quine-global-labs/aurora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Regenerate CA trust and crypto policies for eMudhra incident (#3098)

Browse source 
This handles an issue where the three way /etc merge can leave a user unpatched despite having the new package.

Adapted from https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
(cherry picked from commit bfa213b13bc967d4652a908ec457e3f1aed34d6d
 https://github.com/ublue-os/main/pull/3029)

Co-authored-by: Kyle Gospodnetich <me@kylegospodneti.ch>
This commit is contained in:
inffy 2026-10-26 14:10:26 +00:00 committed by GitHub
parent a0855c4ccc
commit 481bdfe702
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 38 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
View file

@ -1,4 +1,6 @@
enable aurora-groups.service
enable bootc-update-ca-trust.service
enable bootc-update-crypto-policies.service
enable brew-setup.service
enable dconf-update.service
enable flatpak-preinstall.service

18
system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service Normal file
View file

@ -0,0 +1,18 @@
# Regenerate files preserved by the /etc three-way merge after image upgrades.
[Unit]
Description=Regenerate CA certificate trust store
Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
ConditionPathIsMountPoint=/sysroot
ConditionPathExists=/usr/bin/update-ca-trust
DefaultDependencies=no
Requires=local-fs.target
After=local-fs.target
Before=sysinit.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/update-ca-trust extract
[Install]
WantedBy=sysinit.target

18
system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service Normal file
View file

@ -0,0 +1,18 @@
# Regenerate backend files preserved by the /etc three-way merge after image upgrades.
[Unit]
Description=Regenerate crypto-policies backend configuration
Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
ConditionPathIsMountPoint=/sysroot
ConditionPathExists=/usr/bin/update-crypto-policies
DefaultDependencies=no
Requires=local-fs.target
After=local-fs.target
Before=sysinit.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -ec 'policy=$(/usr/bin/update-crypto-policies --show); exec /usr/bin/update-crypto-policies --set "$$policy"'
[Install]
WantedBy=sysinit.target