Fix smime and cms exit status on option parsing errors
Initialize ret to 1 before parsing options so parsing failures return
an error instead of success.
Reported by jumpifnotzero
Fix https://github.com/libressl/portable/issues/1440
ok tb@
initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem
from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory. We can't
do this nicely with syspatch(8) because it requires patches in sequence
so a new tool had to be written. It is intentionally kept very simple
so that it can be studied because we intend to run this in root cron,
(the non-simple parts figure out quickly when not to update).
looked at by sthen beck lucas dgl
Handle the Emudhra intermediate cert compromise.
See https://emudhra.we-have-a-problem.com/
While likely all of Emudrha will be distrusted soon, currently
a lot of India is using them. 8 intermediates under their CA3
have publicly discoverable keys. the 9 others sign many sites.
For now, remove CA3 from the trust store, thus distrusting all
the intermediates it has signed, then add back the remaining
9 uncompromised intermediates by "promoting" to a root, the
usual intermediate elision technique.
This enables real sites in india using these intermediates
to still work. Assuming Emudhra ends up widely distrusted
soon, we can remove these and the other roots after sites
have had time to get new certificates.
ok tb@ sthen@
the clock applet should only monitor /etc/localtime
in additional monitor /etc with kqueue and filter for /etc/localtime
because the symlink can change and that will not be picked up by
monitoring /etc/localtime itself
