Добавление сертификатов в браузер

app-misc/ca-ru-certificates/Manifest

@@ -1 +1,2 @@
-DIST ca-ru-certificates-2022.09.25.crt 4634 BLAKE2B 7e20022c065290433ba04b836d3124d7eee066553eda7ac72764513a63ff5217617ab33baf03ee61f2fb735a2f596550bef03194ed7a8debc82bb4f709579099 SHA512 cc6dd3a8c5d1a6082e72d4e954c5ec3d9be847b4399637f0a3c44309d0bdefb1a2a85883f2587aec86b82cc7f26a819db5f215279e34697a7c0b388780bd5eb8
+DIST ca-ru-certificates-2022.09.25_root.cer 1478 BLAKE2B 93dab17477cc5106088d526af07af43c6c0090d14ed747e876ffe931e18eef1c3f619645cc17f94c430a5aa607ad587027871de01e6c7b3026accf9e40a0e3bb SHA512 516f3375c890a5eb05c86703aaeb3854c94263982063d9248650d777c26958383751125be5b024eb861aad891352b7e6869b73a8aad75f1a8388f57dd6b4233e
+DIST ca-ru-certificates-2022.09.25_sub.cer 1862 BLAKE2B 69a25dbb876c1caabd77357e5157aca5850523124ae5994ffebad3744553f49dad5c02142f4a0034fc3cca2949045615f2ada26259bd5ab70f1437a8a4e3e0e8 SHA512 f43105da3a0643cb887af52ade7a712d956c72ab7eb066ef6915f4eeafd5531119f1e4e555dae875f51732ce51e3ff7d79532297e8e0dd1816e93b4d87b235ae

app-misc/ca-ru-certificates/ca-ru-certificates-2022.09.25.ebuild

@@ -1,15 +1,15 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Поддержка работы сайтов с российскими сертификатами
-
 EAPI=7
 
-
 DESCRIPTION="Установка корневого сертификата для работы сайтов с российскими сертификатами"
 HOMEPAGE="https://www.gosuslugi.ru/crt"
 
-SRC_URI="https://gu-st.ru/content/Other/doc/russiantrustedca.pem -> ${P}.crt"
+SRC_URI="
+https://gu-st.ru/content/Other/doc/russian_trusted_root_ca.cer -> ${P}_root.cer
+https://gu-st.ru/content/Other/doc/russian_trusted_sub_ca.cer -> ${P}_sub.cer
+"
 
 LICENSE=""
 SLOT="0"
@@ -20,13 +20,33 @@ RESTRICT="bindist mirror strip"
 
 S="${WORKDIR}"
 
+CA=usr/local/share/ca-certificates
+RU_TR_R=${P}_root.crt
+RU_TR_S=${P}_sub.crt
+
+RU_TR_R_NAME="Russian Trusted Root CA - The Ministry of Digital Development and Communications"
+RU_TR_S_NAME="Russian Trusted Sub CA - The Ministry of Digital Development and Communications"
+
+## Ассоциативный массив {имя сертификата:файл}
+declare -A massiv
+massiv[${RU_TR_R_NAME}]=${RU_TR_R}
+massiv[${RU_TR_S_NAME}]=${RU_TR_S}
+
 src_prepare() {
-	mkdir -p usr/local/share/ca-certificates/ || die
-	cp ${DISTDIR}/${A} usr/local/share/ca-certificates/  || die
+	mkdir -p ${CA} || die
 	default
 }
 
 src_install() {
+
+	# Конвертируем DER в PEM
+        for k in ${A}; do
+		kk=$(basename ${k} .cer);
+		touch ${CA}/${kk}.crt
+		/usr/bin/openssl x509 -in ${DISTDIR}/${k} -inform DER > ${CA}/${kk}.crt
+
+        done
+
 	mv * "${D}" || die
 }
 
@@ -36,11 +56,55 @@ pkg_postinst() {
 		# to include their stuff in the db.
 		# However it's too overzealous when the user has custom certs in place.
 		# --fresh is to clean up dangling symlinks
-		/usr/sbin/update-ca-certificates
+		/usr/sbin/update-ca-certificates --root "${ROOT}"
 	fi
 
+
+# Установка для браузеров
+
+# Создаём базу nssdb для системы
+mkdir -p /etc/pki/nssdb || die
+
+nssdir=$(find /home/ -name "cert9.db")
+nssdir+=$'\n/etc/pki/nssdb/cert9.db'
+
+for certDB in ${nssdir}
+do
+	certdir=$(dirname ${certDB});
+
+	for k in "${!massiv[@]}"; do
+		certutil -A -n "${k}" -t "CT,C,C" -i /${CA}/${massiv[$k]} -d sql:${certdir};
+	done
+done
+
 	if [[ -n "$(find -L /etc/ssl/certs/ -type l)" ]] ; then
 		ewarn "Removing the following broken symlinks:"
 		ewarn "$(find -L /etc/ssl/certs/ -type l -printf '%p -> %l\n' -delete)"
 	fi
 }
+
+pkg_prerm() {
+	# Удаляем сертификаты
+	rm -f /usr/local/share/ca-certificates/${P}_{root,sub}.crt
+
+	if [[ -d "/usr/local/share/ca-certificates" ]] ; then
+		# If the user has local certs, we need to rebuild again
+		# to include their stuff in the db.
+		# However it's too overzealous when the user has custom certs in place.
+		# --fresh is to clean up dangling symlinks
+		/usr/sbin/update-ca-certificates --root "${ROOT}"
+	fi
+
+	nssdir=$(find /home/ -name "cert9.db")
+	nssdir+=$'\n/etc/pki/nssdb/cert9.db'
+
+	for certDB in ${nssdir}
+	do
+	        certdir=$(dirname ${certDB});
+
+		for k in "${!massiv[@]}"; do
+			certutil -D -n /${CA}"${k}" -d sql:${certdir};
+		done
+	done
+
+}