From ccf91d43d35e78230bd58aeb70d66ef955afe8e7 Mon Sep 17 00:00:00 2001 From: Jean-Louis Dupond Date: Tue, 30 Sep 2025 13:22:19 +0200 Subject: [PATCH] packaging: rename p12 files on major os upgrade When restoring a backup from CentOS 8 onto a CentOS 9 system, the p12 files that were generated are invalid, because they use a legacy encryption on CentOS 9. So we rename the files during a restore if the major version differs, this as the following engine-setup generates new ones anyway then. Signed-off-by: Jean-Louis Dupond --- packaging/bin/engine-backup.sh.in | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/packaging/bin/engine-backup.sh.in b/packaging/bin/engine-backup.sh.in index 09743fe45a8..a9a0e02c739 100755 --- a/packaging/bin/engine-backup.sh.in +++ b/packaging/bin/engine-backup.sh.in @@ -1921,6 +1921,16 @@ __EOF__ sed -i "/^${ESC_APACHE_CONFIGURED_LINE}\$/d" "${POSTINSTALL}" fi + # Delete old p12 files, as encryption of files on c8 are incomatible with c9 + # More info on https://github.com/openssl/openssl/discussions/23089 + if [ "${os}" != "${os_at_backup}" ]; then + for file in /etc/pki/ovirt-engine/keys/*.p12; do + local timestamp=$(date +"%Y%m%d%H%M%S") + mv "${file}" "${file}.${timestamp}" + log "Renamed ${file} to ${file}.${timestamp}" + done + fi + if selinuxenabled; then echo "${paths}" | while read -r path; do if [ -e "${path}" ]; then