|
| 1 | +From f40ef246bcaa479eed39bbe1657c9952bb431211 Mon Sep 17 00:00:00 2001 |
| 2 | +From: reuben olinsky <reubeno@users.noreply.github.com> |
| 3 | +Date: Mon, 28 Apr 2025 09:49:16 -0700 |
| 4 | +Subject: [PATCH] fix: disable copying ca-trust dirs with Azure Linux 3 |
| 5 | + |
| 6 | +Makes ca-trust dir copying in copy_certs() a configurable behavior |
| 7 | +via new config option 'ssl_copied_ca_trust_dirs'. Disables this option |
| 8 | +in Azure Linux 3 configurations to avoid clashes between files copied |
| 9 | +from the host and a symlink installed by the ca-certificates-shared |
| 10 | +package in that distro. |
| 11 | + |
| 12 | +Fixes #1572 |
| 13 | +--- |
| 14 | + mock/docs/site-defaults.cfg | 11 +++++++++++ |
| 15 | + mock/py/mockbuild/config.py | 5 +++++ |
| 16 | + mock/py/mockbuild/package_manager.py | 10 ++++++---- |
| 17 | + releng/release-notes-next/azure-linux-ca-trust.bugfix | 5 +++++ |
| 18 | + |
| 19 | +diff --git a/mock/docs/site-defaults.cfg b/mock/docs/site-defaults.cfg |
| 20 | +index 61d890f20..622eae3a8 100644 |
| 21 | +--- a/mock/docs/site-defaults.cfg |
| 22 | ++++ b/mock/docs/site-defaults.cfg |
| 23 | +@@ -661,6 +661,17 @@ |
| 24 | + # if 0 is set, then no time limit is used |
| 25 | + # config_opts['opstimeout'] = 0 |
| 26 | + |
| 27 | ++# Copy host's ca-trust directories into the specified locations inside the |
| 28 | ++# chroot. Each item in the list is a pair of (host, chroot) paths for the |
| 29 | ++# directories to be copied, since some hosts and some destination chroots |
| 30 | ++# may use different paths. The directories are copied recursively. |
| 31 | ++#config_opts['ssl_copied_ca_trust_dirs'] = None |
| 32 | ++# Example: |
| 33 | ++#config_opts['ssl_copied_ca_trust_dirs'] = [ |
| 34 | ++# ('/etc/pki/ca-trust', '/etc/pki/ca-trust'), |
| 35 | ++# ('/usr/share/pki/ca-trust-source', '/usr/share/pki/ca-trust-source') |
| 36 | ++#] |
| 37 | ++ |
| 38 | + # Copy host's SSL certificate bundle ('/etc/pki/tls/certs/ca-bundle.crt') into |
| 39 | + # specified location inside chroot. This usually isn't needed because we copy |
| 40 | + # the whole /etc/pki/ca-trust/extracted directory recursively by default, and |
| 41 | +diff --git a/mock/py/mockbuild/config.py b/mock/py/mockbuild/config.py |
| 42 | +index d69a11d36..f6c11fc9c 100644 |
| 43 | +--- a/mock/py/mockbuild/config.py |
| 44 | ++++ b/mock/py/mockbuild/config.py |
| 45 | +@@ -136,6 +136,11 @@ def setup_default_config_opts(): |
| 46 | + |
| 47 | + config_opts['ssl_ca_bundle_path'] = None |
| 48 | + |
| 49 | ++ config_opts['ssl_copied_ca_trust_dirs'] = [ |
| 50 | ++ ('/etc/pki/ca-trust', '/etc/pki/ca-trust'), |
| 51 | ++ ('/usr/share/pki/ca-trust-source', '/usr/share/pki/ca-trust-source') |
| 52 | ++ ] |
| 53 | ++ |
| 54 | + config_opts['ssl_extra_certs'] = None |
| 55 | + |
| 56 | + # (global) plugins and plugin configs. |
| 57 | +diff --git a/mock/py/mockbuild/package_manager.py b/mock/py/mockbuild/package_manager.py |
| 58 | +index f88b3e6a5..8a8848079 100644 |
| 59 | +--- a/mock/py/mockbuild/package_manager.py |
| 60 | ++++ b/mock/py/mockbuild/package_manager.py |
| 61 | +@@ -398,10 +398,12 @@ def copy_gpg_keys(self): |
| 62 | + |
| 63 | + @traceLog() |
| 64 | + def copy_certs(self): |
| 65 | +- cert_paths = ["/etc/pki/ca-trust", "/usr/share/pki/ca-trust-source"] |
| 66 | +- for cert_path in cert_paths: |
| 67 | +- pki_dir = self.buildroot.make_chroot_path(cert_path) |
| 68 | +- file_util.update_tree(pki_dir, cert_path) |
| 69 | ++ copied_ca_cert_paths = self.config['ssl_copied_ca_trust_dirs'] |
| 70 | ++ if copied_ca_cert_paths: |
| 71 | ++ for host_path, root_path in copied_ca_cert_paths: |
| 72 | ++ self.buildroot.root_log.debug('copying CA trust dir into chroot: %s => %s', host_path, root_path) |
| 73 | ++ dest_dir = self.buildroot.make_chroot_path(root_path) |
| 74 | ++ file_util.update_tree(dest_dir, host_path) |
| 75 | + |
| 76 | + bundle_path = self.config['ssl_ca_bundle_path'] |
| 77 | + if bundle_path: |
| 78 | +diff --git a/releng/release-notes-next/azure-linux-ca-trust.bugfix b/releng/release-notes-next/azure-linux-ca-trust.bugfix |
| 79 | +new file mode 100644 |
| 80 | +index 000000000..3937d3ca1 |
| 81 | +--- /dev/null |
| 82 | ++++ b/releng/release-notes-next/azure-linux-ca-trust.bugfix |
| 83 | +@@ -0,0 +1,5 @@ |
| 84 | ++Disables copying /etc/pki/ca-trust and /usr/share/pki/ca-trust-source on |
| 85 | ++Azure Linux 3.0 via a new config options ('ssl_copied_ca_trust_dirs'). |
| 86 | ++This avoids file ownership conflicts with a symlink installed by the |
| 87 | ++ca-certificates-shared packages on that distro. Behavior should be unchanged |
| 88 | ++for other configurations. |
0 commit comments