From 481bdfe702ead0dac2f8516f67deb2041981fb48 Mon Sep 17 00:00:00 2001
From: inffy <10782843+inffy@users.noreply.github.com>
Date: Mon, 26 Oct 2026 14:10:26 +0000
Subject: [PATCH] fix: Regenerate CA trust and crypto policies for eMudhra
 incident (#3098)

This handles an issue where the three way /etc merge can leave a user unpatched despite having the new package.

Adapted from https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
(cherry picked from commit bfa213b13bc967d4652a908ec457e3f1aed34d6d
 https://github.com/ublue-os/main/pull/3029)

Co-authored-by: Kyle Gospodnetich <me@kylegospodneti.ch>
---
 .../lib/systemd/system-preset/89-aurora.preset |  2 ++
 .../system/bootc-update-ca-trust.service       | 18 ++++++++++++++++++
 .../bootc-update-crypto-policies.service       | 18 ++++++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
 create mode 100644 system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service

diff --git a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
index 330fc962..9abc2cc7 100644
--- a/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
+++ b/system_files/shared/usr/lib/systemd/system-preset/89-aurora.preset
@@ -1,4 +1,6 @@
 enable aurora-groups.service
+enable bootc-update-ca-trust.service
+enable bootc-update-crypto-policies.service
 enable brew-setup.service
 enable dconf-update.service
 enable flatpak-preinstall.service
diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
new file mode 100644
index 00000000..4b4eb641
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
@@ -0,0 +1,18 @@
+# Regenerate files preserved by the /etc three-way merge after image upgrades.
+[Unit]
+Description=Regenerate CA certificate trust store
+Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
+ConditionPathIsMountPoint=/sysroot
+ConditionPathExists=/usr/bin/update-ca-trust
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/bin/update-ca-trust extract
+
+[Install]
+WantedBy=sysinit.target
diff --git a/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service
new file mode 100644
index 00000000..f77a4a3b
--- /dev/null
+++ b/system_files/shared/usr/lib/systemd/system/bootc-update-crypto-policies.service
@@ -0,0 +1,18 @@
+# Regenerate backend files preserved by the /etc three-way merge after image upgrades.
+[Unit]
+Description=Regenerate crypto-policies backend configuration
+Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
+ConditionPathIsMountPoint=/sysroot
+ConditionPathExists=/usr/bin/update-crypto-policies
+DefaultDependencies=no
+Requires=local-fs.target
+After=local-fs.target
+Before=sysinit.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/bash -ec 'policy=$(/usr/bin/update-crypto-policies --show); exec /usr/bin/update-crypto-policies --set "$$policy"'
+
+[Install]
+WantedBy=sysinit.target