Version bump.

Package-Manager: portage-2.2.14_rc1/cvs/Linux x86_64
Manifest-Sign-Key: 0xD2E96200

3 files changed, 210 insertions, 15 deletions

diff --git a/app-misc/ca-certificates/ChangeLog b/app-misc/ca-certificates/ChangeLog
index 7c837d7d7e01..5e6cbda61867 100644
--- a/app-misc/ca-certificates/ChangeLog
+++ b/app-misc/ca-certificates/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for app-misc/ca-certificates
 # Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-misc/ca-certificates/ChangeLog,v 1.104 2014/08/12 13:08:49 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-misc/ca-certificates/ChangeLog,v 1.105 2014/10/16 17:48:39 vapier Exp $
+
+*ca-certificates-20140927.3.17.2 (16 Oct 2014)
+
+  16 Oct 2014; Mike Frysinger <vapier@gentoo.org>
+  +ca-certificates-20140927.3.17.2.ebuild:
+  Version bump.
 
 *ca-certificates-20140325.3.16.3 (12 Aug 2014)
 
diff --git a/app-misc/ca-certificates/Manifest b/app-misc/ca-certificates/Manifest
index 0f11d85bdcb7..d639abf286eb 100644
--- a/app-misc/ca-certificates/Manifest
+++ b/app-misc/ca-certificates/Manifest
@@ -17,10 +17,12 @@ DIST ca-certificates_20130906_all.deb 185064 SHA256 b2326834479192de2298c607bc02
 DIST ca-certificates_20140223.tar.xz 274768 SHA256 815b7cd97200b0d76450bb3e7d9b65997ac494ab6467b17369f65b2ef94bcb0c SHA512 14855eba51f90ab062b53a0d1986889de9ad7db4cb52bd4d764872b7c90eaaee62920543a4670ab45329469f76365d1e902219397b660034689159f13b8668d8 WHIRLPOOL f841d9a5fa2d4b3d46d06a2de947108ccb8bf7f19c99979822e22f043624656e789ba0340657b21a15560fd6593efa4256efc9f317974bdca8088a3647836e49
 DIST ca-certificates_20140223_all.deb 190226 SHA256 13cb11144a97d95a8be130e4bcdd6c9ffc3df269bb194699bcd21ca377e01df2 SHA512 003b6fd2301eee3ca2119781ee75a1b195f142678d4570b598c4b93847de23c4f659152f834db1f0c8866767324d02b27807260cf43f6ae16207538fa419aa31 WHIRLPOOL 179a0bcf341e7de07d02f6574850614ef221851379945db00018d25f485cee6c11915322ee370e72321d81464d7d6bb96401b41029b8f7215a68e46971671deb
 DIST ca-certificates_20140325.tar.xz 278816 SHA256 c0e3d8c517995db2737f7f1a9b69d654b8823fa6d337871c6ce111fcf083454a SHA512 6645740d61da78845facce6e3881c64f51e945a454cb26cead6e7df4887f1f3797bea217cebaffaae22a76fa3867ee20dee7b1d5200df20b85878a0c6029c2f8 WHIRLPOOL 93d4ff1ac74c6961612ffa0e4da35228636698940fd0a66e4e6842de4e48f5ded74885bfb330f6d106ae267124309d51d49f646959bbae1ef9fa7a55dbb2085a
+DIST ca-certificates_20140927.tar.xz 288824 SHA256 e582724ebb9d5d6fe02d02db1773c9ca76d3aaab4b15375a0d72e9abf88a65c5 SHA512 3cd08559c52aeba763a8ecc0333c7c20838db0111e52d9adf65719f14f858611271d61801a60fb3aea4e74be4a7903c1b462bf889172f5afb774280bb615b98b WHIRLPOOL e32e54b21109b7c44266480a6a5d78693b5ef7ffae1df595c4edfe2cce85d1cd29664e6d916c5bfffb965e4bb01fce6a8327a2ead5bb0ca7cdd8afd04346a270
