Updates to ca-certificates-pki resets ca bundle
Open
Nobody has claimed this yet.
bug
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 692
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Versions:
Photon OS 3.0
ca-certificates-pki-20190521-2.ph3.x86_64
Linux certificate bundle /etc/pki/tls/certs/ca-bundle.crt is updated with a self signed CA using rehash_ca_certificates. An update to package ca-certificates-pki resets the bundle to original value.
Reproduction steps
1. Add custom ca to /etc/ssl/certs
2. Run rehash_ca_certificates to update the bundle
3. Update/reinstall ca-certificates-pki-20190521-2.ph3.x86_64
`tdnf reinstall ca-certificates-pki-20190521-2.ph3.x86_64`
Expected behavior
Certificate bundle should persist custom certificate
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the ca-certificates-pki update or reinstall handling around /etc/pki/tls/certs/ca-bundle.crt, /etc/ssl/certs, and the rehash_ca_certificates entry point. Reproduce the issue with the listed tdnf reinstall command and verify that a custom certificate remains in the bundle after the package operation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100