On Thu, Oct 29, 2026 at 09:24:11PM +0100, Pascal Hambourg wrote: >[bug mail address fixed] > >On 29/10/2026 at 16:57, Cyril Brulebois wrote: >> Max Vozeler <[email protected]> (2026-10-28): >> > >> > For custom CAs, (...) I'd tend to just remove the >> > copying from base-installer and leave it to the preseeder to include >> > e.g. a suitable late_command to copy over the certs into /target. >> > >> > (That's what I've been doing in my preseeding setups) >> >> I haven't followed the initial development, or documentation efforts, >> but if dropping the whole copy altogether and letting users deal with >> whatever's needed in /target… is something you're comfortable with, >> while also wearing a preseed user hat, then that looks like a nice plan. > >Do you see any case where it might be complicated, inconvenient or impossible >to preseed the copying of custom CA certificates ? > >If yes, an option would be for bootstrap-base.postinst to not copy >certificates which are provided by ca-certificates-udeb. I guess it would >require to ship a list of these certificates or their hashes, either provided >by ca-certificates-udeb or generated when building the d-i image.
Couldn't we just copy those then clear them out as part of the post-installation step? Wouldn't that be an easy fix? -- Steve McIntyre, Cambridge, UK. [email protected] Into the distance, a ribbon of black Stretched to the point of no turning back
