Testing Workflow

.github/workflows/build-rpm.yml

@@ -0,0 +1,71 @@
+name: Build RPM Package
+
+on:
+  push:
+    tags:
+      - v[0-9]+.[0-9]+.[0-9]+
+
+jobs:
+  build-rpm:
+    name: Build and upload RPM packages
+    runs-on: ubuntu-latest
+    container:
+      image: fedora:latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: install RPM build tools
+      run: |
+        dnf -y install \
+          cmake \
+          gcc \
+          gcc-c++ \
+          git \
+          rpm-build \
+          rpmdevtools \
+          tar
+
+    - name: Setup RPM build tree
+      run: |
+        rpmdev-setuptree
+
+    - name: Create source tarball
+      run: |
+        cmake -B build -S .
+        cmake --build build --target sdist
+
+    - name: Set environment variables
+      run: |
+        echo "PKG_NAME=ca-certificates-brazil" >> $GITHUB_ENV
+        echo "PKG_VERSION=$(grep \
+            -m1 -iPo '.*CPACK_PACKAGE_VERSION [\"]*\K[\S]*[^(\"\))]' \
+            build/CPackConfig.cmake) \
+        " >> $GITHUB_ENV
+
+    - name: Copy SOURCES and SPEC file
+      run: |
+        cp packaging/pkg.spec.in ~/rpmbuild/SPECS/${PKG_NAME}.spec
+        rpmdev-bumpspec -n ${PKG_VERSION} ~/rpmbuild/SPECS/${PKG_NAME}.spec
+        cp dist/*.src.tar.gz ~/rpmbuild/SOURCES/
+
+    - name: Build RPM
+      run: |
+        dnf -y builddep ~/rpmbuild/SPECS/ca-certificates-brazil.spec
+        rpmbuild -ba ~/rpmbuild/SPECS/ca-certificates-brazil.spec
+
+    - name: Upload built RPMs
+      uses: actions/upload-artifact@v4
+      with:
+        name: built-rpms
+        path: |
+          ~/rpmbuild/RPMS/
+          ~/rpmbuild/SRPMS/
+
+    - name: Create GitHub Release
+      uses: softprops/action-gh-release@v2
+      if: github.ref_type == 'tag'
+      with:
+        generate_release_notes: true
+        files: |
+          ~/rpmbuild/RPMS/**/*.rpm

.gitignore

@@ -0,0 +1,17 @@
+.cache
+.clang-format
+.clangd
+.idea
+
+cmake-build*
+build/
+ _CPack_Packages/
+ CMakeFiles/
+ Makefile
+ cmake_install.cmake
+ CPackConfig.cmake
+ CPackSourceConfig.cmake
+ CTestTestfile.cmake
+ CMakeCache.txt
+
+dist/

