X-Recipient:	archive-cygwin AT delorie DOT com
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.1 sourceware.org E5A4E3846030
Authentication-Results:	sourceware.org;
	dmarc=pass (p=none dis=none) header.from=yandex.ru
Authentication-Results:	sourceware.org; spf=pass smtp.mailfrom=yandex.ru
X-Yandex-Fwd:	2
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail;
	t=1654348803; bh=r+wK9gJC0N3ofYE8XumgsLbdBSpVCVFQOgpv8mc40O8=;
	h=In-Reply-To:Subject:To:From:Message-ID:References:Date:Reply-To;
	b=cWlOQTPRTmpGYfzx7j93sjdqyJYgwgg3ny6Ef8ZMWQ+QWi4muJELL95U9N+dyRJBv
	KuKQLtm84KvECuHB5t3JO9Hy79TRUeRda2JnN3evjC4uQQoiSS9Mt2SDeF6MbeWTM5
	/g9+kv2r2I1O/BcL3mPz8TI0Rt4GdW49XTuSUrds=
Authentication-Results:	vla5-396535d496ca.qloud-c.yandex.net;
	dkim=pass header.i=@yandex.ru
Date:	Sat, 4 Jun 2022 16:19:02 +0300
From:	Andrey Repin <anrdaemon AT yandex DOT ru>
X-Mailer:	The Bat! (v9.3.4) Professional
Message-ID:	<15028103.20220604161902@yandex.ru>
To:	Ken Brown <kbrown AT cornell DOT edu>, cygwin AT cygwin DOT com
Subject:	Re: Unable to update PKI - p11-kit does not support 'extract' command
In-Reply-To:	<57472ae7-7f31-354e-a403-f1c1b4953d83@cornell.edu>
References:	<187912860 DOT 20220601115412 AT yandex DOT ru>
	<57472ae7-7f31-354e-a403-f1c1b4953d83 AT cornell DOT edu>
MIME-Version:	1.0
X-Spam-Status:	No, score=-1.8 required=5.0 tests=BAYES_00, DKIM_SIGNED,
	DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, KAM_THEBAT,
	NICE_REPLY_A, SPF_HELO_NONE, SPF_PASS, TXREP,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version:	SpamAssassin 3.4.6 (2021-04-09) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.29
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Reply-To:	cygwin AT cygwin DOT com
Errors-To:	cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
X-MIME-Autoconverted:	from base64 to 8bit by delorie.com id 254DKQ0d025763

Greetings, Ken Brown!

> On 6/1/2022 4:54 AM, Andrey Repin wrote:
>> Greetings, All!
>> > My root CA key expired recently and I'm battling to update my infrastructure.
>> The most unexpected issue so far is a change in Cygwin's p11-kit, that made
>> update-ca-trust script unusable.
>> > Running `p11-kit extract …` immediately fails with code 2 and its manual does
>> not mention `extract` command anywhere.

> $ man p11-kit

> NAME
>         p11-kit - Tool for operating on configured PKCS#11 modules

> SYNOPSIS
>         p11-kit list-modules

>         p11-kit extract ...

> [...]

> EXTRACT
>         Extract certificates from configured PKCS#11 modules.

>         This operation has been moved to a separate command trust extract. See
>         trust(1) for more information

That explains the [2] error code - there's no "trust" command available.
Turned out, my AV ate it.


-- 
With best regards,
Andrey Repin
Saturday, June 4, 2022 15:34:02

Sorry for my terrible english...

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -