swiyu-verifier.postinst (2359B)
1 #!/bin/sh 2 # Build the service's own Java truststore, and say what is left to do. 3 # 4 # The Swiss Government Root CA VI that the SWIYU infrastructure may present is 5 # not in the public trust store the JVM uses by default. Rather than adding it 6 # to the host's trust store, where it would be trusted by everything on the 7 # machine, it is imported into a copy of the default store that only this 8 # service uses (/usr/bin/swiyu-verifier passes it to the JVM, and silently does 9 # not if this failed). 10 11 set -e 12 13 CERT=/usr/share/swiyu-verifier/certs/root_ca_vi.crt 14 TRUSTSTORE=/var/lib/swiyu-verifier/cacerts 15 SOURCE_STORE=/etc/ssl/certs/java/cacerts 16 17 case "${1}" in 18 configure) 19 20 if [ -r "${CERT}" ] && command -v keytool >/dev/null 2>&1; then 21 # Rebuilt from scratch on every configure, so that a new upstream cert in 22 # the package replaces the old one instead of piling up next to it. 23 rm -f "${TRUSTSTORE}" 24 if [ -r "${SOURCE_STORE}" ]; then 25 cp "${SOURCE_STORE}" "${TRUSTSTORE}" 26 fi 27 if keytool -importcert -noprompt \ 28 -alias root_ca_vi \ 29 -file "${CERT}" \ 30 -keystore "${TRUSTSTORE}" \ 31 -storepass changeit >/dev/null 2>&1; then 32 chmod 0644 "${TRUSTSTORE}" 33 else 34 echo "Could not build ${TRUSTSTORE}; the service will use the default" >&2 35 echo "Java trust store, which does not include the Swiss Government" >&2 36 echo "Root CA VI." >&2 37 rm -f "${TRUSTSTORE}" 38 fi 39 fi 40 41 if [ ! -e /etc/swiyu-verifier/secrets/db.env ]; then 42 echo "No database configured for the SWIYU verifier yet; run" 43 echo "'swiyu-verifier-dbconfig' once and fill in the identity settings in" 44 echo "/etc/swiyu-verifier/swiyu-verifier.env. See" 45 echo "/usr/share/doc/swiyu-verifier/README.Debian." 46 fi 47 48 if [ ! -e /etc/swiyu-verifier/secrets/signing-key.yml ]; then 49 echo "No signing key yet; copy" 50 echo "/usr/share/swiyu-verifier/signing-key.yml.example to" 51 echo "/etc/swiyu-verifier/secrets/signing-key.yml and put your own key in" 52 echo "it, or configure an HSM. Without a key the verifier answers the" 53 echo "wallet with 'Failed to sign request object'." 54 fi 55 56 ;; 57 58 abort-upgrade | abort-remove | abort-deconfigure) ;; 59 60 *) 61 echo "postinst called with unknown argument \`${1}'" >&2 62 exit 1 63 ;; 64 esac 65 66 # Scripts generated by dh_installdeb are inserted below 67 68 #DEBHELPER# 69 70 exit 0