Re: security/ca_root_nss: Remove duplicate PLIST entry

From: Franco Fichtner <>
Date: Wed, 20 Sep 2023 13:13:00 UTC

> On 20. Sep 2023, at 1:17 PM, Bernhard Froehlich <> wrote:
> Before anyone is going to revert this I'd like to add that it seems to fix a
> bug with Custom Root CA for me.

Thanks, would have been nice to have this on record.

> Up to now whenever I have a box with an additional Private Root CA in
> /usr/local/share/certs/ and run "certctl rehash" some tools like fetch
> work properly up to the point when ca_root_nss is installed.
> Removing ca_root_nss also made it work properly:
> pkg remove -f ca_root_nss

I think that's mainly because ETCSYMLINK is enabled by default in
the port.  Without it there's no issue.  Maybe for all releases
bundling CA's it could be turned off by default now?

The main problem is that ca_root_nss caters a bundle for 3 separate
locations used by different services and now makes two of them adjustable
and the last one a fixed link with ETCSYMLINK and having multiple upstream
projects use any of these locations with differing resulting bundles
in the worst case is not ideal.

So really the samples belong to ETCSYMLINK turned off and the links
belong to ETCSYMLINK turned on.  The patch just tries to break the
ambiguity with the wrong conclusion.  They are the same but they are
separate use cases.

There is no proper override strategy in the port that comes from a
single location an propagates over to the target locations.

Granted I'm not using ETCSYMLINK because I need /etc/ssl/cert.pem to be
a collection of upstream and manual CA's anyway.  At the moment the
motivation is not to drop the consistency that ETCSYMLINK offers for
this discussion.