[bug mail address fixed]
On 29/10/2026 at 16:57, Cyril Brulebois wrote:
Max Vozeler <[email protected]> (2026-10-28):
For custom CAs, (...) I'd tend to just remove the
copying from base-installer and leave it to the preseeder to include
e.g. a suitable late_command to copy over the certs into /target.
(That's what I've been doing in my preseeding setups)
I haven't followed the initial development, or documentation efforts,
but if dropping the whole copy altogether and letting users deal with
whatever's needed in /target… is something you're comfortable with,
while also wearing a preseed user hat, then that looks like a nice plan.
Do you see any case where it might be complicated, inconvenient or
impossible to preseed the copying of custom CA certificates ?
If yes, an option would be for bootstrap-base.postinst to not copy
certificates which are provided by ca-certificates-udeb. I guess it
would require to ship a list of these certificates or their hashes,
either provided by ca-certificates-udeb or generated when building the
d-i image.
Otherwise, let's just remove the copying.
