.gitignore

@@ -9,4 +9,3 @@ debian/ca-certificates-st.substvars
 debian/files
 pkg
 src
-packages

Makefile

@@ -9,7 +9,7 @@ SHELL:=/bin/bash
 build:
 	./release_pkg.sh
 
-install: $(wildcard certs/*.pem)
+install: $(wildcard certs/*.pem) $(wildcard certs/secureboot/*.pem)
 	${INSTALL} -d ${DESTDIR}/usr/share/ca-certificates
 	ls -la ${DESTDIR}/usr/share/ca-certificates
 	@for cert in $^ ; do

build.pkg

@@ -1,16 +1,8 @@
 #!/bin/bash
 set -eu -o pipefail
 podmanrun() {
-    mkdir -p packages
-    podman run --pull=newer --rm \
-        -e VAULT_ADDR=http://vault.home.internal --secret=VAULT_TOKEN,type=env \
-        --userns keep-id:uid=1000,gid=1000 \
-        -v .:/src/build:O \
-        -v ./packages:/src/build/packages \
-        -w /src/build \
-        "$1" "/src/build/build_$2.sh"
+    podman run --pull=newer --rm -t -e VAULT_ADDR=http://vault.home.internal --secret=VAULT_TOKEN,type=env --userns keep-id:uid=1000,gid=1000 -v .:/src/build -w /src/build "$1" "/src/build/build_$2.sh"
 }
 
 podmanrun "gitea.sebastian-tobie.de/docker/debian:bookworm" "debian"
 podmanrun "gitea.sebastian-tobie.de/docker/archlinux" "archlinux"
-podmanrun "gitea.sebastian-tobie.de/docker/ubi:9" "ubi"

build_ubi.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-set -eu -o pipefail
-printf "%%%s %s\n" \
-    _topdir /src \
-    _rpmdir "$PWD/packages" \
-    _srcrpmdir "$PWD/packages" \
-    _builddir $(mktemp -d -p /src BUILD-XXXXXX) \
-    _rpmfilename '%%{NAME}-%%{VERSION}-%%{RELEASE}.%%{ARCH}.rpm' \
-    | tee ~/.rpmmacros
-rpmdev-setuptree
-sudo dnf builddep -y package.spec
-cp release_pkg.sh /src/SOURCES
-rpmbuild --quiet -bb package.spec

package.spec

@@ -1,27 +0,0 @@
-Name: ca-certificates-st
-Version: 1.0
-Release: 1
-Source: release_pkg.sh
-License: Propietary
-BuildArch: noarch
-Requires: ca-certificates
-BuildRequires: bao jq
-Summary: Meine Zertifikate
-
-%description
-Meine Zertifikate
-
-%prep
-%setup -T -c
-cp %SOURCE0 .
-
-%build
-./release_pkg.sh
-
-%install
-install -d %{buildroot}%{_datadir}/ca-certificates/trust-source/
-install -m 0644 certs/*.pem %{buildroot}%{_datadir}/ca-certificates/trust-source
-
-%files
-%defattr(0644, root, root , 0755)
-%{_datadir}/ca-certificates/trust-source/*

release_pkg.sh

@@ -24,4 +24,4 @@ download_certs() {
 
 download_certs "root_ca" "certs" "anyExtendedKeyUsage"
 download_certs "acme_ca" "certs" "anyExtendedKeyUsage"
-download_certs "secureboot_ca" "certs" "codeSigning"
+download_certs "secureboot_ca" "certs/secureboot" "codeSigning"