From: Lars Wendler <polynomial-c@gentoo.org>
Date: Tue, 8 Aug 2017 07:38:15 +0000 (+0200)
Subject: app-misc/ca-certificates: Fixed removal of untrusted certs (#616002).
X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=b2cae8b25d30cee6412433139fbc323f08cffb8a;p=gentoo.git

app-misc/ca-certificates: Fixed removal of untrusted certs (#616002).

Package-Manager: Portage-2.3.6, Repoman-2.3.3
---

diff --git a/app-misc/ca-certificates/ca-certificates-20161130.3.30.2.ebuild b/app-misc/ca-certificates/ca-certificates-20161130.3.30.2.ebuild
index a72077ebef87..45efcd9d5817 100644
--- a/app-misc/ca-certificates/ca-certificates-20161130.3.30.2.ebuild
+++ b/app-misc/ca-certificates/ca-certificates-20161130.3.30.2.ebuild
@@ -138,9 +138,15 @@ src_compile() {
 	fi
 
 	if ! use insecure_certs ; then
+		elog "To prevent applications relying on system's trusted root certificate store"
+		elog "from using CAs where at least one major browser vendor Gentoo is following"
+		elog "has decided to apply trust level restrictions, the following"
+		elog "certificate(s) were removed:"
 		# Remove untrusted certs from StartCom and WoSign (bug #598072)
-		rm "${c}"/mozilla/StartCom* || die
-		rm "${c}"/mozilla/WoSign* || die
+		elog "$(find "${c}" -type f \( \
+			-iname '*startcom*' \
+			-o -iname '*wosign*' \
+			\) -printf '%P removed; see https://bugs.gentoo.org/598072 for details\n' -delete)"
 	fi
 
 	(