From 7fdc8ce619bcf02dc07a90bca37cc47882f89606 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Mon, 10 Aug 2026 21:06:48 +0200 Subject: pki: T9135: correctly resolve a file:// URL when importing a CA certificate The local-file branch of CA certificate import recognized a file:// URL by scheme but never actually decoded it - os.path.exists()/open() still received the full "file://..." string rather than the path component, so an explicit file:// URL always failed with "File not found" even when it pointed at a real, readable file. --- src/op_mode/pki.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py index 78b896edb..d9f1e8fab 100755 --- a/src/op_mode/pki.py +++ b/src/op_mode/pki.py @@ -984,10 +984,17 @@ def import_ca_certificate( # get_key(), which this mirrors. url = urllib.parse.urlparse(path) if url.scheme in ('', 'file'): - if not os.path.exists(path): - print(f'File not found: {path}') + if url.scheme == 'file': + if url.netloc: + print(f'Unsupported file URL host: {url.netloc}') + return + local_path = urllib.parse.unquote(url.path) + else: + local_path = path + if not os.path.exists(local_path): + print(f'File not found: {local_path}') return - with open(path) as f: + with open(local_path) as f: cert_data = f.read() else: cert_data = vyos.remote.get_remote_config(path) -- cgit v1.2.3