 DIST nss-3.14.1-add_spi+cacerts_ca_certs.patch 25018 SHA256 82ca25982828fd7153ad15fc6e81408c115476eeeb4045d3a71469380b56824b SHA512 2aafbd972b073061bfd66a66a4b50060691957f2910f716f7a69d22d655c499f186f05db2101bea5248a00949f339327ba8bfffec024c61c8ee908766201ae00 WHIRLPOOL c9fe397e316dac7983b187acf7227078ebd8f8da5df53f77f2564489e85f123c4d2afb88d56e8dc14b9ebfffe8a71ade4724b3c1ea683c5c4c487cb3a64eda43
 DIST nss-3.15.5.tar.gz 6367893 SHA256 1442c85624b7de74c7745132a65aa0de47d280c4f01f293d111bc0b6d8271f43 SHA512 4db27ea98f17f1a5bc6f513455497945fc35957f573b3ac7e730b166fbe0e8fd741c188187c578faf361d969db63d83ff8ccf15ac2b8ca72a367f33a018695ca WHIRLPOOL c3c687ac53dca571d1c45bdf4a80e192ca58da07e06ef56de7ac9736480c97689dd12d14351860764b70a1d823092a1ddbc471328c4bae4a899edd0e331c8aee
 DIST nss-3.16.3.tar.gz 6426732 SHA256 657711ff7a4058043b69019a66f44101d0234eae2b6b80ab900439dbf02add60 SHA512 2e829b021319a9d8c0cedec742f84c54815eed8e3b1042b5045f08746e5768286001e9517d2b69c2a5d705cd632c98f3a9227e651a492bae3ef638cc706fe31f WHIRLPOOL bd8fe296baf79b4cad2224a921bf6d0a6b6a1f13df5b64131f59964541d2ec1ae506a79a5a3b8dc08a47c8fcdfa5eafb866727fcf26c37d4e5e91a7ebb7886b3
 DIST nss-3.16.tar.gz 6378110 SHA256 2bb4faa200962caacf0454f1e870e74aa9a543809e5c440f7978bcce58e0bfe8 SHA512 e3dcde8213f7f131fe2f714ff2f45c6d7b9b2167e51dbf0e1a750cc4f83d9fa35e69408850de6600f55fbc9e26b29dc344548cb64849d6e3252476eadd7ee57f WHIRLPOOL d30b53ec36cacff9756b43780d904e32760cd5d0b75f1888b6fb80e0a87ce828f4e6189de63880ddce90bdf5d90123ff7e9fdf600f4df02ce59702898f08c11e
+DIST nss-3.17.2.tar.gz 6927414 SHA256 134929e44e44b968a4883f4ee513a71ae45d55b486cee41ee8e26c3cc84dab8b SHA512 a3d165bb2c578e7b5d90349729e85a2fce09260d069093080c76cce3b8a996c6489232324fd6a0c69b959321bcdf5f1806054f165cd6ce851fe4ffeb2883ae7f WHIRLPOOL 01b3cc546aa2dd0974caa2267aa9874b01cf6096f307a114393ba5a98adc216e0f2b217631b89b20752be5881f70fc1a7e94e0e90618707d5f9b9d18fd55d859
 EBUILD ca-certificates-20090709.ebuild 2126 SHA256 86820ea4d33d9e0e779c0a0d631242b12821bf4135ec6bccd2c284e948c51b19 SHA512 5c47bd113f19d733219b57c5f5845617fd37802a1a2556af928c6affdb30a210ce91d2b9f97a55c13a22c586f20abe0865a8ec7237ba1841bfadd5cba4184e3a WHIRLPOOL 472cffbb69b7888aeca35faf6e03ae7d862f839b74fef6617d2008f12d8ed6b5f9451ea0f536141b7fd80fd6a121dc8617ad1b87634127fe95557c95f74e1089
 EBUILD ca-certificates-20110421.ebuild 2119 SHA256 1223e4710e2d72fbb97f93bfa77351912b20b6ea07e83c7672bd24b1d812a634 SHA512 324615e914c150b991576df567b5f5042e527d05cd4674e44060771cf7e0e68cfa8495e432fa925d074b6602334d9b80cec50fdad7ae64cb3633c4c9726b42d6 WHIRLPOOL dffadcbc624cee7b9203c8ff6bba375508679c8d87ebb8a12da543d68cc937159b3f26b95bca94c444522e40c30b5b06741f1116233a6af3c6df5a428218fa16
