X-Git-Url: https://gerrit.automotivelinux.org/gerrit/gitweb?a=blobdiff_plain;ds=sidebyside;f=recipes-connectivity%2Fkuksa-val%2Fkuksa-val_git.bb;h=64daba2289ae22b8bb57d8695befef653fda5e33;hb=83b8f9a263d95ed693f00c1bfbb968de236f736a;hp=2c1966ff6064b75cc30579d3b67c093f6e5f6438;hpb=99356a43e5ee3ae662af83e4ae6e0e11ef1aa39e;p=AGL%2Fmeta-agl-demo.git

diff --git a/recipes-connectivity/kuksa-val/kuksa-val_git.bb b/recipes-connectivity/kuksa-val/kuksa-val_git.bb
index 2c1966ff6..64daba228 100644
--- a/recipes-connectivity/kuksa-val/kuksa-val_git.bb
+++ b/recipes-connectivity/kuksa-val/kuksa-val_git.bb
@@ -9,22 +9,18 @@ LIC_FILES_CHKSUM = "file://../LICENSE;md5=2b42edef8fa55315f34f2370b4715ca9 \
                     file://3rd-party-libs/turtle/LICENSE_1_0.txt;md5=e4224ccaecb14d942c71d31bef20d78c \
                     file://3rd-party-libs/jwt-cpp/LICENSE;md5=8325a5ce4414c65ffdda392e0d96a9ff"
 
-DEPENDS = "boost openssl mosquitto nss protobuf-native grpc-native grpc"
+DEPENDS = "boost openssl mosquitto protobuf-native grpc-native grpc"
 
 require kuksa-val.inc
 
 SRC_URI += "file://kuksa-val.service \
-            file://0001-Make-Boost-requirements-more-liberal.patch;striplevel=2 \
-            file://0002-Fix-gRPC-configuration-for-OE-cross-compiling.patch;striplevel=2 \
-            file://0003-Make-install-locations-configurable.patch;striplevel=2 \
-            file://0004-Disable-default-fetch-and-build-of-googletest.patch;striplevel=2 \
-            file://0005-kuksa-val-server-Add-missing-check_git-dependency.patch;striplevel=2 \
-            file://Server.key \
-            file://Server.pem \
+            file://0001-Make-Boost-requirements-more-liberal.patch;patchdir=.. \
+            file://0002-Fix-gRPC-configuration-for-OE-cross-compiling.patch;patchdir=.. \
+            file://0003-Make-install-locations-configurable.patch;patchdir=.. \
+            file://0004-Disable-default-fetch-and-build-of-googletest.patch;patchdir=.. \
+            file://0005-kuksa-val-server-Add-missing-check_git-dependency.patch;patchdir=.. \
+            file://0006-kuksa-val-server-OverlayLoader-explicitly-include-fs.patch;patchdir=.. \
 "
-# NOTE: Ideally this would be applied, but our S definition makes it problematic:
-#   file://0001-genCerts.sh-add-Subject-Alt-Name-extension-to-server.patch;striplevel=?
-#
 
 S = "${WORKDIR}/git/kuksa-val-server"
 
@@ -32,10 +28,11 @@ inherit cmake pkgconfig systemd useradd
 
 SYSTEMD_SERVICE:${PN} = "kuksa-val.service"
 
-USERADD_PACKAGES = "${PN}"
+USERADD_PACKAGES = "${PN} ${PN}-server-certificates"
 USERADDEXTENSION = "useradd-staticids"
 GROUPADD_PARAM:${PN} = "-g 900 kuksa ;"
 USERADD_PARAM:${PN} = "--system -g 900 -u 900 -o -d / --shell /bin/nologin kuksa ;"
+GROUPADD_PARAM:${PN}-server-certificates = "-g 900 kuksa ;"
 
 # Configure file locations more along the lines of FHS instead of kuksa.val's
 # default locations.
@@ -55,44 +52,38 @@ do_install:append() {
         install -d ${D}${systemd_system_unitdir}
         install -m 0644 ${WORKDIR}/kuksa-val.service ${D}${systemd_system_unitdir}
     fi
-
-    # Install replacement server key + certificate
-    # These are AGL specific versions generated using a tweaked
-    # genCerts.sh script from the source tree that adds the now
-    # required subjectAltName extension field to make python3-ssl
-    # happy.  This will be addressed with upstream and can hopefully
-    # be dropped in the future.
-    rm -f ${D}${sysconfdir}/kuksa-val/Server.key
-    install ${WORKDIR}/Server.key ${D}${sysconfdir}/kuksa-val/
-    rm -f ${D}${sysconfdir}/kuksa-val/Server.pem
-    install ${WORKDIR}/Server.pem ${D}${sysconfdir}/kuksa-val/
-
-    # Restrict server certificate access
-    # NOTE: The client certificates are left alone here for client
-    #       development convenience for now, but this will need to
-    #       be revisited.
-    chmod 640 ${D}${sysconfdir}/kuksa-val/Server.key
-    chgrp 900 ${D}${sysconfdir}/kuksa-val/Server.key
-    chmod 640 ${D}${sysconfdir}/kuksa-val/Server.pem
-    chgrp 900 ${D}${sysconfdir}/kuksa-val/Server.pem
 }
 
-pkg_postinst_ontarget:${PN}-client-certificates () {
-    certutil -A -d /home/agl-driver/.pki/nssdb -n "KuksaRootCA" -t "pC,," -i ${sysconfdir}/kuksa-val/CA.pem
-    chown agl-driver:agl-driver -R /home/agl-driver/.pki/
-}
+# Put certificates into their own packages so we can avoid duplicates
+# of them for e.g. cluster clients, and so downstream users can
+# replace them with their own certificates.
+#
+# NOTE:
+#   Downstream users can replace these packages with alternates by
+#   having their packages set their RPROVIDES to include the desired
+#   kuksa-val-certificates-* and explicitly adding their package(s)
+#   to an image, they will end up getting priority during rootfs
+#   construction and installed instead of the default ones here.
+
+PACKAGE_BEFORE_PN += "${PN}-certificates-ca ${PN}-certificates-server ${PN}-certificates-client"
 
-# Put client certificates into their own package so we can avoid
-# duplicates of them for e.g. cluster clients.  Longer term this
-# will need to be revisited.
-PACKAGE_BEFORE_PN += "${PN}-client-certificates"
+FILES:${PN}-certificates-ca = " \
+    ${sysconfdir}/kuksa-val/CA.pem \
+"
 
-FILES:${PN}-client-certificates = " \
+FILES:${PN}-certificates-server = " \
+    ${sysconfdir}/kuksa-val/Server.key \
+    ${sysconfdir}/kuksa-val/Server.pem \
+    ${sysconfdir}/kuksa-val/jwt.key.pub \
+"
+RDEPENDS:${PN}-certificates-server += "${PN}-certificates-ca"
+
+FILES:${PN}-certificates-client = " \
     ${sysconfdir}/kuksa-val/Client.key \
     ${sysconfdir}/kuksa-val/Client.pem \
-    ${sysconfdir}/kuksa-val/CA.pem \
 "
+RDEPENDS:${PN}-certificate-clients += "${PN}-certificates-ca"
 
 FILES:${PN} += "${systemd_system_unitdir} ${datadir}"
 
-RDEPENDS:${PN} += "${PN}-client-certificates nss-agl-driver-db"
+RDEPENDS:${PN} += "${PN}-certificates-server ${PN}-certificates-client"