| commit | e1c51c43b462f4edd8196e4e840f5f7b745e4d17 | [log] [tgz] |
|---|---|---|
| author | Andrew Geissler <geissonator@yahoo.com> | Tue Dec 09 10:41:05 2025 -0600 |
| committer | Andrew Geissler <geissonator@yahoo.com> | Tue Dec 09 10:41:05 2025 -0600 |
| tree | 2716df071d7ae77f1d0785df9a25c8aaf65d75b6 | |
| parent | b4ac23d003f99ee98e4e1d8892ef8c12b90cdf33 [diff] |
remove installs on templated services and targets
New yocto is getting more stringent on installation of templated service
and targets.
Templated services are installed by bitbake recipes so there's no
need to have the WantedBy/RequiredBy in those services.
Here's a summary of the error we get for packages which have templated
services doing an install:
```
ERROR: obmc-phosphor-image-1.0-r0 do_rootfs: Postinstall scriptlets of
['<package>' 'inst returned 1, marking as unpacked only, configuration
required on target']
If the intention is to defer them to first boot,
then please place them into pkg_postinst_ontarget:${PN} ().
Deferring to first boot via 'exit 1' is no longer supported.
```
Tested:
- Confirmed image builds with new yocto and services are still installed
as expected
Change-Id: Ib20f56812381f8cdf48bdbbcbcd63de770486280
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
This project can be built with meson. The typical meson workflow is: meson builddir && ninja -C builddir.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options] Options: --help Print this menu --type certificate type Valid types: client,server,authority --endpoint d-bus endpoint --path certificate file path --unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=truststore \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.