 EBUILD ca-certificates-20110502-r1.ebuild 2116 SHA256 39b705809344be81df5d717a63f7909127481f9ec052c2169d74ac2eda508e68 SHA512 570c7611404cb2cd230bf5925967230aa9e2f90f84bad157d6da522ab5d49c08ae8e6a2170694a094331c549373b2d253388d67a69032f775f9a94dfe476c794 WHIRLPOOL c24f06ad859f69187caacb83ff2835d40d17a7e1e6c03c16cbaf7794c9eab1a2cfb01b7b58290d72abb4f36cec6a655e79efb9a9acd53e99ee5c6d75caf8193e
@@ -39,22 +41,23 @@ EBUILD ca-certificates-20140223-r1.ebuild 6173 SHA256 16c147b61edca6daff8dce71ca
 EBUILD ca-certificates-20140223.3.15.5-r1.ebuild 6300 SHA256 a27cf48ebf50dd47571613da3d322f7a421154385e2345a568917fcd6f46cf2e SHA512 7511f43228addda16b4b53dcf9bfd4a9762c63520c8a90e6717707c87e8020a3b4a267d6d7343bed4f497aa97fc59615054e8ef8cea98c05d87523c45a2a5c33 WHIRLPOOL fe70d60cbbe289f5c0d55f84ab7ea5ab640a0165a8112707120ea13d29c03c69f5458fa3974d9fd74123016a873111700fca53d6a4edd1dee51e83489db4bd97
 EBUILD ca-certificates-20140223.3.16-r1.ebuild 6298 SHA256 bf12b98d046654227427e091d3af56abcd358a17713e5004e51a56ab11da392e SHA512 180f46e3cb916a625da0cab7808c674c4dcc8ec3a0244d7ff2586604a384355d9e9e7aa6e2422e4632e0fab8af2e3788ad3c4f249e63a4175c2a2996cb044475 WHIRLPOOL 872584b604b8deb5f77cc36b85dc209196f1fefb8e9097e03c51a3c6bc6ca883c8a62dc4186c655f5c55475e8c19bc7d1060b1831f9864eaf6a00cb67de31998
 EBUILD ca-certificates-20140325.3.16.3.ebuild 6291 SHA256 f35a9a2d1dbf40a6fc9da488d566bea236d86d84167dbb0a197874060d2acfd5 SHA512 51234db2b011b857e46d71be9b2befd27a9fa27336e580f12bfdd8eeb957dcb7134596e6e47787e90df829f84322b9ba0b264ed917c25bbf5945c9a8c4e2bb91 WHIRLPOOL 1d5ca40fc11b001884e4ec68a333007cea7ceecdd4c70d8562c08a25fd2079d1353dad2fd8f85a8e50921ce74d6efc49da86863a7361191eff7695aa6f190885
-MISC ChangeLog 16354 SHA256 f47a49ddbc8f2aa4e21efc178e7545fb1bebd031027dc0998326ee702718c333 SHA512 8fa499afa7dee21581d50f601e33a8eca79b9cd464c4506dd21d421348ba17321878ed7f26871224c631bbaf8e550892bb1ab07a18680437bc074cf6c5691c3e WHIRLPOOL 554f595949b3befba3bfea59c209e2966bc606170f54bb331b3f625ff20b168f0d2411d7f4c113ec3d6ec1895f29c2d85a0ba7ebc9f5adfcb168da402a7be18a
+EBUILD ca-certificates-20140927.3.17.2.ebuild 6318 SHA256 742d940aab7a79b2deb3b9d67659cf7ac6fe88552c1e83a3ebf92b3c8f2a28fa SHA512 7148a6ce42a074851082bff11db5736edaf7a4611ee0a5156fc50be8d946460dd993473a5e951c9a058c47dfd8c9b8918437b312e19a3bb6c142e40f325ad78c WHIRLPOOL d7a62d831f60de9fbe1f67d05cb237cc9d01f37ba995e6ccbc4778c7c109498cc7b14f20e76e57e1eba60de33f8b0fdfc0ff04ea1f550138d2b326c82b2f8e5e
+MISC ChangeLog 16512 SHA256 4a4a06f40f1f266551b0858eb8e675c95adf9512e1052266034bb0546dd0840f SHA512 c6d9fb93dd8ad971213f97cd1f706cd33557e9cf07977effde19e55408d41cde80d375037af5d3d021ec0995d221949742da0a20b69e2642907e9651ca536f88 WHIRLPOOL b95596ab0b6b801838de2e738d9156961c07bd931b63580c4c7e790a157a02eb5e1b238c4f053c991a97a37319129f55a4e01bd8871c1f8cdb6d1ca5063b0f51
