On 29/10/2026 at 23:26, Max Vozeler wrote:
On Thu, Oct 29, 2026 at 08:32:31PM +0000, Steve McIntyre wrote:
On Thu, Oct 29, 2026 at 09:24:11PM +0100, Pascal Hambourg wrote:
Do you see any case where it might be complicated, inconvenient or impossible
to preseed the copying of custom CA certificates ?
Yes. I tested without the copying code in bootstrap-base.postinst:
(a) an https mirror with a certificate signed by a CA included in
ca-certificates. Install completed fine.
(b) an https mirror that needs a custom CA. This worked for
install_base_system but failed in apt_update. It turns copying *is*
required in this case and doing it in late_command is too late.
Yes, preseed/late_command is triggered way too late to copy custom
certificates. It would require to trigger a command right after the
bootstrap base installation, before using apt-install to download the
kernel package and additional packages from the mirror.
If yes, an option would be for bootstrap-base.postinst to not copy
certificates which are provided by ca-certificates-udeb. I guess it would
require to ship a list of these certificates or their hashes, either provided
by ca-certificates-udeb or generated when building the d-i image.
Couldn't we just copy those then clear them out as part of the
post-installation step? Wouldn't that be an easy fix?
How would we identify the certs to be cleared out though? This seems
non-trivial and potentially error prone - or am I just not seeing the
easy solution?
Maybe by comparing them with certificates installed by ca-certificates ?
I agree, this is non-trivial and error-prone. For example if the mirror
has a ca-certificates version newer than the ca-certificates-udeb used
in the installation image and a compromised certificate was removed from
the newer version, then this certificate would not be removed from the
target system, unless ca-certificates has a purging mechanism such as
proposed in your merge request 18.
What if we instead mirror what ca-certificates does and require any
custom CA certificates to be in /usr/local/share/ca-certificates in the
installer and then copy that into /target?
Getting the custom certificate into the installer already requires
creating the hash symlink in /etc/ssl/certs manually for lack of openssl
rehash / c_rehash:
d-i preseed/early_command string \
somehow_create /etc/ssl/certs/XXX.crt; \
ln -s /etc/ssl/certs/XXX.crt /etc/ssl/certs/HHHHHHHH.0;
Or building the hash symlink into the image itself along with the
certificate. That would be no more difficult if we required the certs to
be in /usr/local/share/ca-certificates:
d-i preseed/early_command string \
somehow_create /usr/local/share/ca-certificates/XXX.crt; \
ln -s /usr/local/share/ca-certificates/XXX.crt /etc/ssl/certs/HHHHHHHH.0;
Thoughts?
It looks like a good idea to me. Separating default and custom
certificates would be cleaner and AFAICS without any added complexity
into d-i nor for users.
Also, the copying could be made unconditional regardless of whether a
https mirror was selected or preseeded: if custom certificates are
present, it must be for a reason. It could be something like this:
<https://salsa.debian.org/pham/base-installer/-/commit/6854a72b0e77>
