summaryrefslogtreecommitdiff
path: root/cloudinit/config/cc_ca_certs.py
diff options
context:
space:
mode:
Diffstat (limited to 'cloudinit/config/cc_ca_certs.py')
-rw-r--r--cloudinit/config/cc_ca_certs.py84
1 files changed, 46 insertions, 38 deletions
diff --git a/cloudinit/config/cc_ca_certs.py b/cloudinit/config/cc_ca_certs.py
index bd7bead9..9de065ab 100644
--- a/cloudinit/config/cc_ca_certs.py
+++ b/cloudinit/config/cc_ca_certs.py
@@ -41,28 +41,27 @@ can be removed from the system with the configuration option
import os
-from cloudinit import subp
-from cloudinit import util
+from cloudinit import subp, util
DEFAULT_CONFIG = {
- 'ca_cert_path': '/usr/share/ca-certificates/',
- 'ca_cert_filename': 'cloud-init-ca-certs.crt',
- 'ca_cert_config': '/etc/ca-certificates.conf',
- 'ca_cert_system_path': '/etc/ssl/certs/',
- 'ca_cert_update_cmd': ['update-ca-certificates']
+ "ca_cert_path": "/usr/share/ca-certificates/",
+ "ca_cert_filename": "cloud-init-ca-certs.crt",
+ "ca_cert_config": "/etc/ca-certificates.conf",
+ "ca_cert_system_path": "/etc/ssl/certs/",
+ "ca_cert_update_cmd": ["update-ca-certificates"],
}
DISTRO_OVERRIDES = {
- 'rhel': {
- 'ca_cert_path': '/usr/share/pki/ca-trust-source/',
- 'ca_cert_filename': 'anchors/cloud-init-ca-certs.crt',
- 'ca_cert_config': None,
- 'ca_cert_system_path': '/etc/pki/ca-trust/',
- 'ca_cert_update_cmd': ['update-ca-trust']
+ "rhel": {
+ "ca_cert_path": "/usr/share/pki/ca-trust-source/",
+ "ca_cert_filename": "anchors/cloud-init-ca-certs.crt",
+ "ca_cert_config": None,
+ "ca_cert_system_path": "/etc/pki/ca-trust/",
+ "ca_cert_update_cmd": ["update-ca-trust"],
}
}
-distros = ['alpine', 'debian', 'ubuntu', 'rhel']
+distros = ["alpine", "debian", "ubuntu", "rhel"]
def _distro_ca_certs_configs(distro_name):
@@ -72,8 +71,9 @@ def _distro_ca_certs_configs(distro_name):
@returns: Dict of distro configurations for ca-cert.
"""
cfg = DISTRO_OVERRIDES.get(distro_name, DEFAULT_CONFIG)
- cfg['ca_cert_full_path'] = os.path.join(cfg['ca_cert_path'],
- cfg['ca_cert_filename'])
+ cfg["ca_cert_full_path"] = os.path.join(
+ cfg["ca_cert_path"], cfg["ca_cert_filename"]
+ )
return cfg
@@ -83,7 +83,7 @@ def update_ca_certs(distro_cfg):
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
"""
- subp.subp(distro_cfg['ca_cert_update_cmd'], capture=False)
+ subp.subp(distro_cfg["ca_cert_update_cmd"], capture=False)
def add_ca_certs(distro_cfg, certs):
@@ -98,9 +98,9 @@ def add_ca_certs(distro_cfg, certs):
return
# First ensure they are strings...
cert_file_contents = "\n".join([str(c) for c in certs])
- util.write_file(distro_cfg['ca_cert_full_path'],
- cert_file_contents,
- mode=0o644)
+ util.write_file(
+ distro_cfg["ca_cert_full_path"], cert_file_contents, mode=0o644
+ )
update_cert_config(distro_cfg)
@@ -110,23 +110,27 @@ def update_cert_config(distro_cfg):
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
"""
- if distro_cfg['ca_cert_config'] is None:
+ if distro_cfg["ca_cert_config"] is None:
return
- if os.stat(distro_cfg['ca_cert_config']).st_size == 0:
+ if os.stat(distro_cfg["ca_cert_config"]).st_size == 0:
# If the CA_CERT_CONFIG file is empty (i.e. all existing
# CA certs have been deleted) then simply output a single
# line with the cloud-init cert filename.
- out = "%s\n" % distro_cfg['ca_cert_filename']
+ out = "%s\n" % distro_cfg["ca_cert_filename"]
else:
# Append cert filename to CA_CERT_CONFIG file.
# We have to strip the content because blank lines in the file
# causes subsequent entries to be ignored. (LP: #1077020)
- orig = util.load_file(distro_cfg['ca_cert_config'])
- cr_cont = '\n'.join([line for line in orig.splitlines()
- if line != distro_cfg['ca_cert_filename']])
- out = "%s\n%s\n" % (cr_cont.rstrip(),
- distro_cfg['ca_cert_filename'])
- util.write_file(distro_cfg['ca_cert_config'], out, omode="wb")
+ orig = util.load_file(distro_cfg["ca_cert_config"])
+ cr_cont = "\n".join(
+ [
+ line
+ for line in orig.splitlines()
+ if line != distro_cfg["ca_cert_filename"]
+ ]
+ )
+ out = "%s\n%s\n" % (cr_cont.rstrip(), distro_cfg["ca_cert_filename"])
+ util.write_file(distro_cfg["ca_cert_config"], out, omode="wb")
def remove_default_ca_certs(distro_name, distro_cfg):
@@ -137,14 +141,15 @@ def remove_default_ca_certs(distro_name, distro_cfg):
@param distro_name: String providing the distro class name.
@param distro_cfg: A hash providing _distro_ca_certs_configs function.
"""
- util.delete_dir_contents(distro_cfg['ca_cert_path'])
- util.delete_dir_contents(distro_cfg['ca_cert_system_path'])
- util.write_file(distro_cfg['ca_cert_config'], "", mode=0o644)
+ util.delete_dir_contents(distro_cfg["ca_cert_path"])
+ util.delete_dir_contents(distro_cfg["ca_cert_system_path"])
+ util.write_file(distro_cfg["ca_cert_config"], "", mode=0o644)
- if distro_name in ['debian', 'ubuntu']:
+ if distro_name in ["debian", "ubuntu"]:
debconf_sel = (
- "ca-certificates ca-certificates/trust_new_crts " + "select no")
- subp.subp(('debconf-set-selections', '-'), debconf_sel)
+ "ca-certificates ca-certificates/trust_new_crts " + "select no"
+ )
+ subp.subp(("debconf-set-selections", "-"), debconf_sel)
def handle(name, cfg, cloud, log, _args):
@@ -159,11 +164,13 @@ def handle(name, cfg, cloud, log, _args):
"""
# If there isn't a ca-certs section in the configuration don't do anything
if "ca-certs" not in cfg:
- log.debug(("Skipping module named %s,"
- " no 'ca-certs' key in configuration"), name)
+ log.debug(
+ "Skipping module named %s, no 'ca-certs' key in configuration",
+ name,
+ )
return
- ca_cert_cfg = cfg['ca-certs']
+ ca_cert_cfg = cfg["ca-certs"]
distro_cfg = _distro_ca_certs_configs(cloud.distro.name)
# If there is a remove-defaults option set to true, remove the system
@@ -183,4 +190,5 @@ def handle(name, cfg, cloud, log, _args):
log.debug("Updating certificates")
update_ca_certs(distro_cfg)
+
# vi: ts=4 expandtab