Re: [OE-core][PATCH] openssl: Do not create /etc/ssl/certs

["Richard Purdie" <richard.purdie@linuxfoundation.org>]

On Tue, 2020-11-03 at 07:44 -0600, Nate Karstens via lists.openembedded.org wrote:
> The openssl package previously created an empty folder for
> CA certificates at /etc/ssl/certs. Other packages, like
> ca-certificates, would then populate this folder.
> 
> Certain systems need more flexibility with how this folder
> is created and populated (e.g., a symlink is needed). To
> accommodate this, the openssl recipe no longer creates the
> empty folder. Instead, the folder will only be created by
> packages that populate it.
> 
> Signed-off-by: Nate Karstens <nate.karstens@garmin.com>
> ---
>  meta/recipes-connectivity/openssl/openssl_1.1.1h.bb | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb
> index eb11fe3960..5723d19dbf 100644
> --- a/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb
> +++ b/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb
> @@ -134,14 +134,12 @@ do_install () {
>  	# Create SSL structure for packages such as ca-certificates which
>  	# contain hard-coded paths to /etc/ssl. Debian does the same.
>  	install -d ${D}${sysconfdir}/ssl
> -	mv ${D}${libdir}/ssl-1.1/certs \
> -	   ${D}${libdir}/ssl-1.1/private \
> +	mv ${D}${libdir}/ssl-1.1/private \
>  	   ${D}${libdir}/ssl-1.1/openssl.cnf \
>  	   ${D}${sysconfdir}/ssl/
>  
>  	# Although absolute symlinks would be OK for the target, they become
>  	# invalid if native or nativesdk are relocated from sstate.
> -	ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-1.1/certs
>  	ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-1.1/private
>  	ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-1.1/openssl.cnf

When you asked about this in the previous email, I questioned whether
we still needed the symlink. Did you check into that? I suspect we may
need it as openssl itself may reference that path internally?

Cheers,

Richard