Joseph Marrero Corchado
17e44957df
The stale trust store after an update is a property of the ostree /etc merge, not of the standard content set. minimal already ships ca-certificates (a hard dependency of openssl-libs), update-ca-trust and systemd-update-done.service, so it has the same problem and everything the unit needs. Moving the unit to minimal makes minimal-plus, standard, ELN and IoT inherit it, and gives the image-based variants built on minimal-plus (CoreOS, Atomic Desktops) a path to a shared fix. The unit is unchanged. Its conditions already skip containers, images without update-ca-trust, boots where /etc is current, and images that carry coreos-update-ca-trust.service. The rootfs check now runs in every tier instead of only in standard. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Vcy8XfBfUtxbEWMu62CiF6 |
||
|---|---|---|
| .. | ||
| rootfs | ||
| ca-trust.sh | ||
| Containerfile.test-ca-trust | ||
| Containerfile.test-derive | ||
| Containerfile.test-sysusers | ||
| README.md | ||
Image tests
just test builds the selected tier and runs the read-only checks in rootfs/.
For standard images, it also runs the CA trust, image derivation, and sysusers
tests in disposable container builds.
The CA trust rootfs check verifies that the refresh service is enabled in every
tier. Containerfile.test-ca-trust generates temporary test CAs and
exercises the installed service's command against stale trust bundles. It checks
vendor CA additions and removals, preservation of local anchors and distrust,
repeated refreshes, and removal of local policy in both the PEM and OpenSSL
bundles. No external CA or network endpoint is used by that test.
This models the trust-store state after an upgrade; it does not run an OSTree merge, boot a systemd manager, or exercise deployment/rollback. Actual boot ordering, service conditions, failure behavior, and initramfs consumers require VM integration coverage, for which this repository currently has no local test runner. The service is a host-bundle mitigation and is not a complete solution for consumers that read trust earlier in boot or from the initramfs.