#1051345 ca-certificates: update-ca-certificates does not recreate ca-certificates.crt if all certificates are deselected

Package:
ca-certificates
Source:
ca-certificates
Submitter:
Scott Moser
Date:
2023-09-06 13:39:39 UTC
Severity:
normal
#1051345#5
Date:
2023-09-06 13:18:29 UTC
From:
To:
Dear Maintainer,

I wanted to disable all the certificates provided by the ca-certificates
package, and only include my own. Upon doing so, and running
update-ca-certificates, I found that
/etc/ssl/certs/ca-certificates.crt contained all the old certificates.

To reproduce:

1. install package
2. deselect all listed entries in ca-certificates.conf

   sed -i '/^[^#!]/s/^/!/'  /etc/ca-certificates.conf

3. run update-ca-certificates, see that
/etc/ssl/certs/ca-certificates.crt is unmodified.



The bug in update-ca-certificates is that the TEMPBUNDLE
file is never created if the 'add' function is never called.
If the TEMPBUNDLE file does not exist, then it will not be moved
into place at the end.