Page MenuHomeFreeBSD

security/ca_root_nss: Disable ETCSYMLINK on FreeBSD 15
ClosedPublic

Authored by des on Sep 5 2025, 4:34 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Oct 7, 9:26 PM
Unknown Object (File)
Tue, Oct 6, 9:19 PM
Unknown Object (File)
Tue, Oct 6, 9:13 PM
Unknown Object (File)
Tue, Oct 6, 9:13 PM
Unknown Object (File)
Sat, Oct 3, 8:19 PM
Unknown Object (File)
Sat, Oct 3, 8:01 PM
Unknown Object (File)
Sat, Oct 3, 7:38 PM
Unknown Object (File)
Thu, Oct 1, 10:47 AM
Subscribers

Diff Detail

Repository
R11 FreeBSD ports repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

des requested review of this revision.Sep 5 2025, 4:34 PM
des created this revision.
This revision is now accepted and ready to land.Sep 5 2025, 4:57 PM

Why? I assume certctl is expected to do the right thing but it doesn't. The port was installing a symlink to /usr/local/openssl/cert.pem but now nothing lands there and node breaks.

That's a bug in Node then. It should be using /etc/ssl/cert.pem.

I have worked on node a couple of months ago and verified in its codebase that it does the right thing with OpenSSL, see my ports commits. I am surprised about the finding mentioned here.

Even if it's a bug in node, the symlink option installs a symlink to /usr/local/openssl/cert.pem, and now the package does not do that. It's a simple hack to keep locally but there is a behavior change here that was probably not intended.