svn commit: r365987 - in stable/12: . usr.sbin/bsdinstall/scripts
Kyle Evans
kevans at FreeBSD.org
Tue Sep 22 02:14:57 UTC 2020
Author: kevans
Date: Tue Sep 22 02:14:55 2020
New Revision: 365987
URL: https://svnweb.freebsd.org/changeset/base/365987
Log:
MFC r365829, r365837, r365852: certctl rehash upon install/distribute
r365829:
installworld: run `certctl rehash` after installation completes
This was originally introduced back in r360833, and subsequently reverted
because it was broken for -DNO_ROOT builds and it may not have been the
correct place for it.
While debatably this may still not be 'the correct place,' it's much cleaner
than scattering rehashes all throughout the tree. brooks has fixed the issue
with -DNO_ROOT by properly writing to the METALOG in r361397.
Do note that this is different than what was originally committed; brooks
had revisions in D24932 that made it actually use the revised unprivileged
mode and write to METALOG, along with being a little more friendly to
foreign crossbuilds and just using the certctl in-tree.
With this change, I believe we should now have a populated /etc/ssl/certs in
the VM images.
r365837:
Promote the installworld `certctl rehash` to distributeworld
Contrary to my belief, installworld is not sufficient for getting certs
installed into VM images. Promote the rehash to both installworld and
distributeworld (notably: not stageworld) and rehash the base distdir so we
end up with /etc/ssl/certs populated in the base dist archive. A future
commit will remove the rehash from bsdinstall, which doesn't really need to
happen if they're installed into base.txz.
While here, fix a minor typo: s/CERTCLTFLAGS/CERTCTLFLAGS/
r365852:
Revert r361257: bsdinstall: do a `certctl rehash` upon installation [...]
As of r365829, any given base distribution set will now include the /etc/ssl
symlinks that this rehash would've otherwise installed. This extra step is
no longer required.
Modified:
stable/12/Makefile.inc1
stable/12/usr.sbin/bsdinstall/scripts/config
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/Makefile.inc1
==============================================================================
--- stable/12/Makefile.inc1 Tue Sep 22 01:58:18 2020 (r365986)
+++ stable/12/Makefile.inc1 Tue Sep 22 02:14:55 2020 (r365987)
@@ -849,7 +849,9 @@ INSTALL_DDIR= ${_INSTALL_DDIR:S://:/:g:C:/$::}
METALOG?= ${DESTDIR}/${DISTDIR}/METALOG
METALOG:= ${METALOG:C,//+,/,g}
IMAKE+= -DNO_ROOT METALOG=${METALOG}
-INSTALLFLAGS+= -U -M ${METALOG} -D ${INSTALL_DDIR}
+METALOG_INSTALLFLAGS= -U -M ${METALOG} -D ${INSTALL_DDIR}
+INSTALLFLAGS+= ${METALOG_INSTALLFLAGS}
+CERTCTLFLAGS= ${METALOG_INSTALLFLAGS}
MTREEFLAGS+= -W
.endif
.if defined(BUILD_PKGS)
@@ -859,6 +861,11 @@ INSTALLFLAGS+= -h sha256
IMAKE_INSTALL= INSTALL="install ${INSTALLFLAGS}"
IMAKE_MTREE= MTREE_CMD="mtree ${MTREEFLAGS}"
.endif
+.if make(distributeworld)
+CERTCTLDESTDIR= ${DESTDIR}/${DISTDIR}/base
+.else
+CERTCTLDESTDIR= ${DESTDIR}
+.endif
DESTDIR_MTREEFLAGS= -deU
# When creating worldtmp we don't need to set the directories as owned by root
@@ -1419,6 +1426,14 @@ distributeworld installworld stageworld: _installcheck
${DESTDIR}/${DISTDIR}/${dist}.debug.meta
.endfor
.endif
+.endif # make(distributeworld)
+.if !make(packageworld) && ${MK_CAROOT} != "no"
+ @if which openssl>/dev/null; then \
+ DESTDIR=${CERTCTLDESTDIR} \
+ sh ${SRCTOP}/usr.sbin/certctl/certctl.sh ${CERTCTLFLAGS} rehash \
+ else \
+ echo "No openssl on the host, not rehashing certificates target -- /etc/ssl may not be populated."; \
+ fi
.endif
packageworld: .PHONY
Modified: stable/12/usr.sbin/bsdinstall/scripts/config
==============================================================================
--- stable/12/usr.sbin/bsdinstall/scripts/config Tue Sep 22 01:58:18 2020 (r365986)
+++ stable/12/usr.sbin/bsdinstall/scripts/config Tue Sep 22 02:14:55 2020 (r365987)
@@ -55,9 +55,6 @@ cp $BSDINSTALL_TMPBOOT/* $BSDINSTALL_CHROOT/boot
# Set up other things from installed config
chroot $BSDINSTALL_CHROOT /usr/bin/newaliases > /dev/null 2>&1
-if [ -x $BSDINSTALL_CHROOT/usr/sbin/certctl ]; then
- chroot $BSDINSTALL_CHROOT /usr/sbin/certctl rehash
-fi
exit 0
More information about the svn-src-all
mailing list