr 2003 23:00:58 +0900 + +ca-certificates (20030414) unstable; urgency=medium + + * certificates are installed in /usr/share/ca-certificates + you can find md5sum of certs files. closes: Bug#170777 + + * debconf to generate /etc/ca-certificates.conf + * update-ca-certificates update /etc/ssl/certs according + /etc/ca-certificates.conf + It also generate /etc/ssl/certs/ca-certificates.crt + which is single-file version of certs. + closes: Bug#158904 + + * change extension from .pem to .crt in /usr/share/ca-certificates + - /etc/mime.types: + application/x-x509-ca-cert crt + but it will be hardlink or copied in /etc/ssl/certs with .pem + extension by update-ca-certificates. + c_rehash requires .pem extension + + * Update certificate from mozilla 2:1.3-4 + mozilla/security/nss/lib/ckfw/builtins/certdata.txt + cefd05b299ea683fc6b1ce9ff1e23a3f mozilla/certdata.txt + + * Add spi-inc.org/spi-ca.crt from http://www.spi-inc.org/secretary/ + 33922a1660820e44812e7ddc392878cb spi-inc.org/spi-ca.crt + % openssl x509 -in spi-inc.org/spi-ca.crt -fingerprint -noout + MD5 Fingerprint=ED:85:3A:FD:32:43:13:73:91:4D:94:06:C4:10:EB:E5 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Mon, 14 Apr 2003 00:02:48 +0900 + +ca-certificates (20020323) unstable; urgency=low + + * Moved from non-US to main now that openssl has moved there. + + -- Fumitoshi UKAI <ukai@debian.or.jp> Sun, 24 Mar 2002 03:11:54 +0900 + +ca-certificates (20020208) unstable; urgency=low + + * add db.debian.org certificate + + -- Fumitoshi UKAI <ukai@debian.or.jp> Fri, 8 Feb 2002 23:46:11 +0900 + +ca-certificates (20020112) unstable; urgency=low + + * upload to non-US instead of main, because it depends on openssl + (it uses c_rehash in openssl in maintainer scripts) + + -- Fumitoshi UKAI <ukai@debian.or.jp> Sun, 13 Jan 2002 04:30:28 +0900 + +ca-certificates (20020107) unstable; urgency=low + + * Initial Release. closes: Bug#126586 + + -- Fumitoshi UKAI <ukai@debian.or.jp> Mon, 7 Jan 2002 21:16:51 +0900 |