From mboxrd@z Thu Jan 1 00:00:00 1970 Subject: openssl: Proposal to stop creating /etc/ssl/certs To: openembedded-core@lists.openembedded.org From: nate.karstens@garmin.com X-Originating-Location: Olathe, Kansas, US (204.77.163.55) X-Originating-Platform: Windows Firefox 81 User-Agent: GROUPS.IO Web Poster MIME-Version: 1.0 Date: Fri, 30 Oct 2020 10:25:31 -0700 Message-ID: Content-Type: multipart/alternative; boundary="Ep8ollUA0F1TV1AmRmGc" --Ep8ollUA0F1TV1AmRmGc Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Greetings, The openssl recipe installs an empty folder /etc/ssl/certs. This is eventu= ally where other recipes like ca-certificates can copy CA certificates for = the system. We are working on a tool that can hot-swap those certificates a= t runtime. The only way to have this transition be seamless and atomic is t= o make /etc/ssl/certs a symlink to another folder that contains the actual = certificates; to update the certificates we just replace the symlink. Our recipe for this tool conflicts with the empty folder in the openssl pa= ckage. We were wondering if it made sense to change the openssl recipe to n= o longer create this folder, the idea being that recipes that populate the = folder (like ca-certificates) would be responsible for creating it. Here is a link to the recipe: https://git.yoctoproject.org/cgit/cgit.cgi/poky/tree/meta/recipes-connecti= vity/openssl/openssl_1.1.1g.bb ( https://urldefense.com/v3/__https:/git.yoc= toproject.org/cgit/cgit.cgi/poky/tree/meta/recipes-connectivity/openssl/ope= nssl_1.1.1g.bb__;!!EJc4YC3iFmQ!CgiLpD5LsQ6adCzphoFeUHIvQm-M8g2nkDA4_4gtF71e= Hm20Q0lGSwMahtdHA3ybWA$ ) Line 135 does contain a note that Debian sets up the SSL structure. Creati= ng a placeholder for where CA certificates would eventually go makes sense = with certain systems. There could be desktop distros that rely on the user = to manually install the certs they need for their organization and providin= g a location for this would be helpful. I don=E2=80=99t think this makes se= nse for the typical embedded system where this folder is on a read-only fil= esystem. I've just been testing locally with a bbappend that uses rmdir to remove t= he folder, but unless there are objections I will submit a patch that remov= es lines 137 (moving the 'mv' to the next line) and 144. I think line 152 c= an remain in case the variable is useful to anyone. Thanks, Nate Karstens Marine Software Engineering Garmin International, Inc. --Ep8ollUA0F1TV1AmRmGc Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Greetings,

The openssl = recipe installs an empty folder /etc/ssl/certs. This is eventually where ot= her recipes like ca-certificates can copy CA certificates for the system. W= e are working on a tool that can hot-swap those certificates at runtime. Th= e only way to have this transition be seamless and atomic is to make /etc/s= sl/certs a symlink to another folder that contains the actual certificates;= to update the certificates we just replace the symlink.

=C2=A0

Our recipe for this tool confli= cts with the empty folder in the openssl package. We were wondering if it m= ade sense to change the openssl recipe to no longer create this folder, the= idea being that recipes that populate the folder (like ca-certificates) wo= uld be responsible for creating it.

=C2=A0

Here is a link to the recipe:

=C2=A0

https://git.yoctoproject.org/cgit/cgit.cgi/poky/tree/meta/recipes-co= nnectivity/openssl/openssl_1.1.1g.bb

=C2=A0

Line 135 does contain a note th= at Debian sets up the SSL structure. Creating a placeholder for where CA ce= rtificates would eventually go makes sense with certain systems. There coul= d be desktop distros that rely on the user to manually install the certs th= ey need for their organization and providing a location for this would be h= elpful. I don=E2=80=99t think this makes sense for the typical embedded sys= tem where this folder is on a read-only filesystem.

=C2=A0

I've just been testing loca= lly with a bbappend that uses rmdir to remove the folder, but unless there = are objections I will submit a patch that removes lines 137 (moving the = 9;mv' to the next line) and 144. I think line 152 can remain in case th= e variable is useful to anyone.

Thanks,

Nate Karstens
Marine Software Engineering
Garmin International, Inc.

--Ep8ollUA0F1TV1AmRmGc--