]> code.ossystems Code Review - openembedded-core.git/commit
openssl: rehash actual mozilla certificates inside rootfs
authorDmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
Fri, 28 Oct 2016 07:22:35 +0000 (10:22 +0300)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Sun, 6 Nov 2016 23:35:16 +0000 (23:35 +0000)
commit5199b990edf4d9784c19137d0ce9ef141cd85e46
tree4348b5c04ba353907d2dd4e89ef51869ba36e0c1
parent1fe17c52e4d7ce1b9d69aaa2cd9d4b351a4b2603
openssl: rehash actual mozilla certificates inside rootfs

The c_rehash utility is supposed to be run in the folder /etc/ssl/certs
of a rootfs where the package ca-certificates puts symlinks to
various CA certificates stored in /usr/share/ca-certificates/mozilla/.
These symlinks are absolute. This means that when c_rehash is run
at rootfs creation time it can't hash the actual files since they
actually reside in the build host's directory
$SYSROOT/usr/share/ca-certificates/mozilla/.

This problem doesn't reproduce when building on Debian or Ubuntu
hosts though, because these OSs have the certificates installed
in the same /usr/share/ca-certificates/mozilla/ folder.
Images built in other distros, e.g. Fedora, have problems with
connecting to https servers when using e.g. python's http lib.

The patch fixes c_rehash to check if it runs on a build host
by testing $SYSROOT and to translate the paths to certificates
accordingly.

Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh