Dixi quod…
>ca-certificates setup. In fact, I’d prefer to control the files
>placed into the chroot, copying just the /usr/share/ca-bundle/certs/
>files and symlinks (which are already c_rehash’d) to get rid of
>the ssl-cert-snakeoil.pem presence (which Debian seems to insist
>on for some reason) from that directory as well.
For the archives (and for others suffering from similar issues),
I came up with the following, and it works:
### {{{ BEGIN
root@evolvis:~ # cat /usr/lib/postfix/configure-instance.hack.sh
#!/bin/mksh
# save as /usr/lib/postfix/configure-instance.hack.sh
# chown 0:0 /usr/lib/postfix/configure-instance.hack.sh && chmod 555
/usr/lib/postfix/configure-instance.hack.sh && dpkg-divert --local --rename
--divert /usr/lib/postfix/configure-instance.orig.sh --add
/usr/lib/postfix/configure-instance.sh && ln -s configure-instance.hack.sh
/usr/lib/postfix/configure-instance.sh
set -e
. /usr/lib/postfix/configure-instance.orig.sh
if [[ -n $NEED_CHROOT && -n $SYNC_CHROOT ]]; then
#print -ru2
#print -ru2 -- "queue_dir=${queue_dir@Q}"
#print -ru2 -- "sca_path=${sca_path@Q}"
#print -ru2 -- "dca_path=${dca_path@Q}"
#print -ru2 -- "dest_dir=${dest_dir@Q}"
sca_rp=$(realpath "$sca_path")
dca_rp=$(realpath "$dca_path")
src_rp=$(realpath /etc/ssl/certs)
if [[ $sca_rp = "$src_rp" || $dca_rp = "$src_rp" ]]; then
rm -rf "$queue_dir/etc/ssl/certs"
mkdir -p "$queue_dir/etc/ssl/certs"
cp -a /usr/share/ca-bundle/certs/* "$queue_dir/etc/ssl/certs/"
fi
fi
### }}} END
Where /usr/share/ca-bundle/certs/ is referenced in the third-to-last
line of this script, insert your favourite location, of course. This
construct uses GNU coreutils’ cp(1) -a flag to copy symlinks as-is,
as /usr/share/ca-bundle/certs/ contains c_rehash-style symbolic links
already; if your source does not, adjust appropriately.
I first thought I’d have to actually patch that script but it turns
out I can just “hook afterwards”.
bye,
//mirabilos
--
„Cool, /usr/share/doc/mksh/examples/uhr.gz ist ja ein Grund,
mksh auf jedem System zu installieren.“
-- XTaran auf der OpenRheinRuhr, ganz begeistert
(EN: “[…]uhr.gz is a reason to install mksh on every system.”)
