aurora/system_files/shared/usr/lib/systemd/system/bootc-update-ca-trust.service
inffy 481bdfe702
fix: Regenerate CA trust and crypto policies for eMudhra incident (#3098)
This handles an issue where the three way /etc merge can leave a user unpatched despite having the new package.

Adapted from https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
(cherry picked from commit bfa213b13bc967d4652a908ec457e3f1aed34d6d
 https://github.com/ublue-os/main/pull/3029)

Co-authored-by: Kyle Gospodnetich <me@kylegospodneti.ch>
2026-10-26 14:10:26 +00:00

18 lines
509 B
Desktop File

# Regenerate files preserved by the /etc three-way merge after image upgrades.
[Unit]
Description=Regenerate CA certificate trust store
Documentation=https://gitlab.com/fedora/bootc/base-images/-/merge_requests/663
ConditionPathIsMountPoint=/sysroot
ConditionPathExists=/usr/bin/update-ca-trust
DefaultDependencies=no
Requires=local-fs.target
After=local-fs.target
Before=sysinit.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/update-ca-trust extract
[Install]
WantedBy=sysinit.target