security/ca_root_nss: Make the certctl command overridable

For some purposes it's useful to be able to build the ca_root_nss with a
custom certctl command.  It may be desireable for instance to run
certctl rehash at the end of a package upgrade rather than in the
middle, in which case it's sufficient to substitute CERTCTL_CMD=:.

Make the certctl command name a variable so that one can override it at
port build time.  No functional change intended.

PR:	290115
Approved by:	maintainer (timeout, 1 month)
Sponsored by:	OPNsense
Sponsored by:	Klara, Inc.

security/ca_root_nss/Makefile

@@ -1,6 +1,6 @@
 PORTNAME=	ca_root_nss
 PORTVERSION=	${VERSION_NSS}
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
 DISTNAME=	nss-${VERSION_NSS}${NSS_SUFFIX}
@@ -34,8 +34,10 @@ VERSION_NSS=	3.117
 CERTDATA_TXT_PATH=	lib/ckfw/builtins/certdata.txt
 BUNDLE_PROCESSOR=	MAca-bundle.pl
 
+CERTCTL_CMD?=	/usr/sbin/certctl
+
 SUB_FILES=	MAca-bundle.pl pkg-deinstall pkg-install pkg-message
-SUB_LIST=	VERSION_NSS=${VERSION_NSS}
+SUB_LIST=	CERTCTL_CMD=${CERTCTL_CMD} VERSION_NSS=${VERSION_NSS}
 
 do-build:
 	@${SETENV} PATH=${LOCALBASE}/bin:$${PATH} \

security/ca_root_nss/files/pkg-deinstall.in

@@ -2,5 +2,5 @@
 
 if [ "$2" = POST-DEINSTALL ]; then
 	CERTCTL_ARGS="-D ${PKG_ROOTDIR}"
-	certctl ${CERTCTL_ARGS} rehash
+	%%CERTCTL_CMD%% ${CERTCTL_ARGS} rehash
 fi

security/ca_root_nss/files/pkg-install.in

@@ -5,7 +5,7 @@ if [ "$2" = POST-INSTALL ]; then
 	if [ -n "${PKG_METALOG}" ]; then
 		CERTCTL_ARGS="${CERTCTL_ARGS} -U -M ${PKG_METALOG}"
 	fi
-	certctl ${CERTCTL_ARGS} rehash
+	%%CERTCTL_CMD%% ${CERTCTL_ARGS} rehash
 
 	[ ! -e %%LOCALBASE%%/bin/cert-sync ] || \
 	    %%LOCALBASE%%/bin/cert-sync --quiet %%PREFIX%%/share/certs/ca-root-nss.crt