 MISC metadata.xml 343 SHA256 770e903b1433ea49a4d4e8fc47084cfa0412e76d2ab59f973d80d2e3db2eaae9 SHA512 3d72166eaf516edbd6d68652f9debbc864046ab548f6e7c171c2790add07f436fb426781f5ef98bfc4b9c3f36e3b616c8b8973e5c601b13f2fa4bdf2bba3f89d WHIRLPOOL bbffa556e696d62479bcdd2d67b03368f412859a1eb9d47ae93f4b364d6e44aca229b20649f97b3a3fc0ad51e2b831b2e1cdd1da84b3abf8ffa17c5e75305088
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
-iQIcBAEBCAAGBQJT6hHkAAoJEPGu1DbS6WIA1X4P+wd06gO2VdeRuc6pwHnH76Ue
-7PHyctbCPczuQe59Cl24jb6+k5M7VipBKpSr7i/YEAovLPbmx/jCEGRImodUyl8E
-mw7v+o6He47pynpBmO+MyoIGoS3F7hWPxs80+J3LMASrMQ0rNXlYPCJ54uDs+xlh
-jyZHQ62plJgn7GFMA4gbkZdNuYwxdF1Hmfh8nIeGppjurYGJFxwelGDA3Pc8zDS6
-WukaKHxcyz7vjW+TWgpy9Qr/kYt0bNzSCMUz5ApAQPOKz6XVGLm8Uahl87hO4iRV
-FKzSuAQvmmqeYk2FqnlT4oM+kguzdj1nkeQacPsSpdEKBMpgLoOh0XmYatkE/Ryl
-5+eO0R3+Jbx8jlGE4jpCJIY4V0ZsCX0WE+T2qPMad3lK+0hHFZVzJTwhPdpOYrgH
-3xBeG2YPpL+qI9dMAu11OHRTfm2dxgAiPRZYfOgzjeyIIaqqTAWHkzaImD9T4NQq
-fgp08ChuDCP9WKI9qcgTkyyc3G6uQ90BOcsl9XJq8iBus/CjL739R7Xzmb04oBBv
-Nn9vbXZlogc7nUpzW+GwkhjyG8ZySGh0Hlp/wjgbhXsJ6F3zkv0f8Og6sUR2v/Fr
-vXWx6rUU/thtbONJJ3hclulSTG7DVOlKpYEN01cluVZF1LTUjMA7I48KP8p4K3iR
-rittudX5pvb1Ns93IHfO
-=UIoi
+iQIcBAEBCAAGBQJUQAT4AAoJEPGu1DbS6WIAcj4P/164Y0NbRgZ1AtSj2guH6uk8
+ByTA+TI/dWDZRbPr+WW35lRe6iEFnvSdrC4ve8l2Y5GOjagLF5rHoWY1maSmc3F7
+6cHlFqD3Aw4qgQkB4rUwnjBW0sxbFtjbXfOIKeGh0Fghff3z93oybFfeyo9mn55f
+zOjmuy3yJUt3JwgvJr70SNAeloVIOnUIN7aDO8Q2kotSG8VN9T8CrlLYu0E/pPjO
+4NT2SYWtsenilpSR5dkf87Xk6nqDFto5RqnxoefF7wzvc5NvTDLjBdJBx764YRUK
+cGCEF5pWBwhuZtOHDlj7PiAaiRt7FgnaSUF++X36xHYcQS5Q8iZUpZfLS3nRpMPi
+a8rCJ56VGHKsuluw4AU6hAwkKToSMLf4g9+rXht+BQDJ7QhhNmnw4B3O5QJvDPQb
+FRVHVcRbjc0inYAZXvlUgEhI5bJK0BQ0ngiugJS1EYp1ORMmtSjw2OEV3231UQRT
+biWp5yR0zlwT20rQqvvSXc1Vb3rVzC3knq4BFNwJzslgY7gCmHpZdXwzFrj8N9do
+2+K8YJMKSd6eRrx7iwiWflFLRtRJqKchHBv7Z54aUd7vT2eFzJnOQbHaJiX39Jbp
+LmnwiQ2S+GMEmjYj5KsADxu7m+eM1+lX4189f6wvWMXRVO8iifbCWLJryJq8WuXW
+5t26B7T0C0SJGNmhVK4M
+=whBC
 -----END PGP SIGNATURE-----
diff --git a/app-misc/ca-certificates/ca-certificates-20140927.3.17.2.ebuild b/app-misc/ca-certificates/ca-certificates-20140927.3.17.2.ebuild
new file mode 100644
index 000000000000..8953fcf3fd9b
--- /dev/null
+++ b/app-misc/ca-certificates/ca-certificates-20140927.3.17.2.ebuild
@@ -0,0 +1,186 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-misc/ca-certificates/ca-certificates-20140927.3.17.2.ebuild,v 1.1 2014/10/16 17:48:39 vapier Exp $
+
+# The Debian ca-certificates package merely takes the CA database as it exists
+# in the nss package and repackages it for use by openssl.
