Hi Cyril, all, On Thu, Oct 22, 2026 at 05:10:59PM +0200, Cyril Brulebois wrote: > Cyril Brulebois <[email protected]> (2026-10-22): > > Where and how to go from here isn't entirely clear to me at this point. > > > > Wild guess, if we still need that manual copy/deployment in this > > specific location, we could still have some kind of cleanup some > > finish-install script, that would get rid of all files that are > > (currently) shipped by ca-certificates, so that we only keep any “really > > local” certificates in there on the long run?
Pascal's testing seems to confirm that the copying is not required for the regular case - https mirror or https preseed URL covered by the CAs in ca-certificates. For custom CAs, did we ever document how to include them in d-i in a way that we should try to support going forward? A cursory search didn't bring up any documentation. If not, I'd tend to just remove the copying from base-installer and leave it to the preseeder to include e.g. a suitable late_command to copy over the certs into /target. (That's what I've been doing in my preseeding setups) > Of course, this is merely about trying to prevent this issue from > happening in future d-i releases… > > As for remediating the issue on already-deployed systems, should there > be something (in ca-certificates?) that would get rid of certificates > that are known to be problematic? Something like using the blocklist > for /usr/local/ as well? It's been a long while since I last looked at > implementation details, so I'm not sure whether that'd be easily doable > (or doable at all), even if there was a consensus. This has been in the back of my head all week. I think ca-certificates can and should purge these cert copies. I've opened a draft MR on salsa https://salsa.debian.org/debian/ca-certificates/-/merge_requests/18 and asked Julien (CCed) for thoughts. Still details to be hashed out. > (All of this reminds me that there wasn't much feedback on #1142266, > which is another story yet somewhat related.) Ouch, that's also quite bad. :( Best regards, Max
