head	1.3;
access;
symbols
	perseant-exfatfs-base-20261102:1.3
	netbsd-11-1-RELEASE:1.3
	netbsd-10-2-RELEASE:1.1.2.2
	netbsd-11-0-RELEASE:1.3
	netbsd-11-0-RC7:1.3
	netbsd-11-0-RC6:1.3
	netbsd-11-0-RC5:1.3
	netbsd-11-0-RC4:1.3
	netbsd-11-0-RC3:1.3
	netbsd-11-0-RC2:1.3
	netbsd-11-0-RC1:1.3
	perseant-exfatfs-base-20250801:1.3
	netbsd-11:1.3.0.4
	netbsd-11-base:1.3
	netbsd-10-1-RELEASE:1.1.2.2
	perseant-exfatfs-base-20240630:1.3
	perseant-exfatfs:1.3.0.2
	perseant-exfatfs-base:1.3
	netbsd-10-0-RELEASE:1.1.2.2
	netbsd-10-0-RC6:1.1.2.2
	netbsd-10-0-RC5:1.1.2.2
	netbsd-10-0-RC4:1.1.2.2
	netbsd-10-0-RC3:1.1.2.2
	netbsd-10-0-RC2:1.1.2.2
	netbsd-10-0-RC1:1.1.2.2
	netbsd-10:1.1.0.2;
locks; strict;
comment	@# @;


1.3
date	2023.12.25.07.46.12;	author kre;	state Exp;
branches;
next	1.2;
commitid	cNVAC8PwIWWQPORE;

1.2
date	2023.12.25.07.43.03;	author kre;	state Exp;
branches;
next	1.1;
commitid	4pYnvKjeTpfUNORE;

1.1
date	2023.09.27.00.24.13;	author riastradh;	state Exp;
branches
	1.1.2.1;
next	;
commitid	k45BHG3lHtqEflGE;

1.1.2.1
date	2023.09.27.00.24.13;	author martin;	state dead;
branches;
next	1.1.2.2;
commitid	1NCiH2r23TKUp3HE;

1.1.2.2
date	2023.10.02.13.26.04;	author martin;	state Exp;
branches;
next	;
commitid	1NCiH2r23TKUp3HE;


desc
@@


1.3
log
@
Whitespace:  8 spaces -> tab
@
text
@#!/bin/sh
#
# $NetBSD: certctl_init,v 1.2 2023/12/25 07:43:03 kre Exp $
#
# PROVIDE: certctl_init
# REQUIRE: mountcritremote
#
# This script ensures that we run `certctl rehash' on first boot of a
# live image to configure TLS trust anchors for OpenSSL in
# /etc/openssl/certs.  We do this only on first boot by testing whether
# /etc/openssl/certs is an empty directory.
#
# Requires mountcritremote for /usr/sbin/certctl.
#
# This is a stop-gap measure to ensure we get TLS trust anchors with
# live images, which we can't prepare at build time because the
# preparation requires running openssl(1) as a tool.  This stop-gap
# measure should perhaps be replaced by a more general-purpose way to
# run postinstall on first boot of the image, but that's a riskier
# proposition to implement on short notice for netbsd-10.

$_rc_subr_loaded . /etc/rc.subr

name="certctl_init"
rcvar=${name}
start_cmd="certctl_init"
stop_cmd=":"

certctl_init()
{
	local certsdir

	certsdir=/etc/openssl/certs

	# If /etc/openssl/certs is a symlink, or exists but is not a
	# directory, or is a directory but is nonempty, then we're not
	# in the first boot's initial configuration.  So do nothing.
	if [ -h "$certsdir" ] ||
	    { [ -e "$certsdir" ] && ! [ -d "$certsdir" ] ; } ||
	    ( [ -d "$certsdir" ] &&
		find -f "$certsdir" -- -maxdepth 0 -type d -empty -exit 1 )
	then
		return
	fi

	# Otherwise, if /etc/openssl/certs is nonexistent or is an
	# empty directory, run `certctl rehash'.
	echo "Configuring TLS trust anchors."
	certctl rehash
}

load_rc_config $name
run_rc_command "$1"
@


1.2
log
@
No longer use obsolete test(1) -a option/operator, use sh && instead.

While here a couple of minor formatting improvements - in general it
is always a good idea to surround sh operator chars (like '>' '(' ...)
with white space, to guard against thet possibility that some other (or
later enhanced) sh might have additional operators which happen to be
the character string used.