CMakeLists.txt

@@ -0,0 +1,108 @@
+cmake_minimum_required(VERSION 3.16)
+
+project(ca-certificates-brazil)
+set(HASH_FILE "hashsha512.txt")
+
+execute_process(
+  COMMAND bash -c 
+    "date +%Y.%m.%d \
+      -d \"$( \
+      curl -ksI $(grep ${HASH_FILE} ${CMAKE_SOURCE_DIR}/sources) \
+        | grep -iPo '^Last-Modified: \\K[\\S ]*'
+      )\"
+    "
+  OUTPUT_VARIABLE PROJECT_VERSION
+  OUTPUT_STRIP_TRAILING_WHITESPACE
+)
+
+set(SourceFiles 
+  "${CMAKE_SOURCE_DIR}/cmake"
+  "${CMAKE_SOURCE_DIR}/CMakeLists.txt"
+  "${CMAKE_SOURCE_DIR}/CPackLists.txt"
+  "${CMAKE_SOURCE_DIR}/sources"
+)
+
+include(CPackLists.txt)
+
+add_custom_target(clear-certs
+  COMMAND rm -rf 
+    certs/
+    pki/
+)
+
+add_custom_target(certs
+  COMMAND xargs -n1 
+    curl 
+      --create-dirs 
+      --output-dir certs 
+      -ksO < ${CMAKE_CURRENT_SOURCE_DIR}/sources
+    && cd certs
+    && (sha512sum -c --quiet ${HASH_FILE} || exit -1)
+    && unzip ACcompactado.zip
+  DEPENDS
+    clear-certs
+)
+
+add_custom_target(isrg-root-x2.crt
+  COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/crt2bundle.sh 
+    pki/ca-trust-source/anchors/isrg-root-x2.crt
+    certs/isrg-root-x2.pem
+  DEPENDS
+    certs
+)
+
+add_custom_target(lets-encrypt-ca-bundle.crt
+  COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/crt2bundle.sh
+    pki/ca-trust-source/anchors/lets-encrypt-ca-bundle.crt
+    certs/lets-encrypt-e1.pem
+    certs/lets-encrypt-e2.pem
+    certs/lets-encrypt-r3.pem
+    certs/lets-encrypt-r4.pem
+  DEPENDS
+    certs
+)
+
+add_custom_target(icp-brasil-ca-bundle.crt
+  COMMAND ${CMAKE_CURRENT_SOURCE_DIR}/crt2bundle.sh
+    pki/ca-trust-source/anchors/icp-brasil-ca-bundle.crt
+    certs/*.crt
+  DEPENDS
+    certs
+)
+
+add_custom_target(anchors ALL
+  DEPENDS
+    isrg-root-x2.crt
+    lets-encrypt-ca-bundle.crt
+    icp-brasil-ca-bundle.crt
+)
+
+# Checks which tool is used to update certificate keyring
+find_program(UPDATE_CACERTS_TOOL
+  NAMES
+    update-ca-certificates
+    update-ca-trust
+  REQUIRED
+)
+message("-- Check for CA certificates update tool: ${UPDATE_CACERTS_TOOL}")
+string(REGEX MATCH "update-ca-trust" P11KIT UPDATE_CACERTS_TOOL)
+string(REGEX MATCH "update-ca-certificates" LEGACY UPDATE_CACERTS_TOOL)
+
+# Set install destination directory according the used tool
+if(DEFINED P11KIT)
+  set(CACERT_INSTALL_DIR "share/pki/ca-trust-source/anchors")
+else()
+  set(CACERT_INSTALL_DIR "share/ca-certificates/extra")
+endif()
+message("-- Set install path to CA certificates: ${CACERT_INSTALL_DIR}")
+
+install(
+  FILES
+    ${CMAKE_CURRENT_BINARY_DIR}/pki/ca-trust-source/anchors/isrg-root-x2.crt
+    ${CMAKE_CURRENT_BINARY_DIR}/pki/ca-trust-source/anchors/lets-encrypt-ca-bundle.crt
+    ${CMAKE_CURRENT_BINARY_DIR}/pki/ca-trust-source/anchors/icp-brasil-ca-bundle.crt
+  DESTINATION
+    ${CMAKE_INSTALL_PREFIX}/${CACERT_INSTALL_DIR}
+)
+
+# vim: ts=2:sw=2:sts=2:et