+#
+# The issue with using the compiled debs directly is two fold:
+# - they do not update frequently enough for us to rely on them
+# - they pull the CA database from nss tip of tree rather than the release
+#
+# So we take the Debian source tools and combine them with the latest nss
+# release to produce (largely) the same end result.  The difference is that
+# now we know our cert database is kept in sync with nss and, if need be,
+# can be sync with nss tip of tree more frequently to respond to bugs.
+
+# When triaging bugs from users, here's some handy tips:
+# - To see what cert is hitting errors, use openssl:
+#   openssl s_client -port 443 -CApath /etc/ssl/certs/ -host $HOSTNAME
+#   Focus on the errors written to stderr.
+#
+# - Look at the upstream log as to why certs were added/removed:
+#   https://hg.mozilla.org/projects/nss/log/tip/lib/ckfw/builtins/certdata.txt
+#
+# - If people want to add/remove certs, tell them to file w/mozilla:
+#   https://bugzilla.mozilla.org/enter_bug.cgi?product=NSS&component=CA%20Certificates&version=trunk
+
+EAPI="4"
+PYTHON_COMPAT=( python{2_6,2_7} )
+
+inherit eutils python-any-r1
+
+if [[ ${PV} == *.* ]] ; then
+	# Compile from source ourselves.
+	PRECOMPILED=false
+	inherit versionator
+
+	DEB_VER=$(get_version_component_range 1)
+	NSS_VER=$(get_version_component_range 2-)
+	RTM_NAME="NSS_${NSS_VER//./_}_RTM"
+else
+	# Debian precompiled version.
+	PRECOMPILED=true
+	inherit unpacker
+fi
+
+DESCRIPTION="Common CA Certificates PEM files"
+HOMEPAGE="http://packages.debian.org/sid/ca-certificates"
+NMU_PR=""
+if ${PRECOMPILED} ; then
+	SRC_URI="mirror://debian/pool/main/c/${PN}/${PN}_${PV}${NMU_PR:++nmu}${NMU_PR}_all.deb"
+else
+	SRC_URI="mirror://debian/pool/main/c/${PN}/${PN}_${DEB_VER}${NMU_PR:++nmu}${NMU_PR}.tar.xz
+		ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${RTM_NAME}/src/nss-${NSS_VER}.tar.gz
+		cacert? ( http://dev.gentoo.org/~anarchy/patches/nss-3.14.1-add_spi+cacerts_ca_certs.patch )"
+fi
+
+LICENSE="MPL-1.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
+IUSE=""
+${PRECOMPILED} || IUSE+=" +cacert"
+
+DEPEND=""
+if ${PRECOMPILED} ; then
+	# platforms like AIX don't have a good ar
+	DEPEND+="
+		kernel_AIX? ( app-arch/deb2targz )
+		!<sys-apps/portage-2.1.10.41"
+fi
+# openssl: we run `c_rehash`
+# debianutils: we run `run-parts`
+RDEPEND="${DEPEND}
+	dev-libs/openssl
+	sys-apps/debianutils"
+
+if ! ${PRECOMPILED}; then
+	DEPEND+=" ${PYTHON_DEPS}"
+fi
+
+S=${WORKDIR}
+
+pkg_setup() {
+	# For the conversion to having it in CONFIG_PROTECT_MASK,
+	# we need to tell users about it once manually first.
