TC002 CA certificates¶

A TC002 release ships the Mozilla CA store in PEM form as share/ca-certificates.crt. awtrix-linux loads it once (--ca-file) and verifies every HTTPS connection of scripts and radio streams against it. The recipe lives in tools/tc002/ca/, and build_bundle.sh runs it (see Install tools).

How it works¶

The recipe builds the bundle the way Buildroot's ca-certificates package builds /etc/ssl/certs/ca-certificates.crt: Debian's certdata2pem.py converts Mozilla's certdata.txt, and the certificates are joined in byte order of their file names.

Build¶

tools/tc002/ca/build.sh WORKDIR [OUTDIR]   # OUTDIR defaults to WORKDIR/out

The script needs python3 with the cryptography module. OUTDIR receives ca-certificates.crt and NOTICE, the MPL-2.0 notice that goes into share/licenses.txt.gz together with the complete MPL-2.0 text. That licence text is copied from Mozilla and does not alter the certificate data or its checksum.

Reference¶

The output checksum is pinned too and matches the bundle of the Buildroot system. A new store means a new tarball: update both checksums together.

Related¶

• OpenSSL
• Install tools
• TC002 tools