maemachinebroke/hakurei
1
0
Fork 0
forked from security/hakurei
Code Pull Requests Activity

internal/rosa/ssl: prefix CA paths

Browse Source 
This makes prefixes consistent with everything else since this will end up in the final Rosa OS image.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2026-02-06 20:41:58 +09:00
parent 68aefa6d59
commit f9b69c94bc
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
internal/rosa/curl.go
View File

@@ -17,6 +17,7 @@ func (t Toolchain) newCurl() pkg.Artifact {
}, },
Configure: [][2]string{ Configure: [][2]string{
{"with-openssl"}, {"with-openssl"},
{"with-ca-bundle", "/system/etc/ssl/certs/ca-bundle.crt"},
}, },
ScriptConfigured: ` ScriptConfigured: `
make "-j$(nproc)" make "-j$(nproc)"

12
internal/rosa/ssl.go
View File

@@ -71,14 +71,14 @@ func (t Toolchain) newNSSCACert() pkg.Artifact {
t.Load(NSS), t.Load(NSS),
t.Load(buildcatrust), t.Load(buildcatrust),
}, nil, nil, ` }, nil, nil, `
mkdir -p /work/etc/ssl/{certs/unbundled,certs/hashed,trust-source} mkdir -p /work/system/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
buildcatrust \ buildcatrust \
--certdata_input /system/nss/certdata.txt \ --certdata_input /system/nss/certdata.txt \
--ca_bundle_output /work/etc/ssl/certs/ca-bundle.crt \ --ca_bundle_output /work/system/etc/ssl/certs/ca-bundle.crt \
--ca_standard_bundle_output /work/etc/ssl/certs/ca-no-trust-rules-bundle.crt \ --ca_standard_bundle_output /work/system/etc/ssl/certs/ca-no-trust-rules-bundle.crt \
--ca_unpacked_output /work/etc/ssl/certs/unbundled \ --ca_unpacked_output /work/system/etc/ssl/certs/unbundled \
--ca_hashed_unpacked_output /work/etc/ssl/certs/hashed \ --ca_hashed_unpacked_output /work/system/etc/ssl/certs/hashed \
--p11kit_output /work/etc/ssl/trust-source/ca-bundle.trust.p11-kit --p11kit_output /work/system/etc/ssl/trust-source/ca-bundle.trust.p11-kit
`) `)
} }
func init() { artifactsF[NSSCACert] = Toolchain.newNSSCACert } func init() { artifactsF[NSSCACert] = Toolchain.newNSSCACert }