standard: Add ca-trust and crypto-policies regeneration units

On bootc/ostree systems, generated config files in /etc may become
stale after an image upgrade due to the 3-way merge. Add systemd
units that regenerate the CA trust store and crypto-policies backend
files early in boot, adapted from CoreOS's approach.

See: https://redhat.atlassian.net/browse/BIFROST-654

Generated-by: AI

standard/bootc-update-ca-trust.service

@@ -0,0 +1,26 @@
+# Adapted from CoreOS coreos-update-ca-trust.service
+# https://github.com/coreos/fedora-coreos-config/blob/8ab99b12/overlay.d/05core/usr/lib/systemd/system/coreos-update-ca-trust.service
+#
+# On bootc/ostree systems, files generated by update-ca-trust in /etc
+# may become stale after an image upgrade. The 3-way merge preserves
+# locally modified generated files, so new CA additions or removals
+# from the updated image are not reflected until regeneration.
+# See: https://redhat.atlassian.net/browse/BIFROST-654
+[Unit]
+Description=Regenerate CA certificate trust store
+Documentation=https://gitlab.com/fedora/bootc/docs
+# Only run on bootc/ostree deployed systems, not in containers.
+ConditionPathIsMountPoint=/sysroot
+# Only run if the update tool is available.
+ConditionPathExists=/usr/bin/update-ca-trust
+# We want to run as early as possible, in particular before anything
+# that may speak TLS to external services.
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/update-ca-trust extract

standard/bootc-update-crypto-policies.service

@@ -0,0 +1,32 @@
+# On bootc/ostree systems, crypto-policies backend files generated in
+# /etc/crypto-policies/back-ends/ may become stale after an image
+# upgrade. The 3-way merge preserves locally modified generated files,
+# so bug fixes in policy generation from the updated image are not
+# reflected until regeneration.
+#
+# Note: Ideally crypto-policies should be in place before PID 1 starts
+# (systemd links against OpenSSL). A systemd unit cannot achieve that.
+# Running before sysinit.target is the earliest practical point. For
+# LUKS/initramfs scenarios, the initramfs must also be regenerated when
+# crypto-policies change at build time.
+# See: https://redhat.atlassian.net/browse/BIFROST-654
+[Unit]
+Description=Regenerate crypto-policies backend configuration
+Documentation=https://gitlab.com/fedora/bootc/docs
+# Only run on bootc/ostree deployed systems, not in containers.
+ConditionPathIsMountPoint=/sysroot
+# Only run if the update tool is available (crypto-policies-scripts).
+ConditionPathExists=/usr/bin/update-crypto-policies
+# We want to run as early as possible, before services that depend
+# on crypto policy settings (TLS, SSH, Kerberos, etc.).
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+# Re-apply the currently configured policy to regenerate all backend
+# files from the (potentially updated) policy definitions in /usr.
+ExecStart=/bin/bash -c 'exec /usr/bin/update-crypto-policies --set "$(/usr/bin/update-crypto-policies --show)"'

standard/config-regeneration.yaml

@@ -0,0 +1,24 @@
+# Regenerate CA trust store and crypto-policies backend files on boot.
+#
+# On bootc/ostree systems, generated config files in /etc may become
+# stale after an image upgrade due to the 3-way merge preserving
+# locally modified files. These units ensure generated files are
+# always consistent with the current image + local customizations.
+#
+# See: https://redhat.atlassian.net/browse/BIFROST-654
+# CoreOS ref: https://github.com/coreos/fedora-coreos-config/blob/8ab99b12/overlay.d/05core/usr/lib/systemd/system/coreos-update-ca-trust.service
+add-files:
+  - - bootc-update-ca-trust.service
+    - /usr/lib/systemd/system/bootc-update-ca-trust.service
+  - - bootc-update-crypto-policies.service
+    - /usr/lib/systemd/system/bootc-update-crypto-policies.service
+
+postprocess:
+  - |
+    #!/bin/bash
+    set -xeuo pipefail
+    chmod 0644 /usr/lib/systemd/system/bootc-update-ca-trust.service
+    chmod 0644 /usr/lib/systemd/system/bootc-update-crypto-policies.service
+    mkdir -p /usr/lib/systemd/system/sysinit.target.wants
+    ln -s ../bootc-update-ca-trust.service /usr/lib/systemd/system/sysinit.target.wants/bootc-update-ca-trust.service
+    ln -s ../bootc-update-crypto-policies.service /usr/lib/systemd/system/sysinit.target.wants/bootc-update-crypto-policies.service

standard/manifest.yaml

@@ -15,6 +15,7 @@ include:
   - persistent-journal.yaml
   - initramfs-full.yaml
   - generic-growfs.yaml
+  - config-regeneration.yaml
   - systemd-presets.yaml
 
 packages: