Re: [OE-core][PATCH] openssl: Do not create /etc/ssl/certs

["Nate Karstens" <nate.karstens@garmin.com>]

My introductory message seems to have been deleted.

This was in reply to https://lists.openembedded.org/g/openembedded-core/topic/77917492#144026 and was tested with core-image-sato build using OpenSSL 1.1.1g.

Nate

-----Original Message-----
From: Karstens, Nate <Nate.Karstens@garmin.com> 
Sent: Tuesday, November 03, 2020 07:44
To: openembedded-core@lists.openembedded.org
Cc: Karstens, Nate <Nate.Karstens@garmin.com>
Subject: [OE-core][PATCH] openssl: Do not create /etc/ssl/certs

The openssl package previously created an empty folder for CA certificates at /etc/ssl/certs. Other packages, like ca-certificates, would then populate this folder.

Certain systems need more flexibility with how this folder is created and populated (e.g., a symlink is needed). To accommodate this, the openssl recipe no longer creates the empty folder. Instead, the folder will only be created by packages that populate it.

Signed-off-by: Nate Karstens <nate.karstens@garmin.com>
---
 meta/recipes-connectivity/openssl/openssl_1.1.1h.bb | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb b/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb
index eb11fe3960..5723d19dbf 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.1.1h.bb
@@ -134,14 +134,12 @@ do_install () {
 	# Create SSL structure for packages such as ca-certificates which
 	# contain hard-coded paths to /etc/ssl. Debian does the same.
 	install -d ${D}${sysconfdir}/ssl
-	mv ${D}${libdir}/ssl-1.1/certs \
-	   ${D}${libdir}/ssl-1.1/private \
+	mv ${D}${libdir}/ssl-1.1/private \
 	   ${D}${libdir}/ssl-1.1/openssl.cnf \
 	   ${D}${sysconfdir}/ssl/
 
 	# Although absolute symlinks would be OK for the target, they become
 	# invalid if native or nativesdk are relocated from sstate.
-	ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/certs')} ${D}${libdir}/ssl-1.1/certs
 	ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/private')} ${D}${libdir}/ssl-1.1/private
 	ln -sf ${@oe.path.relative('${libdir}/ssl-1.1', '${sysconfdir}/ssl/openssl.cnf')} ${D}${libdir}/ssl-1.1/openssl.cnf  }
--
2.28.0