U Ad; @s4UdZddlZddlmZddlmZddlmZddlmZm Z ddl m Z ddl m Z dd lmZmZdd lmZeeZdd d d dgdZddddddgdiZdZddddgZdddeeeedgddgdZeed <eeZd!d"Zd#d$Zd%d&Zd'd(Zd)d*Z d+d,Z!e"e e ee#dd-d.d/Z$dS)0zCA Certs: Add ca certificates.N)Logger)dedent)log)subputil)Cloud)Config) MetaSchema get_meta_doc) PER_INSTANCEz!/usr/local/share/ca-certificates/z#cloud-init-ca-cert-{cert_index}.crtz/etc/ca-certificates.confzupdate-ca-certificates) ca_cert_pathca_cert_local_pathca_cert_filenameca_cert_configca_cert_update_cmdrhelz/etc/pki/ca-trust/z/usr/share/pki/ca-trust-source/z+anchors/cloud-init-ca-cert-{cert_index}.crtzupdate-ca-trusta/This module adds CA certificates to the system's CA store and updates any related files using the appropriate OS-specific utility. The default CA certificates can be disabled/deleted from use by the system with the configuration option ``remove_defaults``. .. note:: certificates must be specified using valid yaml. in order to specify a multiline certificate, the yaml multiline list syntax must be used .. note:: Alpine Linux requires the ca-certificates package to be installed in order to provide the ``update-ca-certificates`` command. alpinedebianubuntuZ cc_ca_certszCA CertificateszAdd ca certificatesa ca_certs: remove_defaults: true trusted: - single_line_cert - | -----BEGIN CERTIFICATE----- YOUR-ORGS-TRUSTED-CA-CERT-HERE -----END CERTIFICATE----- ca_certsca-certs)idnametitleZ descriptiondistrosZ frequencyZexamplesZactivate_by_schema_keysmetacCs*t|t}tj|d|d|d<|S)zReturn a distro-specific ca_certs config dictionary @param distro_name: String providing the distro class name. @returns: Dict of distro configurations for ca_cert. r rca_cert_full_path)DISTRO_OVERRIDESgetDEFAULT_CONFIGospathjoin) distro_namecfgr%>/usr/lib/python3/dist-packages/cloudinit/config/cc_ca_certs.py_distro_ca_certs_configsPs  r'cCstj|ddddS)z Updates the CA certificate cache on the current machine. @param distro_cfg: A hash providing _distro_ca_certs_configs function. rF)ZcaptureN)r distro_cfgr%r%r&update_ca_certs]sr*cCsH|sdSt|dD]0\}}t|}|dj|d}tj||ddqdS)a- Adds certificates to the system. To actually apply the new certificates you must also call the appropriate distro-specific utility such as L{update_ca_certs}. @param distro_cfg: A hash providing _distro_ca_certs_configs function. @param certs: A list of certificate strings. Nr) cert_indexi)mode) enumeratestrformatr write_file)r)Zcertsr,cZcert_file_contentsZcert_file_namer%r%r& add_ca_certsfs r3cCs>|dkrt|n(|dkr:t||dkr:d}td|dS)a. Disables all default trusted CA certificates. For Alpine, Debian and Ubuntu to actually apply the changes you must also call L{update_ca_certs}. @param distro_name: String providing the distro class name. @param distro_cfg: A hash providing _distro_ca_certs_configs function. r)rrr)rrz8ca-certificates ca-certificates/trust_new_crts select no)zdebconf-set-selections-N)remove_default_ca_certsdisable_system_ca_certsr)r#r)Z debconf_selr%r%r&disable_default_ca_certs{s  r7cCs|ddkrdSd}d}t|djdkrt|d}g}|D]\}||krbd}||qF|dksv|ddkr||qF|s||d}|d |qFtj|dd |d d d dS) z For every entry in the CA_CERT_CONFIG file prefix the entry with a "!" in order to disable it. @param distro_cfg: A hash providing _distro_ca_certs_configs function. rNz;# Modified by cloud-init to deselect certs due to user-dataFrT)#!r: wb)Zomode) r statst_sizerZ load_file splitlinesappendr1r")r)Zheader_commentZ added_headerZorigZ out_linesliner%r%r&r6s.      r6cCs:|ddkrdStdt|dt|ddS)z Removes all default trusted CA certificates from the system. @param distro_cfg: A hash providing _distro_ca_certs_configs function. r NzDeleting system CA certificatesr )LOGdebugrZdelete_dir_contentsr(r%r%r&r5s   r5)rr$cloudrargsreturncCsd|krtdnd|kr,td|dSd|krFd|krFtd|d|d}t|jj}d|krvtd|d |dd rtd t|jj|d |krt |d }|rtd t |t ||tdt |dS)au Call to handle ca_cert sections in cloud-config file. @param name: The module name "ca_cert" from cloud.cfg @param cfg: A nested dict containing the entire cloud config contents. @param cloud: The L{CloudInit} object in use. @param log: Pre-initialized Python logger object to use for logging. @param args: Any module arguments from cloud.cfg rzFDEPRECATION: key 'ca-certs' is now deprecated. Use 'ca_certs' instead.rzsh