main/ca-certificates: backport fix to restore still valid certs

The following certs are restored:

- Entrust.net Premium 2048 Secure Server CA
- Entrust Root Certification Authority
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC
- GLOBALTRUST 2020

ref: alpine/ca-certificates#6
fixes: alpine/aports#16812

main/ca-certificates/0001-mk-ca-bundle-remove-CKA_NSS_SERVER_DISTRUST_AFTER-co.patch

+From 103d13b09c84715b868b0acff1e8240cc4f0cdba Mon Sep 17 00:00:00 2001
+From: Kevin Daudt <kdaudt@alpinelinux.org>
+Date: Tue, 7 Jan 2025 17:41:44 +0100
+Subject: [PATCH] mk-ca-bundle: remove CKA_NSS_SERVER_DISTRUST_AFTER conditions
+
+Apply the [upstream patch][0] to restore certificates that are going to
+be removed in the future, but should still be available to verify
+existing certificates.
+
+Note that the CKA_NSS_SERVER_DISTRUST_AFTER attribute cannot be encoded
+in the generated certificate bundle, so that means newly generated
+certificates will be trusted as well. This is a trade-off between
+breaking existing certificates versus not trusting newly generated
+certificates.
+
+With this change, the following root certificates would be restored:
+
+- Entrust.net Premium 2048 Secure Server CA
+- Entrust Root Certification Authority
+- AffirmTrust Commercial
+- AffirmTrust Networking
+- AffirmTrust Premium
+- AffirmTrust Premium ECC
+- Entrust Root Certification Authority - G2
+- Entrust Root Certification Authority - EC
+- GLOBALTRUST 2020
+
+[0]:https://github.com/curl/curl/commit/448df98d9280b3290ecf63e5fc9452d487f41a7c.patch
+
+Fixes #6
+---
+ mk-ca-bundle.pl | 42 ------------------------------------------
+ 1 file changed, 42 deletions(-)
+
+diff --git a/mk-ca-bundle.pl b/mk-ca-bundle.pl
+index 926478f..3732213 100644
+--- a/mk-ca-bundle.pl
++++ b/mk-ca-bundle.pl
+@@ -552,48 +552,6 @@ while (<TXT>) {
+       }
+       next;
+     }
+-    elsif (/^CKA_NSS_SERVER_DISTRUST_AFTER (CK_BBOOL CK_FALSE|MULTILINE_OCTAL)/) {
+-      # Example:
+-      # CKA_NSS_SERVER_DISTRUST_AFTER MULTILINE_OCTAL
+-      # \062\060\060\066\061\067\060\060\060\060\060\060\132
+-      # END
+-      if($1 eq "MULTILINE_OCTAL") {
+-        my @timestamp;
+-        while (<TXT>) {
+-          last if (/^END/);
+-          chomp;
+-          my @octets = split(/\\/);
+-          shift @octets;
+-          for (@octets) {
+-            push @timestamp, chr(oct);
+-          }
+-        }
+-        scalar(@timestamp) == 13 or die "Failed parsing timestamp";
+-        # A trailing Z in the timestamp signifies UTC
+-        if($timestamp[12] ne "Z") {
+-          report "distrust date stamp is not using UTC";
+-        }
+-        # Example date: 200617000000Z
+-        # Means 2020-06-17 00:00:00 UTC
+-        my $distrustat =
+-          timegm($timestamp[10] . $timestamp[11], # second
+-                 $timestamp[8] . $timestamp[9],   # minute
+-                 $timestamp[6] . $timestamp[7],   # hour
+-                 $timestamp[4] . $timestamp[5],   # day
+-                 ($timestamp[2] . $timestamp[3]) - 1, # month
+-                 "20" . $timestamp[0] . $timestamp[1]); # year
+-        if(time >= $distrustat) {
+-          # not trusted anymore
+-          $skipnum++;
+-          report "Skipping: $main_block_name is not trusted anymore" if ($opt_v);
+-          $valid = 0;
+-        }
+-        else {
+-          # still trusted
+-        }
+-      }
+-      next;
+-    }
+     else {
+       next;
+     }
+-- 
+2.47.1
+

main/ca-certificates/APKBUILD

@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ca-certificates
 pkgver=20241121
-pkgrel=0
+pkgrel=1
 pkgdesc="Common CA certificates PEM files from Mozilla"
 url="https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/"
 arch="all"
@@ -15,7 +15,9 @@ replaces="openssl"
 options="!fhs !check"
 triggers="ca-certificates.trigger=/usr/share/ca-certificates:/usr/local/share/ca-certificates:/etc/ssl/certs:/etc/ca-certificates/update.d"
 install="$pkgname.post-deinstall"
-source="https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/$pkgver/ca-certificates-$pkgver.tar.bz2"
+source="https://gitlab.alpinelinux.org/alpine/ca-certificates/-/archive/$pkgver/ca-certificates-$pkgver.tar.bz2
+	0001-mk-ca-bundle-remove-CKA_NSS_SERVER_DISTRUST_AFTER-co.patch
+	"
 
 build() {
 	make
@@ -70,4 +72,5 @@ bundle() {
 
 sha512sums="
 b24fba0f1f30933c9a27f1b2232ce3fcfddc6ad4de9f6bf42b5517ddc20268604823ed6e57821fe08ab9a5da7f2a4926ba0ecb08e095380eccc5c33cbe63df75  ca-certificates-20241121.tar.bz2
+b053077948458a50e013edac1434c684c19092fe47bbbbbd0e4a945db59011f8793530211065dda0198c87226928a8aa40c14dbced51dc3955c8c24558ef8826  0001-mk-ca-bundle-remove-CKA_NSS_SERVER_DISTRUST_AFTER-co.patch
 "