Merge ~vorlon/ubuntu/+source/ssl-cert:lp.2037869 into ubuntu/+source/ssl-cert:ubuntu/devel

[Steve Langasek]

[Nick Rosbrook (enr0n)]

The service file looks appropriately configured for first-boot, so LGTM.

review: Approve

[Steve Langasek (vorlon)]

Unfortunately, discussing the subiquity side of this and talking to xnox, it seems we can't trust ConditionFirstBoot to be correct, so I'm looking at doing this with ConditionFileExists instead

[Nick Rosbrook (enr0n)]

> Unfortunately, discussing the subiquity side of this and talking to xnox, it
> seems we can't trust ConditionFirstBoot to be correct, so I'm looking at doing
> this with ConditionFileExists instead

Ah, yeah I should have added that this depends on certain behavior around /etc/machine-id (or potentially systemd.condition-first-boot).

[Steve Langasek (vorlon)]

Adjusted to use ConditionPathExists=!/etc/ssl/private/ssl-cert-snakeoil.key

[Michael Hudson-Doyle (mwhudson)]

review: Needs Fixing

[Steve Langasek (vorlon)]

right, fixed up the systemd service properly, and did a boot test with it in lxd. looks better to me now, WDYT?

[Michael Hudson-Doyle (mwhudson)]

Still a bit of a quibble but I think it's a minor one if you just want to get this done.

review: Needs Information

diff --git a/debian/changelog b/debian/changelog
index 5e91747..b833c4c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+ssl-cert (1.1.2ubuntu1) mantic; urgency=medium
+
+  * Add a systemd unit to generate a fresh private key for each
+    installed system when ssl-cert is preinstalled in installation media
+    (true for all Ubuntu and flavor desktop live images today).
+    LP: #2037869.
+
+ -- Steve Langasek <[e-mail]>  Sat, 30 Sep 2023 21:19:41 -0700
+
 ssl-cert (1.1.2) unstable; urgency=medium
 
   [ Simon Chopin ]
diff --git a/debian/control b/debian/control
index 86165ba..ffd71ed 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: ssl-cert
 Section: utils
 Priority: optional
-Maintainer: Debian Apache Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Apache Maintainers <[e-mail]>
 Uploaders: Stefan Fritsch <[e-mail]>
 Build-Depends: debhelper-compat (= 12), po-debconf
 Standards-Version: 4.6.0
diff --git a/debian/rules b/debian/rules
index 23d1661..ca6320d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -6,6 +6,7 @@ install:
 	dh_clean
 	dh_installdirs
 	dh_installdocs README
+	dh_installsystemd
 	dh_installman make-ssl-cert.8
 	dh_installchangelogs
 	dh_lintian
diff --git a/debian/ssl-cert.service b/debian/ssl-cert.service
 new file mode 100644
index 0000000..09665f2
--- /dev/null
+++ b/debian/ssl-cert.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Generate snakeoil SSL keypair
+ConditionPathExists=!/etc/ssl/private/ssl-cert-snakeoil.key
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=-/usr/sbin/make-ssl-cert generate-default-snakeoil --force-overwrite
+
+[Install]
+WantedBy=multi-user.target