fix(24.04): reorganise ca-certificates slice(s)

[zhijie-yang]

Proposed changes

The script update-ca-certificates and its corresponding config file /etc/ca-certificates.conf is added to the SDF of ca-certificates.

Related issues/PRs

ROCKS-994

Forward porting

Not applicable.

Checklist

• I have read the contributing guidelines
• I have already submitted the CLA form

[github-actions]

Diff of dependencies:

slices/ca-certificates.yaml

@@ -1,3 +1,2 @@
-debconf
-debconf-2.0
 openssl
+sed

---

[cjdcordeiro]

Nice. LGTM. if @rebornplusplus and @javierdelapuente approve, I'll merge it

[javierdelapuente]

Not sure if related to this PR, or the way I am doing it is different from the way it is really done while building a rock. I am trying to use ca-certificates_data-with-certs from this PR using this rockcraft.yaml file: https://pastebin.ubuntu.com/p/gDYN6njnc9/

I get the following error (I think the other cert.pem file comes as a dependency of python3-venv):

2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.633 Failed to stage: parts list the same file with different contents or permissions.
2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.633 Detailed information: Parts 'django-framework/runtime' and 'django-framework/dependencies' list the following files, but with different contents or permissions:
...
2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.639 Parts 'django-framework/runtime' and 'django-framework/dependencies' list the following files, but with different contents or permissions:
2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.639     usr/lib/ssl/cert.pem
...

Checking inside lxc I see:

rockcraft-netbox-on-amd64-for-amd64-15 ../parts/django-framework# find . -name "cert.pem" -ls
  2147356      0 lrwxrwxrwx   1 root     root           34 Jul  8 15:42 ./runtime/install/usr/lib/ssl/cert.pem -> /etc/ssl/certs/ca-certificates.crt
  2103683      0 lrwxrwxrwx   1 root     root           42 Jul  8 15:35 ./dependencies/install/usr/lib/ssl/cert.pem -> ../../../etc/ssl/certs/ca-certificates.crt

Will this also happen when rockcraft gets the chiselled ca-certificates_data-with-certs?

[rebornplusplus]

Sorry to go back and forth on this. It looks quite nice. Just have one concern about the ca-certificates.conf I mentioned below.

In general, I see two options about the whole ca-certificates offering:

1. The data slice provides the bundle, individual default certs and the config file. Pro: this is a standard offering and doesn't break anything. Con: the slice doubles in size and then some, for the config file. Another slice (name TBD) provides only the bundle and nothing else.
2. As it is now, the data slice provides only the bundle and another slice provides the bundle, config and the individual default certs.

Re-considering it, I feel much more inclined to having option 1 since most of the users would not mind the small extra weight in data slice as long it doesn't break and provide a smooth experience. Let me know what you think!

[rebornplusplus]

Not sure if related to this PR, or the way I am doing it is different from the way it is really done while building a rock. I am trying to use ca-certificates_data-with-certs from this PR using this rockcraft.yaml file: https://pastebin.ubuntu.com/p/gDYN6njnc9/

I get the following error (I think the other cert.pem file comes as a dependency of python3-venv):

2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.633 Failed to stage: parts list the same file with different contents or permissions.
2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.633 Detailed information: Parts 'django-framework/runtime' and 'django-framework/dependencies' list the following files, but with different contents or permissions:
...
2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.639 Parts 'django-framework/runtime' and 'django-framework/dependencies' list the following files, but with different contents or permissions:
2024-07-08 15:43:07.175 :: 2024-07-08 15:43:06.639     usr/lib/ssl/cert.pem
...

Checking inside lxc I see:

rockcraft-netbox-on-amd64-for-amd64-15 ../parts/django-framework# find . -name "cert.pem" -ls
  2147356      0 lrwxrwxrwx   1 root     root           34 Jul  8 15:42 ./runtime/install/usr/lib/ssl/cert.pem -> /etc/ssl/certs/ca-certificates.crt
  2103683      0 lrwxrwxrwx   1 root     root           42 Jul  8 15:35 ./dependencies/install/usr/lib/ssl/cert.pem -> ../../../etc/ssl/certs/ca-certificates.crt

Will this also happen when rockcraft gets the chiselled ca-certificates_data-with-certs?

Hi @javierdelapuente, I think the other cert.pem file is coming from openssl being a dependency of python3-venv. If that's the case, the error above should not happen since the package path has an absolute path as the symlink target. Which makes me think there are two possible scenarios -- a) the file is not coming from openssl or b) somehow the symlink target is changed to a relative path, either by some other package or rockcraft (? doubt that).

In any case, no I don't think merging the slices would fix this issue. I reckon there's a need to dive deep and see where the symlink is coming from and/or where it's being modified.

[linostar]

Reviewed and tested it with James. LGTM.

[rebornplusplus]

Looks nice to me. Only left a few suggestions about the comments.

[rebornplusplus]

All good from me! Can be merged after another maintainer's approval.