X-Recipient: archive-cygwin AT delorie DOT com
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org E5A4E3846030
Authentication-Results: sourceware.org;
 dmarc=pass (p=none dis=none) header.from=yandex.ru
Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=yandex.ru
X-Yandex-Fwd: 2
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail;
 t=1654348803; bh=r+wK9gJC0N3ofYE8XumgsLbdBSpVCVFQOgpv8mc40O8=;
 h=In-Reply-To:Subject:To:From:Message-ID:References:Date:Reply-To;
 b=cWlOQTPRTmpGYfzx7j93sjdqyJYgwgg3ny6Ef8ZMWQ+QWi4muJELL95U9N+dyRJBv
 KuKQLtm84KvECuHB5t3JO9Hy79TRUeRda2JnN3evjC4uQQoiSS9Mt2SDeF6MbeWTM5
 /g9+kv2r2I1O/BcL3mPz8TI0Rt4GdW49XTuSUrds=
Authentication-Results: vla5-396535d496ca.qloud-c.yandex.net;
 dkim=pass header.i=@yandex.ru
Date: Sat, 4 Jun 2022 16:19:02 +0300
From: Andrey Repin <anrdaemon AT yandex DOT ru>
X-Mailer: The Bat! (v9.3.4) Professional
Message-ID: <15028103.20220604161902@yandex.ru>
To: Ken Brown <kbrown AT cornell DOT edu>, cygwin AT cygwin DOT com
Subject: Re: Unable to update PKI - p11-kit does not support 'extract' command
In-Reply-To: <57472ae7-7f31-354e-a403-f1c1b4953d83@cornell.edu>
References: <187912860 DOT 20220601115412 AT yandex DOT ru>
 <57472ae7-7f31-354e-a403-f1c1b4953d83 AT cornell DOT edu>
MIME-Version: 1.0
X-Spam-Status: No, score=-1.8 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, KAM_THEBAT,
 NICE_REPLY_A, SPF_HELO_NONE, SPF_PASS, TXREP,
 T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
 server2.sourceware.org
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Reply-To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset="utf-8"
Errors-To: cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 254DKQ0d025763

Greetings, Ken Brown!

> On 6/1/2022 4:54 AM, Andrey Repin wrote:
>> Greetings, All!
>> > My root CA key expired recently and I'm battling to update my infrastructure.
>> The most unexpected issue so far is a change in Cygwin's p11-kit, that made
>> update-ca-trust script unusable.
>> > Running `p11-kit extract …` immediately fails with code 2 and its manual does
>> not mention `extract` command anywhere.

> $ man p11-kit

> NAME
>         p11-kit - Tool for operating on configured PKCS#11 modules

> SYNOPSIS
>         p11-kit list-modules

>         p11-kit extract ...

> [...]

> EXTRACT
>         Extract certificates from configured PKCS#11 modules.

>         This operation has been moved to a separate command trust extract. See
>         trust(1) for more information

That explains the [2] error code - there's no "trust" command available.
Turned out, my AV ate it.


-- 
With best regards,
Andrey Repin
Saturday, June 4, 2022 15:34:02

Sorry for my terrible english...

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple