ca-certificates update needs openssl : circular dependency

[stelian]

I have updated ca-certificates tcz on my picore.

openssl.tcz lists ca-certifiates in its .dep file.

ca-certificates includes an /usr/local/tce.installed script, which in turn will call /usr/local/sbin/update-ca-certificates

But update-ca-certificates needs openssl.

This causes errors on boot.

[bmarkus]

Which version, which architecture?

[stelian]

13.1.0, armv6

[Rich]

Hi bmarkus
I wonder if it makes sense to rearrange the  tce.installed  files for those 2 extensions.

Code: [Select]

update-ca-certificates
ln -s /usr/local/etc/ssl/certs/ca-certificates.crt /usr/local/etc/ssl/cacert.pem
ln -s /usr/local/etc/ssl/certs/ca-certificates.crt /usr/local/etc/ssl/ca-bundle.crt
I think moving these 3 lines from the end of  tce.installed/ca-certificates  to the end of  tce.installed/openssl-1.1.1
would solve the issue:

[Paul_123]

Pretty sure I took the script in ca-certIificates from core x86_64.

But I don’t see how there is an error during boot, since tce-bootload mounts all extensions in onboot.lst before calling any of the startup scripts. 

The base image has only openssh.tcz in the onboot.lst.  Which will load OpenSSL and ca-certs properly.  The only way to trigger the error would be to have only ca-certificates.tcz listed in onboot

[Rich]

Hi Paul_123

... openssl.tcz lists ca-certifiates in its .dep file. ...

In x86 and x86_64  ca-certificates  lists  openssl  in its  .dep  file. I think that way makes more sense. The
tce.installed/ca-certificates  script calls  update-ca-certificates  which calls  c_rehash.sh  which calls  openssl , so
ca-certificates  depends on  openssl , which should be loaded first.

When booting, tce-load (like tce-bootload) runs the  tce.installed  scripts after all extensions are loaded, so order
should not be an issue there. When using tce-load from the commandline , tce.installed  scripts get run as each
extension gets loaded and dependency scripts run first. So in that case, you want  ca-certificates  to depend on
openssl , and not the other way around.

[stelian]

Pretty sure I took the script in ca-certIificates from core x86_64.

But I don’t see how there is an error during boot, since tce-bootload mounts all extensions in onboot.lst before calling any of the startup scripts. 

The base image has only openssh.tcz in the onboot.lst.  Which will load OpenSSL and ca-certs properly.  The only way to trigger the error would be to have only ca-certificates.tcz listed in onboot

The error came up because I did indeed remove openssh from the onboot.lst, in order to load it later.

Later on the bootprocess (in bootlocat.sh) I load python3, which needs openssl, which needs ca-certificates, which needs openssl...