security/ca_root_nss: handle bundle links consistently for ETCSYMLINK

[des]

Summary

/usr/local/openssl/cert.pem is the default location for security/openssl
so it should be handled just like /etc/ssl/cert.pem base OpenSSL. To
avoid having samples and copies with differing contents point both files
to the actual /usr/local/etc/ssl/cert.pem created by the sample. If users
have set their own content that is likely intended and should be enforced
across all three files.

PR: 283161

[franco_opnsense.org]

change summary

[des]

security/ca_root_nss/Makefile

54

This doesn't look right...

[franco_opnsense.org]

security/ca_root_nss/Makefile

54

Can you be specific.

# diff -u /usr/local/etc/ssl/cert.pem{,.sample}
# ls -lah /etc/ssl/cert.pem
lrwxr-xr-x  1 root wheel   32B Dec 20 19:01 /etc/ssl/cert.pem -> ../../usr/local/etc/ssl/cert.pem
# ls -lah /usr/local/openssl/cert.pem
lrwxr-xr-x  1 root wheel   19B Dec 20 19:01 /usr/local/openssl/cert.pem -> ../etc/ssl/cert.pem
# ls -lah /usr/local/etc/ssl/cert.pem
-rw-r--r--  1 root wheel  774K Dec 20 19:01 /usr/local/etc/ssl/cert.pem
# md5 /etc/ssl/cert.pem
MD5 (/etc/ssl/cert.pem) = 5114bb207368fb4f8afb93275db6bf37
# md5 /usr/local/etc/ssl/cert.pem
MD5 (/usr/local/etc/ssl/cert.pem) = 5114bb207368fb4f8afb93275db6bf37
# md5 /usr/local/etc/ssl/cert.pem.sample 
MD5 (/usr/local/etc/ssl/cert.pem.sample) = 5114bb207368fb4f8afb93275db6bf37
# md5 /usr/local/openssl/cert.pem
MD5 (/usr/local/openssl/cert.pem) = 5114bb207368fb4f8afb93275db6bf37

[franco_opnsense.org]

@des did you find the time to make a technical assessment? thanks!

[des]

I keep trying to think of a better way to do this than abuse the @sample mechanism, but I'm not sure there is one if we don't want to break compatibility for the non-ETCSYMLINK case. Ultimately what we need is to finish certctl so ETCSYMLINK is no longer needed, but this is probably good enough until then.