CPackLists.txt

@@ -0,0 +1,80 @@
+cmake_minimum_required(VERSION 3.16)
+
+set(CPACK_PACKAGE_VERSION "${PROJECT_VERSION}")
+set(CPACK_OUTPUT_FILE_PREFIX "${PROJECT_SOURCE_DIR}/dist")
+set(CPACK_VERBATIM_VARIABLES YES)
+
+set(SourceIgnoreFiles 
+  ".cache"
+  ".clang-format"
+  ".clangd"
+  ".git/"
+  ".gitea/"
+  ".github/"
+  ".gitignore"
+  ".idea"
+  "CMakeCache.txt"
+  "CMakeFiles/"
+  "CPackConfig.cmake$"
+  "CPackSourceConfig.cmake"
+  "CTestTestfile.cmake"
+  "Makefile"
+  "_CPack_Packages/"
+  "build/"
+  "cmake-build*"
+  "cmake_install.cmake"
+  "dist/"
+)
+
+# Escape any '.' and '/' characters
+string(REPLACE "." "\\\." SourceIgnoreFiles "${SourceIgnoreFiles}")
+string(REPLACE "/" "\\\/" SourceIgnoreFiles "${SourceIgnoreFiles}")
+
+# Override install prefix for package target
+string(REGEX REPLACE "^/(.*)" "\\1" 
+  CPACK_PACKAGING_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}"
+)
+set(CPACK_SET_DESTDIR ON)
+
+set(CPACK_GENERATOR "TGZ")
+set(CPACK_PACKAGE_TOPLEVEL_TAG "noarch")
+set(CPACK_INCLUDE_TOPLEVEL_DIRECTORY 0)
+set(CPACK_PACKAGE_FILE_NAME "${PROJECT_NAME}-${PROJECT_VERSION}.${CPACK_PACKAGE_TOPLEVEL_TAG}")
+set(CPACK_IGNORE_FILES "${SourceIgnoreFiles}")
+set(CPACK_OUTPUT_CONFIG_FILE "${PROJECT_BINARY_DIR}/CPackConfig.cmake")
+configure_file(
+  "${PROJECT_SOURCE_DIR}/cmake/CPackConfig.cmake.in"
+  "${PROJECT_BINARY_DIR}/CPackConfig.cmake"
+  @ONLY
+)
+
+set(CPACK_SOURCE_GENERATOR "TGZ")
+set(CPACK_SOURCE_TOPLEVEL_TAG "src")
+set(CPACK_SOURCE_PACKAGE_FILE_NAME "${PROJECT_NAME}-${PROJECT_VERSION}.${CPACK_SOURCE_TOPLEVEL_TAG}")
+set(CPACK_SOURCE_IGNORE_FILES "${SourceIgnoreFiles}")
+set(CPACK_SOURCE_OUTPUT_CONFIG_FILE "${PROJECT_BINARY_DIR}/CPackSourceConfig.cmake")
+configure_file(
+  "${PROJECT_SOURCE_DIR}/cmake/CPackConfig.cmake.in"
+  "${PROJECT_BINARY_DIR}/CPackSourceConfig.cmake"
+  @ONLY
+)
+
+include(CPack)
+
+add_custom_target(sdist
+  COMMAND "${CMAKE_COMMAND}"
+    --build "${CMAKE_BINARY_DIR}"
+    --target package_source
+  VERBATIM
+  USES_TERMINAL
+)
+
+add_custom_target(bdist
+  COMMAND "${CMAKE_COMMAND}"
+    --build "${CMAKE_BINARY_DIR}"
+    --target package
+  VERBATIM
+  USES_TERMINAL
+)
+
+# vim: ts=2:sw=2:sts=2:et:syntax=cmake

README.md

@@ -1,2 +1,12 @@
 # ca-certificates-brazil
 The Brazilian Public Key Infrastructure:  ICP-Brasil
+
+## Description
+The Brazilian Public Key Infrastructure - ICP-Brasil is a hierarchical chain
+of trust that enables the issuance of digital certificates for the virtual
+identification of citizens.
+
+It is observed that the model adopted by Brazil was single-root certification,
+and the ITI, in addition to playing the role of Root Certifying Authority - Root AC,
+also has the role of accrediting and discrediting the other participants in the
+chain, supervise and audit the processes.

