Merged trunk lp:cloud-init

1 files changed, 18 insertions, 13 deletions

diff --git a/cloudinit/config/cc_ca_certs.py b/cloudinit/config/cc_ca_certs.py
index dc046bda..4f2a46a1 100644
--- a/cloudinit/config/cc_ca_certs.py
+++ b/cloudinit/config/cc_ca_certs.py
@@ -22,6 +22,7 @@ CA_CERT_PATH = "/usr/share/ca-certificates/"
 CA_CERT_FILENAME = "cloud-init-ca-certs.crt"
 CA_CERT_CONFIG = "/etc/ca-certificates.conf"
 CA_CERT_SYSTEM_PATH = "/etc/ssl/certs/"
+CA_CERT_FULL_PATH = os.path.join(CA_CERT_PATH, CA_CERT_FILENAME)
 
 distros = ['ubuntu', 'debian']
 
@@ -33,7 +34,7 @@ def update_ca_certs():
     util.subp(["update-ca-certificates"], capture=False)
 
 
-def add_ca_certs(paths, certs):
+def add_ca_certs(certs):
     """
     Adds certificates to the system. To actually apply the new certificates
     you must also call L{update_ca_certs}.
@@ -43,27 +44,31 @@ def add_ca_certs(paths, certs):
     if certs:
         # First ensure they are strings...
         cert_file_contents = "\n".join([str(c) for c in certs])
-        cert_file_fullpath = os.path.join(CA_CERT_PATH, CA_CERT_FILENAME)
-        cert_file_fullpath = paths.join(False, cert_file_fullpath)
-        util.write_file(cert_file_fullpath, cert_file_contents, mode=0644)
+        util.write_file(CA_CERT_FULL_PATH, cert_file_contents, mode=0644)
+
         # Append cert filename to CA_CERT_CONFIG file.
-        util.write_file(paths.join(False, CA_CERT_CONFIG),
-                        "\n%s" % CA_CERT_FILENAME, omode="ab")
+        # We have to strip the content because blank lines in the file
+        # causes subsequent entries to be ignored. (LP: #1077020)
+        orig = util.load_file(CA_CERT_CONFIG)
+        cur_cont = '\n'.join([l for l in orig.splitlines()
+                              if l != CA_CERT_FILENAME])
+        out = "%s\n%s\n" % (cur_cont.rstrip(), CA_CERT_FILENAME)
+        util.write_file(CA_CERT_CONFIG, out, omode="wb")
 
 
-def remove_default_ca_certs(paths):
+def remove_default_ca_certs():
     """
     Removes all default trusted CA certificates from the system. To actually
     apply the change you must also call L{update_ca_certs}.
     """
-    util.delete_dir_contents(paths.join(False, CA_CERT_PATH))
-    util.delete_dir_contents(paths.join(False, CA_CERT_SYSTEM_PATH))
-    util.write_file(paths.join(False, CA_CERT_CONFIG), "", mode=0644)
+    util.delete_dir_contents(CA_CERT_PATH)
+    util.delete_dir_contents(CA_CERT_SYSTEM_PATH)
+    util.write_file(CA_CERT_CONFIG, "", mode=0644)
     debconf_sel = "ca-certificates ca-certificates/trust_new_crts select no"
     util.subp(('debconf-set-selections', '-'), debconf_sel)
 
 
-def handle(name, cfg, cloud, log, _args):
+def handle(name, cfg, _cloud, log, _args):
     """
     Call to handle ca-cert sections in cloud-config file.
 
@@ -85,14 +90,14 @@ def handle(name, cfg, cloud, log, _args):
     # default trusted CA certs first.
     if ca_cert_cfg.get("remove-defaults", False):
         log.debug("Removing default certificates")
-        remove_default_ca_certs(cloud.paths)
+        remove_default_ca_certs()
 
     # If we are given any new trusted CA certs to add, add them.
     if "trusted" in ca_cert_cfg:
         trusted_certs = util.get_cfg_option_list(ca_cert_cfg, "trusted")
         if trusted_certs:
             log.debug("Adding %d certificates" % len(trusted_certs))
-            add_ca_certs(cloud.paths, trusted_certs)
+            add_ca_certs(trusted_certs)
 
     # Update the system with the new cert configuration.
     log.debug("Updating certificates")