Red Hat Bugzilla – Bug 1174191
On 64-bit RHEL 7.0/7.1, shared-system-certs is never active for 32-bit multiarch
Last modified: 2018-10-30 03:23:16 EDT
On 64-bit systems, the shared-system-certs feature, which is implemented by the p11-kit-trust.so module, is never active for 32-bit applications, because the p11-kit-trust package is available only as a 64-bit package. For example, on x86_64, the p11-kit-trust.x86_64.rpm package is available, but the p11-kit-trust.i686.rpm package isn't. As a result, 32-bit applications using NSS will always use the statically built NSS version of the root CA list. Expected: 32-bit applications using NSS on a 64-bit system should use the dynamically provided CA list. In order to fix this bug, the p11-kit-trust package must be made available as a 32-bit version on multiarch systems
I'm adding devel ack, since seems that there is a scenario which is currently blocked. Rel-eng needs to add a multilib whitelist for this specific package + remaining p11-kit-trust. Is PM okay witch such change (it will result into shipping i686 rpms, which we haven't previously shipped). Also closing https://projects.engineering.redhat.com/browse/RCM-13414 in favour of this bug. Lubos
Right thing would be to deliver this update via advisory. Do we have any update, or will we re-push last advisory for p11-kit-trust? Fixed in https://code.engineering.redhat.com/gerrit/142223
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3014