From 56c71d0816dc8b4e53bb2a286cc798cfd33d3491 Mon Sep 17 00:00:00 2001
From: Mark Johnston <markj@FreeBSD.org>
Date: Mon, 14 Jul 2025 21:44:57 +0000
Subject: [PATCH] security/ca_root_nss: Make unprivileged installation possible

The post-install and post-deinstall scripts simply invoke "certctl
rehash", which of course requires root privileges.  Modify them to
enable unprivileged installation, useful for building VM images.  For
instance, FreeBSD's EC2 image builder wants to install amazon-ssm-agent,
which depends on ca_root_nss.

Modify the scripts to:
1. Use PKG_ROOTDIR as the root instead of assuming the default.
2. When installing, and PKG_METALOG is set, assume we're doing an
   unprivileged build and tell certctl to write updates to the
   configured METALOG.

Note, the use of PKG_METALOG depends on a new pkg feature:
https://github.com/freebsd/pkg/pull/2476

If an updated ca_root_nss is installed using an old pkg(8), then the
PKG_METALOG variable will not be set, so there are no compatibility
issues.

Sponsored by:	The FreeBSD Foundation
Sponsored by:	Klara, Inc.
PR:		288243
---
 security/ca_root_nss/Makefile               |  4 ++--
 security/ca_root_nss/files/pkg-deinstall.in |  6 ++++++
 security/ca_root_nss/files/pkg-install.in   | 12 ++++++++++++
 security/ca_root_nss/pkg-plist              |  3 ---
 4 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 security/ca_root_nss/files/pkg-deinstall.in
 create mode 100644 security/ca_root_nss/files/pkg-install.in

diff --git a/security/ca_root_nss/Makefile b/security/ca_root_nss/Makefile
index 8824436587be..1214762865cf 100644
--- a/security/ca_root_nss/Makefile
+++ b/security/ca_root_nss/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	ca_root_nss
 PORTVERSION=	${VERSION_NSS}
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	security
 MASTER_SITES=	MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
 DISTNAME=	nss-${VERSION_NSS}${NSS_SUFFIX}
@@ -34,7 +34,7 @@ VERSION_NSS=	3.115
 CERTDATA_TXT_PATH=	lib/ckfw/builtins/certdata.txt
 BUNDLE_PROCESSOR=	MAca-bundle.pl
 
-SUB_FILES=	MAca-bundle.pl pkg-message
+SUB_FILES=	MAca-bundle.pl pkg-deinstall pkg-install pkg-message
 SUB_LIST=	VERSION_NSS=${VERSION_NSS}
 
 do-build:
diff --git a/security/ca_root_nss/files/pkg-deinstall.in b/security/ca_root_nss/files/pkg-deinstall.in
new file mode 100644
index 000000000000..8e5138c10c22
--- /dev/null
+++ b/security/ca_root_nss/files/pkg-deinstall.in
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+if [ "$2" = POST-DEINSTALL ]; then
+	CERTCTL_ARGS="-D ${PKG_ROOTDIR}"
+	certctl ${CERTCTL_ARGS} rehash
+fi
diff --git a/security/ca_root_nss/files/pkg-install.in b/security/ca_root_nss/files/pkg-install.in
new file mode 100644
index 000000000000..6f05ab7e72ed
--- /dev/null
+++ b/security/ca_root_nss/files/pkg-install.in
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+if [ "$2" = POST-INSTALL ]; then
+	CERTCTL_ARGS="-D ${PKG_ROOTDIR}"
+	if [ -n "${PKG_METALOG}" ]; then
+		CERTCTL_ARGS="${CERTCTL_ARGS} -U -M ${PKG_METALOG}"
+	fi
+	certctl ${CERTCTL_ARGS} rehash
+
+	[ ! -e %%LOCALBASE%%/bin/cert-sync ] || \
+	    %%LOCALBASE%%/bin/cert-sync --quiet %%PREFIX%%/share/certs/ca-root-nss.crt
+fi
diff --git a/security/ca_root_nss/pkg-plist b/security/ca_root_nss/pkg-plist
index 7899413567aa..79f18017fea6 100644
--- a/security/ca_root_nss/pkg-plist
+++ b/security/ca_root_nss/pkg-plist
@@ -2,6 +2,3 @@
 @sample etc/ssl/cert.pem.sample
 %%ETCSYMLINK%%openssl/cert.pem
 %%ETCSYMLINK%%/etc/ssl/cert.pem
-@postexec certctl rehash
-@postunexec certctl rehash
-@postexec [ ! -e %%LOCALBASE%%/bin/cert-sync ] || %%LOCALBASE%%/bin/cert-sync --quiet %%PREFIX%%/share/certs/ca-root-nss.crt