I don't understand while the final part of the condition for not doing
anything needs to run in a subshell, but that can stay for now.
@
text
@d3 1
a3 1
# $NetBSD: certctl_init,v 1.1 2023/09/27 00:24:13 riastradh Exp $
d42 1
a42 1
        then
@


1.1
log
@/etc/rc.d/cerctl_init: New script for certctl rehash in live images.

This is very limited -- it does not supplant postinstall to rehash
certificates on upgrade; it only runs certctl rehash if
/etc/openssl/certs is an empty directory, as you get in live images
not created with sysinst.

We could also have a more general-purpose way to run postinstall(8)
on first boot of an image, but that has a lot more moving parts to
think about, so let's start with this limited-scope low-risk
approach.

PR install/57629

XXX pullup-10
@
text
@d3 1
a3 1
# $NetBSD$
d39 3
a41 4
	    [ -e "$certsdir" -a ! -d "$certsdir" ] ||
	    ([ -d "$certsdir" ] &&
		find -f "$certsdir" -- \
		    -maxdepth 0 -type d -empty -exit 1)
@


1.1.2.1
log
@file certctl_init was added on branch netbsd-10 on 2023-10-02 13:26:04 +0000
@
text
@d1 54
@


1.1.2.2
log
@Pull up following revision(s) (requested by riastradh in ticket #381):

	distrib/utils/embedded/conf/evbarm.conf: revision 1.42
	distrib/sets/lists/etc/mi: revision 1.273
	etc/rc.d/Makefile: revision 1.118
	distrib/utils/embedded/conf/usermode.conf: revision 1.7
	etc/rc.d/certctl_init: revision 1.1
	distrib/evbarm/liveimage/armimage/rc.conf.armimage: revision 1.2
	etc/defaults/rc.conf: revision 1.166
	distrib/amd64/liveimage/emuimage/rc.conf.emuimage: revision 1.3
	distrib/utils/embedded/conf/x86.conf: revision 1.11
	distrib/utils/embedded/conf/evbmips.conf: revision 1.4

/etc/rc.d/cerctl_init: New script for certctl rehash in live images.

This is very limited -- it does not supplant postinstall to rehash
certificates on upgrade; it only runs certctl rehash if
/etc/openssl/certs is an empty directory, as you get in live images
not created with sysinst.

We could also have a more general-purpose way to run postinstall(8)
on first boot of an image, but that has a lot more moving parts to
think about, so let's start with this limited-scope low-risk
approach.

PR install/57629

/etc/rc.d/certctl_init: Default off.
Otherwise in systems without certctl_init=YES, such as systems
installed with sysinst(8) where it's unnecessary because the rehash
has already happened at install time, you'll get spurious warnings.
@
text
@a0 54
#!/bin/sh
#
# $NetBSD: certctl_init,v 1.1 2023/09/27 00:24:13 riastradh Exp $
#
# PROVIDE: certctl_init
# REQUIRE: mountcritremote
#
# This script ensures that we run `certctl rehash' on first boot of a
# live image to configure TLS trust anchors for OpenSSL in
# /etc/openssl/certs.  We do this only on first boot by testing whether
# /etc/openssl/certs is an empty directory.
#
# Requires mountcritremote for /usr/sbin/certctl.
#
# This is a stop-gap measure to ensure we get TLS trust anchors with
# live images, which we can't prepare at build time because the
# preparation requires running openssl(1) as a tool.  This stop-gap
# measure should perhaps be replaced by a more general-purpose way to
# run postinstall on first boot of the image, but that's a riskier
# proposition to implement on short notice for netbsd-10.

$_rc_subr_loaded . /etc/rc.subr

name="certctl_init"
rcvar=${name}
start_cmd="certctl_init"
stop_cmd=":"

certctl_init()
{
	local certsdir

	certsdir=/etc/openssl/certs

	# If /etc/openssl/certs is a symlink, or exists but is not a
	# directory, or is a directory but is nonempty, then we're not
	# in the first boot's initial configuration.  So do nothing.
	if [ -h "$certsdir" ] ||
	    [ -e "$certsdir" -a ! -d "$certsdir" ] ||
	    ([ -d "$certsdir" ] &&
		find -f "$certsdir" -- \
		    -maxdepth 0 -type d -empty -exit 1)
        then
		return
	fi

	# Otherwise, if /etc/openssl/certs is nonexistent or is an
	# empty directory, run `certctl rehash'.
	echo "Configuring TLS trust anchors."
	certctl rehash
}

load_rc_config $name
run_rc_command "$1"
@