cmake/CPackConfig.cmake.in

@@ -0,0 +1,29 @@
+# This file will be configured to contain variables for CPack. These variables
+# should be set in the CMake list file of the project before CPack module is
+# included. Example variables are:
+#   CPACK_GENERATOR                     - Generator used to create package
+#   CPACK_INSTALL_CMAKE_PROJECTS        - For each project (path, name, component)
+#   CPACK_CMAKE_GENERATOR               - CMake Generator used for the projects
+#   CPACK_INSTALL_COMMANDS              - Extra commands to install components
+#   CPACK_INSTALL_DIRECTORIES           - Extra directories to install
+#   CPACK_PACKAGE_DESCRIPTION_FILE      - Description file for the package
+#   CPACK_PACKAGE_DESCRIPTION_SUMMARY   - Summary of the package
+#   CPACK_PACKAGE_EXECUTABLES           - List of pairs of executables and labels
+#   CPACK_PACKAGE_FILE_NAME             - Name of the package generated
+#   CPACK_PACKAGE_ICON                  - Icon used for the package
+#   CPACK_PACKAGE_INSTALL_DIRECTORY     - Name of directory for the installer
+#   CPACK_PACKAGE_NAME                  - Package project name
+#   CPACK_PACKAGE_VENDOR                - Package project vendor
+#   CPACK_PACKAGE_VERSION               - Package project version
+#   CPACK_PACKAGE_VERSION_MAJOR         - Package project version (major)
+#   CPACK_PACKAGE_VERSION_MINOR         - Package project version (minor)
+#   CPACK_PACKAGE_VERSION_PATCH         - Package project version (patch)
+
+# There are certain generator specific ones
+
+# NSIS Generator:
+#   CPACK_PACKAGE_INSTALL_REGISTRY_KEY  - Name of the registry key for the installer
+#   CPACK_NSIS_EXTRA_UNINSTALL_COMMANDS - Extra commands used during uninstall
+#   CPACK_NSIS_EXTRA_INSTALL_COMMANDS   - Extra commands used during install
+
+@_CPACK_OTHER_VARIABLES_@

crt2bundle.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+out=${1}
+mkdir -p $(dirname ${out})
+shift
+
+in=''
+for c in ${*}; do
+  echo "+ Loading CA certificate: ${c}";
+  in="${in} -certfile ${c}";
+done;
+
+openssl crl2pkcs7 -nocrl ${in} \
+  | openssl pkcs7 -print_certs -out ${out}

packaging/pkg.spec.in

@@ -0,0 +1,52 @@
+%global debug_package %{nil}
+%global source_date_epoch_from_changelog 0
+
+%define __openssl   %{_bindir}/openssl
+
+Name:               ca-certificates-brazil
+Version:            __VERSION__
+Release:            %{autorelease}
+Summary:            The ICP-Brasil root certificate bundle
+
+License:            Public Domain
+URL:                https://www.gov.br/iti/pt-br/assuntos/certificado-digital
+Source0:            %{name}-%{version}.src.tar.gz
+
+BuildArch:          noarch
+BuildRequires:      %{__openssl}
+BuildRequires:      %{_bindir}/mktemp
+BuildRequires:      %{_bindir}/unzip
+
+%description
+The Brazilian Public Key Infrastructure - ICP-Brasil is a hierarchical chain 
+of trust that enables the issuance of digital certificates for the virtual 
+identification of citizens.
+
+It is observed that the model adopted by Brazil was single-root certification,
+and the ITI, in addition to playing the role of Root Certifying Authority - Root AC,
+also has the role of accrediting and discrediting the other participants in the 
+chain, supervise and audit the processes.
+
+%prep
+%autosetup -c
+%{cmake}
+
+%build
+%{cmake_build}
+
+%install
+%{__rm} -rf %{buildroot}
+%{cmake_install}
+
+
+%files
+%{_datadir}/pki/ca-trust-source/anchors/isrg-root-x2.crt
+%{_datadir}/pki/ca-trust-source/anchors/lets-encrypt-ca-bundle.crt
+%{_datadir}/pki/ca-trust-source/anchors/icp-brasil-ca-bundle.crt
+
+
+%post -p %{_bindir}/update-ca-trust
+%postun -p %{_bindir}/update-ca-trust
+
+%changelog
+%autochangelog

sources

@@ -0,0 +1,7 @@
+https://acraiz.icpbrasil.gov.br/credenciadas/CertificadosAC-ICP-Brasil/ACcompactado.zip
+https://acraiz.icpbrasil.gov.br/credenciadas/CertificadosAC-ICP-Brasil/hashsha512.txt
+https://letsencrypt.org/certs/isrg-root-x2.pem
+https://letsencrypt.org/certs/lets-encrypt-e1.pem
+https://letsencrypt.org/certs/lets-encrypt-e2.pem
+https://letsencrypt.org/certs/lets-encrypt-r3.pem
+https://letsencrypt.org/certs/lets-encrypt-r4.pem