[gnome-continuous-yocto/gnomeostree-3.28-rocko: 3218/8267] openssl: rehash actual mozilla certificates inside rootfs

[Emmanuele Bassi <ebassi src gnome org>]

commit ef1fa14260b98fde89ad82a211461c7ccfe63d2d
Author: Dmitry Rozhkov <dmitry rozhkov linux intel com>
Date:   Fri Oct 28 10:22:35 2016 +0300

    openssl: rehash actual mozilla certificates inside rootfs
    
    The c_rehash utility is supposed to be run in the folder /etc/ssl/certs
    of a rootfs where the package ca-certificates puts symlinks to
    various CA certificates stored in /usr/share/ca-certificates/mozilla/.
    These symlinks are absolute. This means that when c_rehash is run
    at rootfs creation time it can't hash the actual files since they
    actually reside in the build host's directory
    $SYSROOT/usr/share/ca-certificates/mozilla/.
    
    This problem doesn't reproduce when building on Debian or Ubuntu
    hosts though, because these OSs have the certificates installed
    in the same /usr/share/ca-certificates/mozilla/ folder.
    Images built in other distros, e.g. Fedora, have problems with
    connecting to https servers when using e.g. python's http lib.
    
    The patch fixes c_rehash to check if it runs on a build host
    by testing $SYSROOT and to translate the paths to certificates
    accordingly.
    
    (From OE-Core rev: 5199b990edf4d9784c19137d0ce9ef141cd85e46)
    
    Signed-off-by: Dmitry Rozhkov <dmitry rozhkov linux intel com>
    Signed-off-by: Ross Burton <ross burton intel com>
    Signed-off-by: Richard Purdie <richard purdie linuxfoundation org>

 .../openssl/openssl/openssl-c_rehash.sh            |   20 ++++++++++++++++----
 1 files changed, 16 insertions(+), 4 deletions(-)
---
diff --git a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh 
b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
index f67f415..25ea729 100644
--- a/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
+++ b/meta/recipes-connectivity/openssl/openssl/openssl-c_rehash.sh
@@ -114,11 +114,11 @@ link_hash()
        LINKFILE=${HASH}.${TAG}${SUFFIX}
     done
 
-    echo "${1} => ${LINKFILE}"
+    echo "${3} => ${LINKFILE}"
 
     # assume any system with a POSIX shell will either support symlinks or
     # do something to handle this gracefully
-    ln -s ${1} ${LINKFILE}
+    ln -s ${3} ${LINKFILE}
 
     return 0
 }
@@ -142,7 +142,19 @@ hash_dir()
 
     ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE
     do
-       check_file ${FILE}
+       REAL_FILE=${FILE}
+       # if we run on build host then get to the real files in rootfs
+       if [ -n "${SYSROOT}" -a -h ${FILE} ]
+       then
+           FILE=$( readlink ${FILE} )
+           # check the symlink is absolute (or dangling in other word)
+           if [ "x/" == "x$( echo ${FILE} | cut -c1 -)" ]
+           then
+               REAL_FILE=${SYSROOT}/${FILE}
+           fi
+       fi
+
+       check_file ${REAL_FILE}
         local FILE_TYPE=${?}
        local TYPE_STR=''
 
@@ -157,7 +169,7 @@ hash_dir()
            continue
         fi
 
-       link_hash ${FILE} ${TYPE_STR}
+       link_hash ${REAL_FILE} ${TYPE_STR} ${FILE}
     done
 }