Remove update-ca-trust enable step #3954
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The enable command was never valid. On EL 7 & 8 it was just ignored so effectively it ran twice. On EL 9 there is argument parsing and enable emits a deprecation warning to use extract. On EL 10 the enable command is no longer accepted and only extract is valid.
github-actions
bot
added
Needs tech review
9 tasks
maximiliankolb
approved these changes
Jun 23, 2025
There was a problem hiding this comment.
LGTM style-wise. Would you mind doing a tech review @m-bucher ?
FYI: In foreman on "devel", I still found one instance:
$ rg "update-ca-trust"
app/views/unattended/provisioning_templates/snippet/ca_registration.erb
31: update-ca-trust
maximiliankolb
added
style review done
Without a parameter is technically not a problem because that's the same as |
|
@m-bucher Can you please do a tech review? |
|
Friendly reminder: @m-bucher Can you please do a tech review? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes are you introducing?
Always only run
update-ca-trust extract.Why are you introducing these changes? (Explanation, links to references, issues, etc.)
The enable command was never valid. On EL 7 & 8 it was just ignored so effectively it ran twice. On EL 9 there is argument parsing and enable emits a deprecation warning to use extract. On EL 10 the enable command is no longer accepted and only extract is valid.
Anything else to add? (Considerations, potential downsides, alternative solutions you have explored, etc.)
voxpupuli/puppet-trusted_ca@b3416c5 is where I originally wrote down my findings in the period that ca-certificates on EL9 didn't accept
enableat all. It has since started to accept it again, with a deprecation warning.Checklists
Please cherry-pick my commits into: