From 79aeb9624c24194308f221e4cc95cbbc7a74b531 Mon Sep 17 00:00:00 2001
From: Manuel Montecelo <mmontecelo@sipwise.com>
Date: Fri, 1 Oct 2021 16:01:14 +0200
Subject: [PATCH] TT#143801 Let's Encrypt expiration problem 20210930

A root-cert in for Let's encrypt expired on this date:
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021

Our jobs in gerrit installing machines, for example matrix-runner, for
stretch and buster, fail to download packages from debian. and
deb.sipwise.com complaining that the certificate is invalid.

This is because of having older versions of ca-certificates, that don't
contain the new root-cert, or because versions of some libraries
(e.g. gnutls used by wget and apt) do not seem to work well when there
are several chains to validate the certificate -- they use only the
first chain, and if elements of it are invalid/expired, don't try the
others.

This change forces installation of new versions of ca-certificates and
libgnutls30 both in the "outside" system running grml (because it needs
to use "wget" accessing the servers for special commands) as well as
"inside" the new chroot, because by default in the new Debian system
ca-certificates is not installed.

Change-Id: I58ff9daa10c21f5ad867308c33ffa303c120683d
(cherry picked from commit 79b0f26a7b07e3ad888037c2503ebef0e09b52cd)
---
 templates/scripts/includes/deployment.sh | 57 +++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/templates/scripts/includes/deployment.sh b/templates/scripts/includes/deployment.sh
index e5f33db..c215c4b 100755
--- a/templates/scripts/includes/deployment.sh
+++ b/templates/scripts/includes/deployment.sh
@@ -306,6 +306,57 @@ EOF
   done
 }
 
+letsencrypt_expiration_fix() {
+  echo "Let's Encrypt expiration fix, installing new versions of ca-certificates and necessary crypto libs..."
+
+  letsencrypt_packages=()
+  letsencrypt_packages+=(ca-certificates)
+  letsencrypt_packages+=(libgnutls30)
+
+  echo "Versions before fix:"
+  dpkg-query --show --showformat="\${binary:Package} \${Version}\n" "${letsencrypt_packages[@]}" || true
+
+  # Use separate apt database and source list because non management node has no internet access
+  # so is installed from management node so these additional packages have to be accessible from
+  # sipwise repo
+  local TMPDIR
+  TMPDIR=$(mktemp -d)
+  mkdir -p "${TMPDIR}/etc/preferences.d" "${TMPDIR}/statedir/lists/partial" \
+    "${TMPDIR}/cachedir/archives/partial"
+  chown _apt -R "${TMPDIR}"
+
+  special_url="${DEBIAN_URL/https/http}"
+  suites="main contrib non-free"
+  {
+    echo "deb ${special_url}/debian/          ${DEBIAN_RELEASE}          ${suites}"
+    echo "deb ${special_url}/debian/          ${DEBIAN_RELEASE}-updates  ${suites}"
+    echo "deb ${special_url}/debian-security/ ${DEBIAN_RELEASE}-security ${suites}"
+  } >> "${TMPDIR}/etc/sources.list"
+
+  mkdir -p "${TMPDIR}"/etc/apt/apt.conf.d/
+  cat > "${TMPDIR}"/etc/apt/apt.conf.d/73_acquire_retries << EOF
+# NGCP_MANAGED_FILE -- deployment.sh
+Acquire::Retries "3";
+EOF
+
+  DEBIAN_FRONTEND='noninteractive' apt-get \
+    -o dir::cache="${TMPDIR}/cachedir" \
+    -o dir::state="${TMPDIR}/statedir" \
+    -o dir::etc="${TMPDIR}/etc" \
+    -o dir::etc::trustedparts="/etc/apt/trusted.gpg.d/" \
+    update
+
+  DEBIAN_FRONTEND='noninteractive' apt-get \
+    -o dir::cache="${TMPDIR}/cachedir" \
+    -o dir::state="${TMPDIR}/statedir" \
+    -o dir::etc="${TMPDIR}/etc" \
+    -o dir::etc::trustedparts="/etc/apt/trusted.gpg.d/" \
+    -y --no-install-recommends install "${letsencrypt_packages[@]}"
+
+  echo "Versions after fix:"
+  dpkg-query --show --showformat="\${binary:Package} \${Version}\n" "${letsencrypt_packages[@]}" || true
+}
+
 status_wait() {
   if [[ -n "${STATUS_WAIT}" ]] && [[ "${STATUS_WAIT}" != 0 ]]; then
     # if ngcpstatus boot option is used wait for a specific so a
@@ -1561,6 +1612,10 @@ case "${DEBIAN_RELEASE}" in
 esac
 
 
+# Fix for Let's Encrypt cert expiration problem at 20210930
+letsencrypt_expiration_fix
+
+
 if ! "$NGCP_INSTALLER" ; then
   CARRIER_EDITION=false
   PRO_EDITION=false
@@ -1867,7 +1922,7 @@ DEBOPT_OPTIONS=("--no-merged-usr")
 
 # install only "Essential:yes" packages plus apt (explicitly included in minbase variant),
 # systemd + network related packages
-DEBOPT_OPTIONS+=("--variant=minbase --include=systemd,systemd-sysv,init,isc-dhcp-client,ifupdown")
+DEBOPT_OPTIONS+=("--variant=minbase --include=systemd,systemd-sysv,init,isc-dhcp-client,ifupdown,ca-certificates")
 # TT#61152 Add configuration Acquire::Retries=3, for apt to retry downloads
 DEBOPT_OPTIONS+=("--aptopt='Acquire::Retries=3'")