iot/base-images
0
0
Fork 0
mirror of https://gitlab.com/fedora/bootc/base-images.git synced 2026-11-05 12:19:43 +00:00
Code Issues Projects Releases Packages Wiki Activity

standard: Order CA trust regeneration before systemd-resolved

Browse source 
systemd-resolved uses DefaultDependencies=no and orders itself before
sysinit.target, so it could start in parallel with the regeneration and
read a stale trust store for DNS-over-TLS. Order the service before it.
The ordering is ignored when systemd-resolved is not installed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6
This commit is contained in:
Joseph Marrero 2026-10-27 15:00:14 -04:00
commit f803e4d4c8
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
standard/atomic-update-ca-trust.service
View file

@ -20,6 +20,11 @@ DefaultDependencies=no
Requires=local-fs.target
After=local-fs.target
Before=sysinit.target
# systemd-resolved also uses DefaultDependencies=no and orders itself before
# sysinit.target, so without an explicit ordering it can start in parallel
# with regeneration and read a stale trust store for DNS-over-TLS. Order
# before it; systemd ignores this when the unit is not installed.
Before=systemd-resolved.service
[Service]
Type=oneshot