Problems with bootstrapping certificates

[Alan DeKok]

Petr Uzel wrote:
> To be more specific: I work on packaging freeradius server RPM. The
> README explictly states that "This bootstrap script SHOULD be run on
> installation of any pre-built binary package for your OS." I
> understand that it should be ran automatically in the %post section,
> like in the suse spec file included in the tarball. This leads to two
> problems:
> - if the user runs bootstrap script manually after installation, the
>   certificates get corrupted

  Yes.  Re-generating the certs causes them to be regenerated.

> - if the user performs upgrade of the package, the certificates get
>   corrupted - this is worse than the first problem, since the user
>   might already have his 'production' certificates installed.

  So don't regenerate them...

> So I suggest either to
> 1) do not recommend running the bootstrap script automatically and
> force the user to run it manually
> or
> 2) fix the bootstrap script and/or Makefile to do nothing if
> the required files already exist.

  That's already in the "makefile".  I suggest a patch to the bootstrap
script.

  Alan DeKok.