Merge branch 'debian-buster' into debian-stretch

The CA add/remove info is in the changelog for users that wish to know
what certificate authorities were added or removed. The default
installation of apt-listchanges results in lots of emails from users
wondering why the package maintainer is emailing them or halting their
automated upgrades.

debian/changelog

@@ -1,3 +1,10 @@
+ca-certificates (20200611~deb9u1) stretch; urgency=medium
+
+  * Rebuild for stretch.
+  * This oldstable release Closes: #962596, #942915
+
+ -- Michael Shuler <michael@pbandjelly.org>  Thu, 11 Jun 2020 09:11:56 -0500
+
 ca-certificates (20200611) unstable; urgency=medium
 
   * mozilla/blacklist:

debian/compat

@@ -0,0 +1 @@
+10

debian/control

@@ -4,15 +4,15 @@ Priority: optional
 Maintainer: Michael Shuler <michael@pbandjelly.org>
 Uploaders: Raphael Geissert <geissert@debian.org>,
            Thijs Kinkhorst <thijs@debian.org>
-Build-Depends: debhelper-compat (= 13), po-debconf
+Build-Depends: debhelper (>= 10), po-debconf
 Build-Depends-Indep: python3, openssl
-Standards-Version: 4.5.0.2
+Standards-Version: 3.9.8
 Vcs-Git: https://salsa.debian.org/debian/ca-certificates.git
 Vcs-Browser: https://salsa.debian.org/debian/ca-certificates
 
 Package: ca-certificates
 Architecture: all
-Depends: openssl (>= 1.1.1), ${misc:Depends}
+Depends: openssl (>= 1.0.0), ${misc:Depends}
 Enhances: openssl
 Multi-Arch: foreign
 Breaks: ca-certificates-java (<<20121112+nmu1)

debian/gbp.conf

@@ -1,2 +1,2 @@
 [buildpackage]
-debian-branch = master
+debian-branch = debian-stretch

debian/rules

@@ -60,7 +60,7 @@ install: build
 	install -d -m 0755 "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
 	(cd mozilla; \
 	 $(MAKE) install CERTSDIR="$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs")
-	openssl rehash -v "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
+	c_rehash -v "$(CURDIR)/debian/ca-certificates-udeb/etc/ssl/certs"
 
 # Build architecture-independent files here.
 binary-indep: build install

sbin/update-ca-certificates

@@ -172,20 +172,11 @@ REMOVED_CNT=$(wc -l < "$REMOVED")
 if [ "$ADDED_CNT" -gt 0 ] || [ "$REMOVED_CNT" -gt 0 ]
 then
   # only run if set of files has changed
-  # Remove orphan symlinks found in ETCCERTSDIR to prevent `openssl rehash`
-  # from exiting with an error. See #895482, #895473.
-  find $ETCCERTSDIR -type l ! -exec test -e {} \; -print | while read orphan
-  do
-    rm -f "$orphan"
-    if [ "$verbose" = 1 ]; then
-      echo "Removed orphan symlink $orphan"
-    fi
-  done
   if [ "$verbose" = 0 ]
   then
-    openssl rehash . > /dev/null
+    c_rehash . > /dev/null
   else
-    openssl rehash -v .
+    c_rehash .
   fi
 fi
 

sbin/update-ca-certificates.8

@@ -50,7 +50,7 @@ A summary of options is included below.
 Show summary of options.
 .TP
 .B \-v, \-\-verbose
-Be verbose. Output \fBopenssl rehash\fP.
+Be verbose. Output \fBc_rehash\fP.
 .TP
 .B \-f, \-\-fresh
 Fresh updates.  Remove symlinks in /etc/ssl/certs directory.
@@ -69,7 +69,7 @@ Directory of CA certificates.
 .I /usr/local/share/ca-certificates
 Directory of local CA certificates (with .crt extension).
 .SH SEE ALSO
-.BR openssl (1)
+.BR c_rehash (1)
 .SH AUTHOR
 This manual page was written by Fumitoshi UKAI <ukai@debian.or.jp>,
 for the Debian project (but may be used by others).