Add base-passwd and generate certificate bundle

[woky]

No description provided.

[cjdcordeiro]

it lgtm.

I have 2 non-blocking comments though:

1. (see inline comment about var names)
2. in the base-passwd DEB, it actually is a preinst script who populates those files in /etc, manually (like printing a text snippet). The files in /usr/share are only used in postinst, by what I assume is a sort of backup procedure. So the comment/question is: aren't we being untruthful to the DEB by ignoring the preinst?

[woky]

in the base-passwd DEB, it actually is a preinst script who populates those files in /etc, manually (like printing a text snippet). The files in /usr/share are only used in postinst, by what I assume is a sort of backup procedure. So the comment/question is: aren't we being untruthful to the DEB by ignoring the preinst?

@cjdcordeiro We are still truthful, see:

• https://salsa.debian.org/debian/base-passwd/-/blob/master/debian/preinst#L7
• https://salsa.debian.org/debian/base-passwd/-/blob/master/debian/rules#L22

The preinst string is created from passwd.master.

That being said, I don't think it makes sense to be truthful here. I don't think most of these make sense in 99% of container images we wish to have:

...
games:*:5:60:games:/usr/games:/usr/sbin/nologin
man:*:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:*:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:*:8:8:mail:/var/mail:/usr/sbin/nologin
news:*:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:*:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:*:13:13:proxy:/bin:/usr/sbin/nologin
...

FYI: I'm not sure why the ca-certificates script now works but I think it's because of the relative output dir issue that was just fixed in chisel. I may have edited the command line I put into the issue where I originally used relative path.

[cjdcordeiro]

thanks for the info on the base-passwd's preinst 👍

no further comments then.

[woky]

@niemeyer could you please merge this one if you have no objections?

[niemeyer]

Just some nitpicking, and one relevant question:

[niemeyer]

This shouldn't be required, as it's the actual mode of the underlying directory. I think we have a bug about umask getting in the way during creation. Is that what you're seeing? Why was the explicit mode added here?

[woky]

I though there wasn't bug but that the directory had wrong permissions in the archive since the postinst script explicitly adjusted its permissions. But I've just checked it's correct and indeed it sounds like a bug with umask handling. Reported here: canonical/chisel#9

[niemeyer]

Nitpick: I think it's more conventional in Python to not have spaces padding the edges of list comprehensions. Is that true? I don't mind too much the details of our conventions, as long as it's consistent, but since we're just starting we should try to borrow some typical Python style.

[woky]

Ack. Fixed.