Home | History | Annotate | Line # | Download | only in rc.d
certctl_init revision 1.1.2.2 
      1  1.1.2.2  martin #!/bin/sh
      2  1.1.2.2  martin #
      3  1.1.2.2  martin # $NetBSD: certctl_init,v 1.1.2.2 2023/10/02 13:26:04 martin Exp $
      4  1.1.2.2  martin #
      5  1.1.2.2  martin # PROVIDE: certctl_init
      6  1.1.2.2  martin # REQUIRE: mountcritremote
      7  1.1.2.2  martin #
      8  1.1.2.2  martin # This script ensures that we run `certctl rehash' on first boot of a
      9  1.1.2.2  martin # live image to configure TLS trust anchors for OpenSSL in
     10  1.1.2.2  martin # /etc/openssl/certs.  We do this only on first boot by testing whether
     11  1.1.2.2  martin # /etc/openssl/certs is an empty directory.
     12  1.1.2.2  martin #
     13  1.1.2.2  martin # Requires mountcritremote for /usr/sbin/certctl.
     14  1.1.2.2  martin #
     15  1.1.2.2  martin # This is a stop-gap measure to ensure we get TLS trust anchors with
     16  1.1.2.2  martin # live images, which we can't prepare at build time because the
     17  1.1.2.2  martin # preparation requires running openssl(1) as a tool.  This stop-gap
     18  1.1.2.2  martin # measure should perhaps be replaced by a more general-purpose way to
     19  1.1.2.2  martin # run postinstall on first boot of the image, but that's a riskier
     20  1.1.2.2  martin # proposition to implement on short notice for netbsd-10.
     21  1.1.2.2  martin 
     22  1.1.2.2  martin $_rc_subr_loaded . /etc/rc.subr
     23  1.1.2.2  martin 
     24  1.1.2.2  martin name="certctl_init"
     25  1.1.2.2  martin rcvar=${name}
     26  1.1.2.2  martin start_cmd="certctl_init"
     27  1.1.2.2  martin stop_cmd=":"
     28  1.1.2.2  martin 
     29  1.1.2.2  martin certctl_init()
     30  1.1.2.2  martin {
     31  1.1.2.2  martin 	local certsdir
     32  1.1.2.2  martin 
     33  1.1.2.2  martin 	certsdir=/etc/openssl/certs
     34  1.1.2.2  martin 
     35  1.1.2.2  martin 	# If /etc/openssl/certs is a symlink, or exists but is not a
     36  1.1.2.2  martin 	# directory, or is a directory but is nonempty, then we're not
     37  1.1.2.2  martin 	# in the first boot's initial configuration.  So do nothing.
     38  1.1.2.2  martin 	if [ -h "$certsdir" ] ||
     39  1.1.2.2  martin 	    [ -e "$certsdir" -a ! -d "$certsdir" ] ||
     40  1.1.2.2  martin 	    ([ -d "$certsdir" ] &&
     41  1.1.2.2  martin 		find -f "$certsdir" -- \
     42  1.1.2.2  martin 		    -maxdepth 0 -type d -empty -exit 1)
     43  1.1.2.2  martin         then
     44  1.1.2.2  martin 		return
     45  1.1.2.2  martin 	fi
     46  1.1.2.2  martin 
     47  1.1.2.2  martin 	# Otherwise, if /etc/openssl/certs is nonexistent or is an
     48  1.1.2.2  martin 	# empty directory, run `certctl rehash'.
     49  1.1.2.2  martin 	echo "Configuring TLS trust anchors."
     50  1.1.2.2  martin 	certctl rehash
     51  1.1.2.2  martin }
     52  1.1.2.2  martin 
     53  1.1.2.2  martin load_rc_config $name
     54  1.1.2.2  martin run_rc_command "$1"
     55