minimal: Move CA trust regeneration down from standard

The stale trust store after an update is a property of the ostree /etc
merge, not of the standard content set. minimal already ships
ca-certificates (a hard dependency of openssl-libs), update-ca-trust and
systemd-update-done.service, so it has the same problem and everything
the unit needs. Moving the unit to minimal makes minimal-plus, standard,
ELN and IoT inherit it, and gives the image-based variants built on
minimal-plus (CoreOS, Atomic Desktops) a path to a shared fix.

The unit is unchanged. Its conditions already skip containers, images
without update-ca-trust, boots where /etc is current, and images that
carry coreos-update-ca-trust.service.

The rootfs check now runs in every tier instead of only in standard.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6

minimal/manifest.yaml

@@ -28,6 +28,7 @@ include:
   - basic-fixes.yaml
   - kernel-install.yaml
   - systemd-presets.yaml
+  - ca-trust.yaml
 
 packages:
   # this is implied by dependencies but let's make it explicit

standard/manifest.yaml

@@ -15,7 +15,6 @@ include:
   - persistent-journal.yaml
   - initramfs-full.yaml
   - generic-growfs.yaml
-  - ca-trust.yaml
   - systemd-presets.yaml
 
 packages:

tests/README.md

@@ -4,8 +4,8 @@
 For standard images, it also runs the CA trust, image derivation, and sysusers
 tests in disposable container builds.
 
-The CA trust rootfs check verifies that the refresh service is enabled in the
-standard image. `Containerfile.test-ca-trust` generates temporary test CAs and
+The CA trust rootfs check verifies that the refresh service is enabled in every
+tier. `Containerfile.test-ca-trust` generates temporary test CAs and
 exercises the installed service's command against stale trust bundles. It checks
 vendor CA additions and removals, preservation of local anchors and distrust,
 repeated refreshes, and removal of local policy in both the PEM and OpenSSL

tests/rootfs/cases/atomic-update-ca-trust

@@ -1,13 +1,12 @@
 #!/bin/bash
 set -xeuo pipefail
 
-# Like the automatic update timer, this service is only shipped in standard.
-if [ -f /usr/lib/systemd/system-preset/86-bootc-standard.preset ]; then
-    test -x /usr/bin/update-ca-trust
-    # This static unit is pulled in by a vendor .wants link. is-enabled reports
-    # "static" even with that link, so check that the target resolves to the unit.
-    unit=/usr/lib/systemd/system/atomic-update-ca-trust.service
-    wanted=/usr/lib/systemd/system/sysinit.target.wants/atomic-update-ca-trust.service
-    test -L "$wanted"
-    test "$unit" -ef "$wanted"
-fi
+# Shipped in minimal, so every tier inherits it. ca-certificates is a hard
+# dependency of openssl-libs, so the tool is present in every tier too.
+test -x /usr/bin/update-ca-trust
+# This static unit is pulled in by a vendor .wants link. is-enabled reports
+# "static" even with that link, so check that the target resolves to the unit.
+unit=/usr/lib/systemd/system/atomic-update-ca-trust.service
+wanted=/usr/lib/systemd/system/sysinit.target.wants/atomic-update-ca-trust.service
+test -L "$wanted"
+test "$unit" -ef "$wanted"