ca-certificates: Remove TrustCor Systems root CAs

On November 30, 2022, Mozilla decided to take the following
actions as a response to the concerns raised about the merits
of this root CA operator (excerpt taken from
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ):

> 1. Set "Distrust for TLS After Date" and "Distrust for S/MIME
>    After Date" to November 30, 2022, for the 3 TrustCor root
>    certificates (TrustCor RootCert CA-1, TrustCor ECA-1,
>    TrustCor RootCert CA-2) that are currently included in
>    Mozilla's root store.
>
> 2. Remove those root certificates from Mozilla's root store
>    after the existing end-entity TLS certificates have expired.

As far as the latter is concerned, the offending certificates
have these expiry dates set:
- TrustCor RootCert CA-1: Mon, 31 Dec 2029 17:23:16 GMT
- TrustCor RootCert CA-2: Sun, 31 Dec 2034 17:26:39 GMT
- TrustCor ECA-1:         Mon, 31 Dec 2029 17:28:07 GMT

The way IPFire 2 currently processes Mozilla's trust store
does not feature a way of incorporate a "Distrust for XYZ After
Date" attribute. This means that despite TrustCor Systems root
CAs are no longer trusted by browsers using Mozilla's trust
store, IPFire would still accept certificates directly or
indirectly issued by this CA until December 2029 or December 2034.

To protect IPFire users, this patch therefore suggests to
patch our copy of Mozilla's trust store in order to remove
TrustCor Systems' root CAs: The vast majority of HTTPS connections
established from an IPFire machine take place in a non-interactive
context, so there is no security benefit from a "Distrust After
Date" information. Instead, if we do not want IPFire installations
to trust this CA, we have no other option other than remove it
unilaterally from our copy of Mozilla's trust store.

See also: https://lists.ipfire.org/pipermail/development/2022-November/014681.html

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

lfs/ca-certificates

@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 20220917
+VER        = 20221201
 
 # From https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt
 
@@ -52,6 +52,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cp -av $(DIR_CONF)/$(THISAPP) $(DIR_APP)
 
+	# Remove TrustCor Systems root CAs (see mailing list thread:
+	# https://lists.ipfire.org/pipermail/development/2022-November/014681.html)
+	cd $(DIR_APP) && patch -Np0 < $(DIR_SRC)/src/patches/ca-certificates-Remove-TrustCor-Systems-root-CAs.patch
+
 	cd $(DIR_APP) && sh ./build.sh
 
 	-mkdir -pv /etc/ssl/certs