From 17e44957df28895d892e3062471aeafb79352286 Mon Sep 17 00:00:00 2001 From: Joseph Marrero Corchado Date: Thu, 29 Oct 2026 10:31:54 -0400 Subject: [PATCH] minimal: Move CA trust regeneration down from standard The stale trust store after an update is a property of the ostree /etc merge, not of the standard content set. minimal already ships ca-certificates (a hard dependency of openssl-libs), update-ca-trust and systemd-update-done.service, so it has the same problem and everything the unit needs. Moving the unit to minimal makes minimal-plus, standard, ELN and IoT inherit it, and gives the image-based variants built on minimal-plus (CoreOS, Atomic Desktops) a path to a shared fix. The unit is unchanged. Its conditions already skip containers, images without update-ca-trust, boots where /etc is current, and images that carry coreos-update-ca-trust.service. The rootfs check now runs in every tier instead of only in standard. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6 --- .../atomic-update-ca-trust.service | 0 {standard => minimal}/ca-trust.yaml | 0 minimal/manifest.yaml | 1 + standard/manifest.yaml | 1 - tests/README.md | 4 ++-- tests/rootfs/cases/atomic-update-ca-trust | 19 +++++++++---------- 6 files changed, 12 insertions(+), 13 deletions(-) rename {standard => minimal}/atomic-update-ca-trust.service (100%) rename {standard => minimal}/ca-trust.yaml (100%) diff --git a/standard/atomic-update-ca-trust.service b/minimal/atomic-update-ca-trust.service similarity index 100% rename from standard/atomic-update-ca-trust.service rename to minimal/atomic-update-ca-trust.service diff --git a/standard/ca-trust.yaml b/minimal/ca-trust.yaml similarity index 100% rename from standard/ca-trust.yaml rename to minimal/ca-trust.yaml diff --git a/minimal/manifest.yaml b/minimal/manifest.yaml index 411a026b..be2c3195 100644 --- a/minimal/manifest.yaml +++ b/minimal/manifest.yaml @@ -28,6 +28,7 @@ include: - basic-fixes.yaml - kernel-install.yaml - systemd-presets.yaml + - ca-trust.yaml packages: # this is implied by dependencies but let's make it explicit diff --git a/standard/manifest.yaml b/standard/manifest.yaml index f27a93dd..51820946 100644 --- a/standard/manifest.yaml +++ b/standard/manifest.yaml @@ -15,7 +15,6 @@ include: - persistent-journal.yaml - initramfs-full.yaml - generic-growfs.yaml - - ca-trust.yaml - systemd-presets.yaml packages: diff --git a/tests/README.md b/tests/README.md index 4bd6d16a..2b2fcee1 100644 --- a/tests/README.md +++ b/tests/README.md @@ -4,8 +4,8 @@ For standard images, it also runs the CA trust, image derivation, and sysusers tests in disposable container builds. -The CA trust rootfs check verifies that the refresh service is enabled in the -standard image. `Containerfile.test-ca-trust` generates temporary test CAs and +The CA trust rootfs check verifies that the refresh service is enabled in every +tier. `Containerfile.test-ca-trust` generates temporary test CAs and exercises the installed service's command against stale trust bundles. It checks vendor CA additions and removals, preservation of local anchors and distrust, repeated refreshes, and removal of local policy in both the PEM and OpenSSL diff --git a/tests/rootfs/cases/atomic-update-ca-trust b/tests/rootfs/cases/atomic-update-ca-trust index d82c2785..a682b367 100755 --- a/tests/rootfs/cases/atomic-update-ca-trust +++ b/tests/rootfs/cases/atomic-update-ca-trust @@ -1,13 +1,12 @@ #!/bin/bash set -xeuo pipefail -# Like the automatic update timer, this service is only shipped in standard. -if [ -f /usr/lib/systemd/system-preset/86-bootc-standard.preset ]; then - test -x /usr/bin/update-ca-trust - # This static unit is pulled in by a vendor .wants link. is-enabled reports - # "static" even with that link, so check that the target resolves to the unit. - unit=/usr/lib/systemd/system/atomic-update-ca-trust.service - wanted=/usr/lib/systemd/system/sysinit.target.wants/atomic-update-ca-trust.service - test -L "$wanted" - test "$unit" -ef "$wanted" -fi +# Shipped in minimal, so every tier inherits it. ca-certificates is a hard +# dependency of openssl-libs, so the tool is present in every tier too. +test -x /usr/bin/update-ca-trust +# This static unit is pulled in by a vendor .wants link. is-enabled reports +# "static" even with that link, so check that the target resolves to the unit. +unit=/usr/lib/systemd/system/atomic-update-ca-trust.service +wanted=/usr/lib/systemd/system/sysinit.target.wants/atomic-update-ca-trust.service +test -L "$wanted" +test "$unit" -ef "$wanted"