[oe-commits] [openembedded-core] 15/83: openssl: rehash actual mozilla certificates inside rootfs
git at git.openembedded.org
git at git.openembedded.org
Sun Nov 6 23:36:27 UTC 2016
rpurdie pushed a commit to branch master
in repository openembedded-core.
commit 5199b990edf4d9784c19137d0ce9ef141cd85e46
Author: Dmitry Rozhkov <dmitry.rozhkov at linux.intel.com>
AuthorDate: Fri Oct 28 10:22:35 2016 +0300
openssl: rehash actual mozilla certificates inside rootfs
The c_rehash utility is supposed to be run in the folder /etc/ssl/certs
of a rootfs where the package ca-certificates puts symlinks to
various CA certificates stored in /usr/share/ca-certificates/mozilla/.
These symlinks are absolute. This means that when c_rehash is run
at rootfs creation time it can't hash the actual files since they
actually reside in the build host's directory
$SYSROOT/usr/share/ca-certificates/mozilla/.
This problem doesn't reproduce when building on Debian or Ubuntu
hosts though, because these OSs have the certificates installed
in the same /usr/share/ca-certificates/mozilla/ folder.
Images built in other distros, e.g. Fedora, have problems with
connecting to https servers when using e.g. python's http lib.
The patch fixes c_rehash to check if it runs on a build host
by testing $SYSROOT and to translate the paths to certificates
accordingly.
Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov at linux.intel.com>
Signed-off-by: Ross Burton <ross.burton at intel.com>
---
.../openssl/openssl/openssl-c_rehash.sh | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
index f67f415..25ea729 100644
--- a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
+++ b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
@@ -114,11 +114,11 @@ link_hash()
LINKFILE=${HASH}.${TAG}${SUFFIX}
done
- echo "${1} => ${LINKFILE}"
+ echo "${3} => ${LINKFILE}"
# assume any system with a POSIX shell will either support symlinks or
# do something to handle this gracefully
- ln -s ${1} ${LINKFILE}
+ ln -s ${3} ${LINKFILE}
return 0
}
@@ -142,7 +142,19 @@ hash_dir()
ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE
do
- check_file ${FILE}
+ REAL_FILE=${FILE}
+ # if we run on build host then get to the real files in rootfs
+ if [ -n "${SYSROOT}" -a -h ${FILE} ]
+ then
+ FILE=$( readlink ${FILE} )
+ # check the symlink is absolute (or dangling in other word)
+ if [ "x/" == "x$( echo ${FILE} | cut -c1 -)" ]
+ then
+ REAL_FILE=${SYSROOT}/${FILE}
+ fi
+ fi
+
+ check_file ${REAL_FILE}
local FILE_TYPE=${?}
local TYPE_STR=''
@@ -157,7 +169,7 @@ hash_dir()
continue
fi
- link_hash ${FILE} ${TYPE_STR}
+ link_hash ${REAL_FILE} ${TYPE_STR} ${FILE}
done
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the Openembedded-commits
mailing list