From 7d350720fe5d25fece68c5d1625a33a6cad431ef Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Thu, 28 May 2015 14:59:31 -0400 Subject: [PATCH] Replace pip-installed requests CA bundle with link If the version of python-requests required is higher than that provided by the operating system, pip will install it from upstream. The upstream version provides its own CA certificate bundle based on the Mozilla bundle, and defaults to that in case a CA certificate file is not specified for a request. The distribution-specific packages point to the system-wide CA bundle that can be managed by tools such as update-ca-trust (Fedora/RHEL) and update-ca-certificates (Debian/Ubuntu). When installing in SSL/TLS mode, either with SSL=True or by adding tls-proxy to ENABLED_SERVICES, if a non-systemwide CA bundle is used, then the CA generated by devstack will not be used causing the installation to fail. Replace the upstream-provided bundle with a link to the system bundle when possible. Change-Id: I349662ff8f851b4a7f879f89b8975a068f2d73dc Closes-Bug: #1459789 --- tools/fixup_stuff.sh | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/tools/fixup_stuff.sh b/tools/fixup_stuff.sh index 31258d13f7..d3a3de2092 100755 --- a/tools/fixup_stuff.sh +++ b/tools/fixup_stuff.sh @@ -138,3 +138,24 @@ fi # and installing the latest version using pip. uninstall_package python-virtualenv pip_install -U virtualenv + +# If a non-system python-requests is installed then it will use the +# built-in CA certificate store rather than the distro-specific +# CA certificate store. Detect this and symlink to the correct +# one. If the value for the CA is not rooted in /etc then we know +# we need to change it. +capath=$(python -c "from requests import certs; print certs.where()") + +if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then + if [[ ! $capath =~ ^/etc/.* && ! -L $capath ]]; then + if is_fedora; then + sudo rm -f $capath + sudo ln -s /etc/pki/tls/certs/ca-bundle.crt $capath + elif is_ubuntu; then + sudo rm -f $capath + sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath + else + echo "Don't know how to set the CA bundle, expect the install to fail." + fi + fi +fi