konevsa/pve-manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not use a hardcoded Certificate Authority for https repositories

Browse Source 
Instead we will the use the CA certificate provided by the
ca-certificates packages, which is now a mandatory depency of
pve-manager since 8204daafaf4063dabd8a23c36dfb16719650d2fc and
pve-manager 4.2-17. This change allows us in the future to
use different CA for our https repositories.

This changed has been tested OK with the following combination:
 * https repository using a StartCom certificate: works
 * https repository using a Let's encrypt certificate: works

User visible changes:
 * none : the new configuration file 75pveconf silently
 overwrites the olderone, except if local changes were made
 in which case you're presented with the traditional debian menu
 (keep local/ use packager version/ diff / open a shell)
This commit is contained in:
Emmanuel Kasper 2016-07-13 12:17:03 +02:00 committed by Fabian Grünbichler
parent c68c743659
commit ce532dac59
3 changed files with 1 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Makefile
View File

@ -17,13 +17,6 @@ check:
%:
set -e && for i in ${SUBDIRS}; do ${MAKE} -C $$i $@; done
pve-repo-ca-certificates.crt:
rm -rf ca-tmp
mkdir ca-tmp
cd ca-tmp; wget http://aia.startssl.com/certs/sub.class1.server.ca.pem
cd ca-tmp; wget http://aia.startssl.com/certs/ca.pem
cd ca-tmp; cat *.pem >../$@
.PHONY: dinstall
dinstall: ${DEB}
dpkg -i ${DEB}
@ -66,7 +59,7 @@ upload: ${DEB} check
# rsync po/*.po po/pve-manager.pot pve.proxmox.com:/home/ftp/sources/po-files/
.PHONY: install
install: country.dat vznet.conf vzdump.conf vzdump-hook-script.pl pve-apt.conf pve-repo-ca-certificates.crt mtu bridgevlan bridgevlanport vlan vlan-down
install: country.dat vznet.conf vzdump.conf vzdump-hook-script.pl pve-apt.conf mtu bridgevlan bridgevlanport vlan vlan-down
install -d -m 0700 -o www-data -g www-data ${DESTDIR}/var/log/pveproxy
install -D -m 0644 debian/pve.logrotate ${DESTDIR}/etc/logrotate.d/pve
install -d ${DESTDIR}/usr/share/${PACKAGE}
@ -80,7 +73,6 @@ install: country.dat vznet.conf vzdump.conf vzdump-hook-script.pl pve-apt.conf p
install -D -m 0644 pve-apt.conf ${DESTDIR}/etc/apt/apt.conf.d/75pveconf
install -D -m 0644 pve-sources.list ${DESTDIR}/etc/apt/sources.list.d/pve-enterprise.list
install -D -m 0644 pve-blacklist.conf ${DESTDIR}/etc/modprobe.d/pve-blacklist.conf
install -D -m 0644 pve-repo-ca-certificates.crt ${DESTDIR}/etc/apt/pve-repo-ca-certificates.crt
install -D -m 0644 vzdump.conf ${DESTDIR}/etc/vzdump.conf
install -D -m 0755 vznet.conf ${DESTDIR}/etc/vz/vznet.conf
install -D -m 0755 mtu ${DESTDIR}/etc/network/if-up.d/mtu

1
debian/conffiles vendored
View File

@ -7,7 +7,6 @@
/etc/vzdump.conf
/etc/logrotate.d/pve
/etc/apt/apt.conf.d/75pveconf
/etc/apt/pve-repo-ca-certificates.crt
/etc/apt/sources.list.d/pve-enterprise.list
/etc/network/if-up.d/mtu
/etc/network/if-pre-up.d/vlan

3
pve-apt.conf
View File

@ -5,6 +5,3 @@ APT
"^pve-kernel-.*";
};
}
Acquire::https::enterprise.proxmox.com::CaInfo "/etc/apt/pve-repo-ca-certificates.crt";
Acquire::https::enterprise.proxmox.com::Verify-Peer "true";