sysmo-bts
/
generic-poky
9
0
Fork 0
Code Pull Requests Releases Activity

openssl: rehash actual mozilla certificates inside rootfs 

The c_rehash utility is supposed to be run in the folder /etc/ssl/certs
of a rootfs where the package ca-certificates puts symlinks to
various CA certificates stored in /usr/share/ca-certificates/mozilla/.
These symlinks are absolute. This means that when c_rehash is run
at rootfs creation time it can't hash the actual files since they
actually reside in the build host's directory
$SYSROOT/usr/share/ca-certificates/mozilla/.

This problem doesn't reproduce when building on Debian or Ubuntu
hosts though, because these OSs have the certificates installed
in the same /usr/share/ca-certificates/mozilla/ folder.
Images built in other distros, e.g. Fedora, have problems with
connecting to https servers when using e.g. python's http lib.

The patch fixes c_rehash to check if it runs on a build host
by testing $SYSROOT and to translate the paths to certificates
accordingly.

(From OE-Core rev: 5199b990edf4d9784c19137d0ce9ef141cd85e46)

Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Dmitry Rozhkov 2016-10-28 10:22:35 +03:00 committed by Richard Purdie
parent 3d4c896b2a
commit ef1fa14260
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
View File

@ -114,11 +114,11 @@ link_hash()
LINKFILE=${HASH}.${TAG}${SUFFIX}
done
echo "${1} => ${LINKFILE}"
echo "${3} => ${LINKFILE}"
# assume any system with a POSIX shell will either support symlinks or
# do something to handle this gracefully
ln -s ${1} ${LINKFILE}
ln -s ${3} ${LINKFILE}
return 0
}
@ -142,7 +142,19 @@ hash_dir()
ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE
do
check_file ${FILE}
REAL_FILE=${FILE}
# if we run on build host then get to the real files in rootfs
if [ -n "${SYSROOT}" -a -h ${FILE} ]
then
FILE=$( readlink ${FILE} )
# check the symlink is absolute (or dangling in other word)
if [ "x/" == "x$( echo ${FILE} | cut -c1 -)" ]
then
REAL_FILE=${SYSROOT}/${FILE}
fi
fi
check_file ${REAL_FILE}
local FILE_TYPE=${?}
local TYPE_STR=''
@ -157,7 +169,7 @@ hash_dir()
continue
fi
link_hash ${FILE} ${TYPE_STR}
link_hash ${REAL_FILE} ${TYPE_STR} ${FILE}
done
}