+	[[ -f "${EPREFIX}"/etc/env.d/98ca-certificates ]] \
+		|| ewarn "You should run update-ca-certificates manually after etc-update"
+}
+
+src_unpack() {
+	${PRECOMPILED} || default
+
+	mv ${PN}-*/ ${PN} || die
+
+	# Do all the work in the image subdir to avoid conflicting with source
+	# dirs in $WORKDIR.  Need to perform everything in the offset #381937
+	mkdir -p "image/${EPREFIX}"
+	cd "image/${EPREFIX}" || die
+
+	${PRECOMPILED} && unpacker_src_unpack
+}
+
+src_prepare() {
+	cd "image/${EPREFIX}" || die
+	if ! ${PRECOMPILED} ; then
+		mkdir -p usr/sbin
+		cp -p "${S}"/${PN}/sbin/update-ca-certificates usr/sbin/ || die
+
+		if use cacert ; then
+			pushd "${S}"/nss-${NSS_VER} >/dev/null
+			epatch "${DISTDIR}"/nss-3.14.1-add_spi+cacerts_ca_certs.patch
+			popd >/dev/null
+		fi
+	fi
+
+	epatch "${FILESDIR}"/${PN}-20110502-root.patch
+	local relp=$(echo "${EPREFIX}" | sed -e 's:[^/]\+:..:g')
+	sed -i \
+		-e '/="$ROOT/s:ROOT/:ROOT'"${EPREFIX}"'/:' \
+		-e '/RELPATH="\.\./s:"$:'"${relp}"'":' \
+		usr/sbin/update-ca-certificates || die
+}
+
+src_compile() {
+	cd "image/${EPREFIX}" || die
+	if ! ${PRECOMPILED} ; then
+		python_setup
+		local d="${S}/${PN}/mozilla"
+		# Grab the database from the nss sources.
+		cp "${S}"/nss-${NSS_VER}/nss/lib/ckfw/builtins/{certdata.txt,nssckbi.h} "${d}" || die
+		emake -C "${d}"
+
+		# Now move the files to the same places that the precompiled would.
+		mkdir -p etc/ssl/certs etc/ca-certificates/update.d usr/share/ca-certificates/mozilla
+		if use cacert ; then
+			mkdir -p usr/share/ca-certificates/{cacert.org,spi-inc.org}
+			mv "${d}"/CAcert_Inc..crt usr/share/ca-certificates/cacert.org/cacert.org_root.crt || die
+			mv "${d}"/SPI_Inc..crt usr/share/ca-certificates/spi-inc.org/spi-cacert-2008.crt || die
+		fi
+		mv "${d}"/*.crt usr/share/ca-certificates/mozilla/ || die
+	else
+		mv usr/share/doc/{ca-certificates,${PF}} || die
+	fi
+
+	(
+	echo "# Automatically generated by ${CATEGORY}/${PF}"
+	echo "# $(date -u)"
+	echo "# Do not edit."
+	cd usr/share/ca-certificates
+	find * -name '*.crt' | LC_ALL=C sort
+	) > etc/ca-certificates.conf
+
+	sh usr/sbin/update-ca-certificates --root "${S}/image" || die
+}
+
+src_install() {
+	cp -pPR image/* "${D}"/ || die
+	if ! ${PRECOMPILED} ; then
+		cd ca-certificates
+		doman sbin/*.8
+		dodoc debian/README.* examples/ca-certificates-local/README
+	fi
+
+	echo 'CONFIG_PROTECT_MASK="/etc/ca-certificates.conf"' > 98ca-certificates
+	doenvd 98ca-certificates
+}
+
+pkg_postinst() {
+	if [ -d "${EROOT}/usr/local/share/ca-certificates" ] ; then
+		# if the user has local certs, we need to rebuild again
+		# to include their stuff in the db.
+		# However it's too overzealous when the user has custom certs in place.
+		# --fresh is to clean up dangling symlinks
+		"${EROOT}"/usr/sbin/update-ca-certificates --root "${EROOT}"
+	fi
+
+	local c badcerts=0
+	for c in $(find -L "${EROOT}"etc/ssl/certs/ -type l) ; do
+		ewarn "Broken symlink for a certificate at $c"
+		badcerts=1
+	done
+	if [ $badcerts -eq 1 ]; then
+		ewarn "Removing the following broken symlinks:"
+		ewarn "$(find -L "${EROOT}"/etc/ssl/certs/ -type l -printf '%p -> %l\n' -delete)"
+	fi
+}