From 71af986c085755a2fc5d7de5edfc4270fbd153d3 Mon Sep 17 00:00:00 2001 From: Joseph Marrero Corchado Date: Wed, 5 Aug 2026 13:41:32 -0400 Subject: [PATCH] standard: Add ca-trust and crypto-policies regeneration units On bootc/ostree systems, generated config files in /etc may become stale after an image upgrade due to the 3-way merge. Add systemd units that regenerate the CA trust store and crypto-policies backend files early in boot, adapted from CoreOS's approach. See: https://redhat.atlassian.net/browse/BIFROST-654 Generated-by: AI --- standard/bootc-update-ca-trust.service | 26 +++++++++++++++ standard/bootc-update-crypto-policies.service | 32 +++++++++++++++++++ standard/config-regeneration.yaml | 24 ++++++++++++++ standard/manifest.yaml | 1 + 4 files changed, 83 insertions(+) create mode 100644 standard/bootc-update-ca-trust.service create mode 100644 standard/bootc-update-crypto-policies.service create mode 100644 standard/config-regeneration.yaml diff --git a/standard/bootc-update-ca-trust.service b/standard/bootc-update-ca-trust.service new file mode 100644 index 00000000..b3f85df7 --- /dev/null +++ b/standard/bootc-update-ca-trust.service @@ -0,0 +1,26 @@ +# Adapted from CoreOS coreos-update-ca-trust.service +# https://github.com/coreos/fedora-coreos-config/blob/8ab99b12/overlay.d/05core/usr/lib/systemd/system/coreos-update-ca-trust.service +# +# On bootc/ostree systems, files generated by update-ca-trust in /etc +# may become stale after an image upgrade. The 3-way merge preserves +# locally modified generated files, so new CA additions or removals +# from the updated image are not reflected until regeneration. +# See: https://redhat.atlassian.net/browse/BIFROST-654 +[Unit] +Description=Regenerate CA certificate trust store +Documentation=https://gitlab.com/fedora/bootc/docs +# Only run on bootc/ostree deployed systems, not in containers. +ConditionPathIsMountPoint=/sysroot +# Only run if the update tool is available. +ConditionPathExists=/usr/bin/update-ca-trust +# We want to run as early as possible, in particular before anything +# that may speak TLS to external services. +DefaultDependencies=no +Requires=local-fs.target +After=local-fs.target +Before=sysinit.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/bin/update-ca-trust extract diff --git a/standard/bootc-update-crypto-policies.service b/standard/bootc-update-crypto-policies.service new file mode 100644 index 00000000..a56d330e --- /dev/null +++ b/standard/bootc-update-crypto-policies.service @@ -0,0 +1,32 @@ +# On bootc/ostree systems, crypto-policies backend files generated in +# /etc/crypto-policies/back-ends/ may become stale after an image +# upgrade. The 3-way merge preserves locally modified generated files, +# so bug fixes in policy generation from the updated image are not +# reflected until regeneration. +# +# Note: Ideally crypto-policies should be in place before PID 1 starts +# (systemd links against OpenSSL). A systemd unit cannot achieve that. +# Running before sysinit.target is the earliest practical point. For +# LUKS/initramfs scenarios, the initramfs must also be regenerated when +# crypto-policies change at build time. +# See: https://redhat.atlassian.net/browse/BIFROST-654 +[Unit] +Description=Regenerate crypto-policies backend configuration +Documentation=https://gitlab.com/fedora/bootc/docs +# Only run on bootc/ostree deployed systems, not in containers. +ConditionPathIsMountPoint=/sysroot +# Only run if the update tool is available (crypto-policies-scripts). +ConditionPathExists=/usr/bin/update-crypto-policies +# We want to run as early as possible, before services that depend +# on crypto policy settings (TLS, SSH, Kerberos, etc.). +DefaultDependencies=no +Requires=local-fs.target +After=local-fs.target +Before=sysinit.target + +[Service] +Type=oneshot +RemainAfterExit=yes +# Re-apply the currently configured policy to regenerate all backend +# files from the (potentially updated) policy definitions in /usr. +ExecStart=/bin/bash -c 'exec /usr/bin/update-crypto-policies --set "$(/usr/bin/update-crypto-policies --show)"' diff --git a/standard/config-regeneration.yaml b/standard/config-regeneration.yaml new file mode 100644 index 00000000..83a3cbd3 --- /dev/null +++ b/standard/config-regeneration.yaml @@ -0,0 +1,24 @@ +# Regenerate CA trust store and crypto-policies backend files on boot. +# +# On bootc/ostree systems, generated config files in /etc may become +# stale after an image upgrade due to the 3-way merge preserving +# locally modified files. These units ensure generated files are +# always consistent with the current image + local customizations. +# +# See: https://redhat.atlassian.net/browse/BIFROST-654 +# CoreOS ref: https://github.com/coreos/fedora-coreos-config/blob/8ab99b12/overlay.d/05core/usr/lib/systemd/system/coreos-update-ca-trust.service +add-files: + - - bootc-update-ca-trust.service + - /usr/lib/systemd/system/bootc-update-ca-trust.service + - - bootc-update-crypto-policies.service + - /usr/lib/systemd/system/bootc-update-crypto-policies.service + +postprocess: + - | + #!/bin/bash + set -xeuo pipefail + chmod 0644 /usr/lib/systemd/system/bootc-update-ca-trust.service + chmod 0644 /usr/lib/systemd/system/bootc-update-crypto-policies.service + mkdir -p /usr/lib/systemd/system/sysinit.target.wants + ln -s ../bootc-update-ca-trust.service /usr/lib/systemd/system/sysinit.target.wants/bootc-update-ca-trust.service + ln -s ../bootc-update-crypto-policies.service /usr/lib/systemd/system/sysinit.target.wants/bootc-update-crypto-policies.service diff --git a/standard/manifest.yaml b/standard/manifest.yaml index 51820946..e0bcbecd 100644 --- a/standard/manifest.yaml +++ b/standard/manifest.yaml @@ -15,6 +15,7 @@ include: - persistent-journal.yaml - initramfs-full.yaml - generic-growfs.yaml + - config-regeneration.yaml - systemd-presets.yaml packages: