Bug 1680063 - python2-certifi points to the wrong location
Summary: python2-certifi points to the wrong location
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Service Broker
Version: 3.11.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.11.z
Assignee: Shawn Hurley
QA Contact: Zihan Tang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-02-22 16:21 UTC by Pablo Alonso Rodriguez
Modified: 2019-11-15 09:10 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-06 02:00:28 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:0794 0 None None None 2019-06-06 02:00:41 UTC

Description Pablo Alonso Rodriguez 2019-02-22 16:21:43 UTC
Description of problem:

Package python2-certifi points to the same CA location than the upstream version "/usr/lib/python2.7/site-packages/certifi/cacert.pem" as per:

$ python -m certifi
/usr/lib/python2.7/site-packages/certifi/cacert.pem

But does not bundle the cacert.pem file as per:

$ rpm -ql python2-certifi | grep /usr/lib/python2.7/site-packages/certifi/cacert.pem

$

It should either include the file or point to the system bundle (as the Fedora version does):

$ python -m certifi
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

Version-Release number of the following components:

$ rpm -q python2-certifi
python2-certifi-2018.4.16-1.el7.noarch

How reproducible:

Always

Steps to Reproduce:

$ python -m certifi
/usr/lib/python2.7/site-packages/certifi/cacert.pem

Actual results:

Pointing to a non-existent file

Expected results:

Either the following:

$ python -m certifi
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem

Or the package should include /usr/lib/python2.7/site-packages/certifi/cacert.pem

Comment 2 Scott Dodson 2019-02-28 14:49:15 UTC
Package appears to be maintained by Jason Montleon for ASB / APB usage.

Comment 9 Zihan Tang 2019-04-15 09:11:30 UTC
@Pablo, thanks for your clarification,
/etc/pki/tls/certs/ca-bundle.crt  is system file.
 
bash-4.2$ ls /etc/pki/tls/certs/ca-bundle.crt
/etc/pki/tls/certs/ca-bundle.crt

Move to Verified.

Comment 10 Zihan Tang 2019-04-15 09:17:53 UTC
This is also fixed in v4.0+

Comment 12 errata-xmlrpc 2019-06-06 02:00:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0794


Note You need to log in before you can comment on or make changes to this bug.