20161102 (patches unapplied)

Imported using git-ubuntu import.

debian/NEWS

@@ -1,3 +1,31 @@
+ca-certificates (20161102) unstable; urgency=medium
+
+  Update Mozilla certificate authority bundle to version 2.9.
+    The following certificate authorities were added (+):
+    + "Certplus Root CA G1"
+    + "Certplus Root CA G2"
+    + "Certum Trusted Network CA 2"
+    + "Hellenic Academic and Research Institutions ECC RootCA 2015"
+    + "Hellenic Academic and Research Institutions RootCA 2015"
+    + "ISRG Root X1"
+    + "OpenTrust Root CA G1"
+    + "OpenTrust Root CA G2"
+    + "OpenTrust Root CA G3"
+    + "SZAFIR ROOT CA2"
+    The following certificate authorities were removed (-):
+    - "CA Disig"
+    - "NetLock Business (Class B) Root"
+    - "NetLock Express (Class C) Root"
+    - "NetLock Notary (Class A) Root"
+    - "NetLock Qualified (Class QA) Root"
+    - "Sonera Class 1 Root CA"
+    - "Staat der Nederlanden Root CA"
+    - "Verisign Class 1 Public Primary Certification Authority - G2"
+    - "Verisign Class 3 Public Primary Certification Authority"
+    - "Verisign Class 3 Public Primary Certification Authority - G2"
+
+ -- Michael Shuler <michael@pbandjelly.org>  Wed, 02 Nov 2016 21:15:03 -0500
+
 ca-certificates (20151214) unstable; urgency=medium
 
   Removed SPI CA.  Closes: #796208

debian/changelog

@@ -1,3 +1,47 @@
+ca-certificates (20161102) unstable; urgency=medium
+
+  [ Michael Shuler ]
+  * debian/control:
+    Update to Standards-Version: 3.9.8
+    Update to Vcs-Browser/Vcs-Git: https URLs
+  * mozilla/{certdata.txt,nssckbi.h}:
+    Update Mozilla certificate authority bundle to version 2.9.
+    Thanks for the initial 2.7 patch, Jonathan Wiltshire. Closes: #828845
+    The following certificate authorities were added (+):
+    + "Certplus Root CA G1"
+    + "Certplus Root CA G2"
+    + "Certum Trusted Network CA 2"
+    + "Hellenic Academic and Research Institutions ECC RootCA 2015"
+    + "Hellenic Academic and Research Institutions RootCA 2015"
+    + "ISRG Root X1"
+    + "OpenTrust Root CA G1"
+    + "OpenTrust Root CA G2"
+    + "OpenTrust Root CA G3"
+    + "SZAFIR ROOT CA2"
+    The following certificate authorities were removed (-):
+    - "CA Disig"
+    - "NetLock Business (Class B) Root"
+    - "NetLock Express (Class C) Root"
+    - "NetLock Notary (Class A) Root"
+    - "NetLock Qualified (Class QA) Root"
+    - "Sonera Class 1 Root CA"
+    - "Staat der Nederlanden Root CA"
+    - "Verisign Class 1 Public Primary Certification Authority - G2"
+    - "Verisign Class 3 Public Primary Certification Authority"
+    - "Verisign Class 3 Public Primary Certification Authority - G2"
+
+   [ Andreas Beckmann ]
+   * debian/postinst:
+     Run update-certificates without hooks to initially populate
+     /etc/ssl/certs.  (The hooks are deferred to the noawait trigger.)
+     Closes: #825730
+
+    [ Izharul Haq ]
+    * debian/po/id.po:
+      Add Indonesian debconf translation. Thank you, Izharul! Closes: #835156
+
+ -- Michael Shuler <michael@pbandjelly.org>  Wed, 02 Nov 2016 21:15:03 -0500
+
 ca-certificates (20160104) unstable; urgency=medium
 
   * debian/rules:

debian/control

@@ -7,9 +7,9 @@ Uploaders: Raphael Geissert <geissert@debian.org>,
            Christian Perrier <bubulle@debian.org>
 Build-Depends: debhelper (>= 9), po-debconf
 Build-Depends-Indep: python
-Standards-Version: 3.9.6
-Vcs-Git: git://anonscm.debian.org/collab-maint/ca-certificates.git
-Vcs-Browser: http://anonscm.debian.org/cgit/collab-maint/ca-certificates.git
+Standards-Version: 3.9.8
+Vcs-Git: https://anonscm.debian.org/git/collab-maint/ca-certificates.git
+Vcs-Browser: https://anonscm.debian.org/cgit/collab-maint/ca-certificates.git
 
