openssl: rehash actual mozilla certificates inside rootfs

The c_rehash utility is supposed to be run in the folder /etc/ssl/certs
of a rootfs where the package ca-certificates puts symlinks to
various CA certificates stored in /usr/share/ca-certificates/mozilla/.
These symlinks are absolute. This means that when c_rehash is run
at rootfs creation time it can't hash the actual files since they
actually reside in the build host's directory
$SYSROOT/usr/share/ca-certificates/mozilla/.

This problem doesn't reproduce when building on Debian or Ubuntu
hosts though, because these OSs have the certificates installed
in the same /usr/share/ca-certificates/mozilla/ folder.
Images built in other distros, e.g. Fedora, have problems with
connecting to https servers when using e.g. python's http lib.

The patch fixes c_rehash to check if it runs on a build host
by testing $SYSROOT and to translate the paths to certificates
accordingly.

(From OE-Core rev: 5199b990edf4d9784c19137d0ce9ef141cd85e46)

Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
index f67f415544bc4d91adb3145a488e03c534064013..25ea729ac172e6572b9ff2917f52bb338d88e00a 100644 (file)
--- a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
+++ b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
@@ -114,11 +114,11 @@ link_hash()
        LINKFILE=${HASH}.${TAG}${SUFFIX}
     done
 
-    echo "${1} => ${LINKFILE}"
+    echo "${3} => ${LINKFILE}"
 
     # assume any system with a POSIX shell will either support symlinks or
     # do something to handle this gracefully
-    ln -s ${1} ${LINKFILE}
+    ln -s ${3} ${LINKFILE}
 
     return 0
 }
@@ -142,7 +142,19 @@ hash_dir()
 
     ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE
     do
-       check_file ${FILE}
+       REAL_FILE=${FILE}
+       # if we run on build host then get to the real files in rootfs
+       if [ -n "${SYSROOT}" -a -h ${FILE} ]
+       then
+           FILE=$( readlink ${FILE} )
+           # check the symlink is absolute (or dangling in other word)
+           if [ "x/" == "x$( echo ${FILE} | cut -c1 -)" ]
+           then
+               REAL_FILE=${SYSROOT}/${FILE}
+           fi
+       fi
+
+       check_file ${REAL_FILE}
         local FILE_TYPE=${?}
        local TYPE_STR=''
 
@@ -157,7 +169,7 @@ hash_dir()
            continue
         fi
 
-       link_hash ${FILE} ${TYPE_STR}
+       link_hash ${REAL_FILE} ${TYPE_STR} ${FILE}
     done
 }