debian: Move PKI directory to FHS-compliant location.

The PKI directory is mutable state, so it should be in /var, not in /usr.
This commit changes its location and, on systems upgraded from earlier
versions, moves the existing PKI and leaves behind a symlink.

CC: 661090@bugs.debian.org
Reported-by: Andreas Beckmann <debian@abeckmann.de>
Signed-off-by: Ben Pfaff <blp@nicira.com>

diff --git a/AUTHORS b/AUTHORS
index 84908a9a97a4d7a201f6b9cee2dbec8a0fafac7e..6a83514bc8f304179331e6f08972e5cf5637463d 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -68,6 +68,7 @@ Alan Shieh              ashieh@nicira.com
 Alban Browaeys          prahal@yahoo.com
 Alex Yip                alex@nicira.com
 Alexey I. Froloff       raorn@altlinux.org
+Andreas Beckmann        debian@abeckmann.de
 Ben Basler              bbasler@nicira.com
 Bob Ball                bob.ball@citrix.com
 Brad Hall               brad@nicira.com

diff --git a/debian/automake.mk b/debian/automake.mk
index e18d47a2b3844241ca9e4656c6db378508f3be0c..4425750d2af1ad0ceb6921e2745ce72448507923 100644 (file)
--- a/debian/automake.mk
+++ b/debian/automake.mk
@@ -31,6 +31,7 @@ EXTRA_DIST += \
        debian/openvswitch-ipsec.dirs \
        debian/openvswitch-ipsec.init \
        debian/openvswitch-ipsec.install \
+       debian/openvswitch-pki.dirs \
        debian/openvswitch-pki.postinst \
        debian/openvswitch-pki.postrm \
        debian/openvswitch-switch.README.Debian \

diff --git a/debian/openvswitch-controller.postinst b/debian/openvswitch-controller.postinst
index 51acfb1ab3b3c16d4a4c49fefceab8d2a6041021..3073dc0427e8457e3e8e55cbc904a7cecde478c0 100755 (executable)
--- a/debian/openvswitch-controller.postinst
+++ b/debian/openvswitch-controller.postinst
@@ -21,8 +21,16 @@ set -e
 case "$1" in
     configure)
         cd /etc/openvswitch-controller
+
+        # If cacert.pem is a symlink to the old location for cacert.pem,
+        # remove it so that we can symlink it to the new location.
+        if test -h cacert.pem && \
+           test X"`readlink cacert.pem`" = X/usr/share/openvswitch/pki/switchca/cacert.pem; then
+            rm -f cacert.pem
+        fi
+
         if ! test -e cacert.pem; then
-            ln -s /usr/share/openvswitch/pki/switchca/cacert.pem cacert.pem
+            ln -s /var/lib/openvswitch/pki/switchca/cacert.pem cacert.pem
         fi
         if ! test -e privkey.pem || ! test -e cert.pem; then
             oldumask=$(umask)

diff --git a/debian/openvswitch-pki.dirs b/debian/openvswitch-pki.dirs
new file mode 100644 (file)
index 0000000..84f7b37
--- /dev/null
+++ b/debian/openvswitch-pki.dirs
@@ -0,0 +1 @@
+/var/lib/openvswitch

diff --git a/debian/openvswitch-pki.postinst b/debian/openvswitch-pki.postinst
index ab25795fb941aba4f793e687684ddff95bfc9137..f4705e94f6da7b5686474d677adc0969bb80e978 100755 (executable)
--- a/debian/openvswitch-pki.postinst
+++ b/debian/openvswitch-pki.postinst
@@ -19,8 +19,16 @@ set -e
 
 case "$1" in
     configure)
+        # Move the pki directory from its previous, non FHS-compliant location,
+        # to its new location, leaving behind a symlink for compatibility.
+        if test -d /usr/share/openvswitch/pki && \
+           test ! -e /var/lib/openvswitch/pki; then
+            mv /usr/share/openvswitch/pki /var/lib/openvswitch
+            ln -s /var/lib/openvswitch/pki /usr/share/openvswitch/pki
+        fi
+
         # Create certificate authorities.
-        if test ! -d /usr/share/openvswitch/pki; then
+        if test ! -e /var/lib/openvswitch/pki; then
             ovs-pki init
         fi
         ;;

diff --git a/debian/openvswitch-pki.postrm b/debian/openvswitch-pki.postrm
index 5db4d6be6bb63d67b668c89e83fed49b47aa609f..bc91e13de725fc479929a0ad52701b88d4d504e4 100755 (executable)
--- a/debian/openvswitch-pki.postrm
+++ b/debian/openvswitch-pki.postrm
@@ -22,6 +22,11 @@ set -e
 case "$1" in
     purge)
         rm -f /var/log/openvswitch/ovs-pki.log* || true
+
+        # Remove backward compatibility symlink, if present.
+        if test -h /usr/share/openvswitch/pki; then
+            rm -f /usr/share/openvswitch/pki
+        fi
         ;;
 
     remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)

diff --git a/m4/openvswitch.m4 b/m4/openvswitch.m4
index c59d5d4c1d7447f13b298f2889a837d87a54c4c3..9b2a5baf743655a3b71fabce43523b72cf2e6424 100644 (file)
--- a/m4/openvswitch.m4
+++ b/m4/openvswitch.m4
@@ -1,6 +1,6 @@
 # -*- autoconf -*-
 
-# Copyright (c) 2008, 2009, 2010, 2011 Nicira Networks.
+# Copyright (c) 2008, 2009, 2010, 2011, 2012 Nicira Networks.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -106,9 +106,9 @@ AC_DEFUN([OVS_CHECK_PKIDIR],
   [AC_ARG_WITH(
      [pkidir], 
      AC_HELP_STRING([--with-pkidir=DIR], 
-                    [PKI hierarchy directory [[DATADIR/openvswitch/pki]]]),
+                    [PKI hierarchy directory [[LOCALSTATEDIR/lib/openvswitch/pki]]]),
      [PKIDIR=$withval],
-     [PKIDIR='${pkgdatadir}/pki'])
+     [PKIDIR='${localstatedir}/lib/openvswitch/pki'])
    AC_SUBST([PKIDIR])])
 
 dnl Checks for the directory in which to store pidfiles.