 Package: ca-certificates
 Architecture: all

debian/po/id.po

@@ -0,0 +1,119 @@
+# Indonesian translation for podebconf ca-certificates template.
+# Copyright (C) 2016 THE ca-certificates COPYRIGHT HOLDER
+# This file is distributed under the same license as the ca-certificates package.
+# Translator:
+# Izharul Haq <atoz.chevara@yahoo.com>, 2016.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: ca-certificates 20160104\n"
+"Report-Msgid-Bugs-To: ca-certificates@packages.debian.org\n"
+"POT-Creation-Date: 2011-10-22 14:41+0200\n"
+"PO-Revision-Date: 2016-08-22 18:31+0700\n"
+"Last-Translator: Izharul Haq <atoz.chevara@yahoo.com>\n"
+"Language-Team: L10N Debian Indonesian <debian-l10n-indonesian@lists.debian."
+"org>\n"
+"Language: id\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 1.6.10\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+#. Type: title
+#. Description
+#: ../templates:2001
+msgid "ca-certificates configuration"
+msgstr "pengaturan ca-certificates"
+
+#. Type: select
+#. Choices
+#: ../templates:3001
+msgid "yes"
+msgstr "ya"
+
+#. Type: select
+#. Choices
+#: ../templates:3001
+msgid "no"
+msgstr "tidak"
+
+#. Type: select
+#. Choices
+#: ../templates:3001
+msgid "ask"
+msgstr "tanyakan"
+
+#. Type: select
+#. Description
+#: ../templates:3002
+msgid "Trust new certificates from certificate authorities?"
+msgstr "Mempercayai sertifikat baru dari otoritas sertifikat?"
+
+#. Type: select
+#. Description
+#: ../templates:3002
+msgid ""
+"This package may install new CA (Certificate Authority) certificates when "
+"upgrading. You may want to check such new CA certificates and select only "
+"certificates that you trust."
+msgstr ""
+"Paket ini dapat memasang sertifikat CA baru (Otoritas Sertifikat) ketika "
+"melakukan pembaharuan. Anda mungkin ingin memeriksa sertifikat CA baru "
+"tersebut dan memilih hanya sertifikat yang anda percaya."
+
+#. Type: select
+#. Description
+#: ../templates:3002
+msgid ""
+" - yes: new CA certificates will be trusted and installed;\n"
+" - no : new CA certificates will not be installed by default;\n"
+" - ask: prompt for each new CA certificate."
+msgstr ""
+" - ya: setiap sertifikat CA baru selalu dipercaya dan dipasangkan;\n"
+" - tidak : setiap sertifikat CA baru tidak akan dipasang sebagai standar;\n"
+" - tanyakan: konfirmasikan untuk setiap sertifikat CA baru."
+
+#. Type: multiselect
+#. Description
+#: ../templates:4001
+msgid "New certificates to activate:"
+msgstr "Sertifikat baru untuk diaktifkan:"
+
+#. Type: multiselect
+#. Description
+#: ../templates:4001
+msgid ""
+"During upgrades, new certificates will be added. Please choose those you "
+"trust."
+msgstr ""
+"Selama pembaharuan, sertifikat baru akan ditambahkan. Silakan memilih yang "
+"anda percaya."
+
+#. Type: multiselect
+#. Description
+#: ../templates:5001
+msgid "Certificates to activate:"
+msgstr "Sertifikat untuk diaktifkan:"
+
+#. Type: multiselect
+#. Description
+#: ../templates:5001
+msgid ""
+"This package installs common CA (Certificate Authority) certificates in /usr/"
+"share/ca-certificates."
+msgstr ""
+"Paket ini umumnya memasang sertifikat CA (Otoritas Sertifikat) di /usr/share/"
+"ca-certificates."
+
+#. Type: multiselect
+#. Description
+#: ../templates:5001
+msgid ""
+"Please select the certificate authorities you trust so that their "
+"certificates are installed into /etc/ssl/certs. They will be compiled into a "
+"single /etc/ssl/certs/ca-certificates.crt file."
+msgstr ""
+"Silahkan pilih otoritas sertifikat yang anda percaya sehingga sertifikat "
+"akan dipasang ke dalam /etc/ssl/certs. Mereka akan dikompilasi menjadi satu "
+"berkas /etc/ssl/certs/ca-certificates.crt."

debian/postinst

@@ -138,13 +138,16 @@ EOF
 	        -e 's/^[[:space:]]*1[[:space:]]*/!/' \
 	    >> /etc/ca-certificates.conf
 	fi
+	# update /etc/ssl/certs without running the hooks
 	# fix bogus symlink to ca-certificates.crt on upgrades; see
 	# Debian #643667; drop after wheezy
 	if dpkg --compare-versions "$2" lt-nl 20111025; then
-	    dpkg-trigger --no-await update-ca-certificates-fresh
+	    update-ca-certificates --hooksdir "" --fresh
 	else
-	    dpkg-trigger --no-await update-ca-certificates
+	    update-ca-certificates --hooksdir ""
 	fi
+	# deferred update of /etc/ssl/certs including running the hooks
+	dpkg-trigger --no-await update-ca-certificates
     ;;
 
     triggered)

mozilla/nssckbi.h

@@ -18,7 +18,7 @@
 #define NSS_BUILTINS_CRYPTOKI_VERSION_MAJOR 2
 #define NSS_BUILTINS_CRYPTOKI_VERSION_MINOR 20
 
-/* These version numbers detail the changes 
+/* These version numbers detail the changes
  * to the list of trusted certificates.
  *
  * The NSS_BUILTINS_LIBRARY_VERSION_MINOR macro needs to be bumped
@@ -45,14 +45,14 @@
  * of the comment in the CK_VERSION type definition.
  */
 #define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
-#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 6
-#define NSS_BUILTINS_LIBRARY_VERSION "2.6"
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 9
+#define NSS_BUILTINS_LIBRARY_VERSION "2.9"
 
 /* These version numbers detail the semantic changes to the ckfw engine. */
 #define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1
 #define NSS_BUILTINS_HARDWARE_VERSION_MINOR 0
 
-/* These version numbers detail the semantic changes to ckbi itself 
+/* These version numbers detail the semantic changes to ckbi itself
  * (new PKCS #11 objects), etc. */
 #define NSS_BUILTINS_FIRMWARE_VERSION_MAJOR 1
 #define NSS_BUILTINS_FIRMWARE_VERSION_MINOR 0