mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 15:49:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

buildtools-tarball: Make buildtools respects host CA certificates

Browse Source 
To adapt user network enviroment, buildtools should first try to use
the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these
envs is not set, then use the auto-detected ca file and ca path, and
finally use the CA certificates in buildtools.

nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work

nativesdk-curl don't set default ca file, need
SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work

nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO
also works

nativesdk-python3-requests will use cacert.pem under python module certifi by
default, need to set REQUESTS_CA_BUNDLE

(From OE-Core rev: 8a7ec52e9b35654bee48cd948c6c34c63db3e265)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Changqing Li
2025-04-15 18:56:07 +08:00
committed by Richard Purdie
parent f4d8e84fd9
commit 8dcd0f73eb
5 changed files with 88 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
meta/recipes-core/meta/buildtools-tarball.bb
View File

@@ -80,14 +80,35 @@ create_sdk_files:append () {
toolchain_create_sdk_version ${SDK_OUTPUT}/${SDKPATH}/version-${SDK_SYS}
cat >> $script <<EOF
# Detect host ca file/path, export for envfile to use
# /etc/ssl/certs/ca-certificates.crt Debian systems
# /etc/pki/tls/certs/ca-bundle.crt Fedora systems
# /etc/ssl/ca-bundle.pem Suse systems
export CAFILE
export CAPATH
for a in /etc/ssl/certs/ca-certificates.crt \
/etc/pki/tls/certs/ca-bundle.crt \
/etc/ssl/ca-bundle.pem ; do
if test -f "\$a"; then
CAFILE="\$a"
break
fi
done
a="/etc/ssl/certs"
if test -d "\$a" && ls "\$a"/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].0 >/dev/null 2>/dev/null; then
CAPATH="\$a"
fi
if [ -d "\$OECORE_NATIVE_SYSROOT/environment-setup.d" ]; then
for envfile in \$OECORE_NATIVE_SYSROOT/environment-setup.d/*.sh; do
. \$envfile
done
fi
# We have to unset this else it can confuse oe-selftest and other tools
# which may also use the overlapping namespace.
unset OECORE_NATIVE_SYSROOT
unset OECORE_NATIVE_SYSROOT CAFILE CAPATH
EOF
if [ "${SDKMACHINE}" = "i686" ]; then