JHALFS build against BLFS: make-ca requires network access ?

Only just came across some old notes about this, when looking to
update some local renderings of the Books for use with JHALFS 
for a 12.3 Multilib build, however, as I can't recall raising
it before, thought that raising it at the start of a new LFS/BLFS
Book development cycle would be a good thing to do, as the markup
giving rise to the issue is still in the BLFS Book sources.

Before anyone points out that the LFS/BLFS Books aren't written
so as satisfy JHALFS, I believe that the issue, that a JHALFS
build merely brings to light, should be rectified.


I had asked for some extra BLFS packages, to allow for further
building, to be installed, resulting in these scripts being
created:

001-z-libxml2
002-z-libxslt
003-z-sgml-common
004-z-unzip
005-z-DocBook
006-z-docbook-xsl
007-z-wget
008-z-libtasn1
009-z-p11-kit
010-z-make-ca
011-z-curl
012-z-git
013-z-gpm
014-z-sudo

however, when JHALFS came to run "010-z-make-ca", it failed at
the point where the Book's instructions suggest running a

  /usr/sbin/make-ca -g

an action which requires network access.


Should that command be rendering in a way that would see JHALFS try to
execute it in the first place?


The source (postlfs/security/make-ca.xml) has

  <screen role="root"><userinput>/usr/sbin/make-ca -g</userinput></screen>

which is why it's getting dumped, but maybe it should be 

  <screen role="nodump"><userinput>/usr/sbin/make-ca -g</userinput></screen>

akin to one of the illustrative command stanzas a bit further down, vis:

  <screen role="nodump"><userinput>wget http://www.cacert.org/certs/root.crt &amp;&amp;
  wget http://www.cacert.org/certs/class3.crt &amp;&amp;
  ...


Presumably, the "make-ca -g" was marked up as role="root", so that the BLFS
Makefile's dump-commands target will extract it, by why only extract that
one "run time" command, and not the other "post package-install" commands? 


I note, also, that the Important note box says

   Technically, this package is already installed at this point. But most
   packages listing make-ca as a dependency actually require the system
   certificate store set up by this package, rather than the make-ca program
   itself. So the instructions for using make-ca for setting up the system
   certificate store are included in this section. You should make sure the
   required runtime dependency for make-ca is satisfied now, and continue
   to follow the instructions.

and have a couple of suggestions for that

1) Starting that second sentence with a "But" after a full stop reads a
   bit clunky, so what about

   ... already installed at this point, however, most packages ...

2) Instead of using "now" in 

   You should make sure the required runtime dependency for make-ca is
   satisfied now, ...

which is, implicitly, saying that you have to be connected to the internet 
when installing make-ca, have something that explicitly mentions a network 
access requirement, so perhaps, getting rid of the "now", something like:

   Before using packages that have make-ca as a dependency, and so might 
   expect to see a populated system certificate store, you should make
   sure that that required runtime dependency is satisfied by running the
   following command, noting that you will require access to the internet
   for it to complete.

Hoping that's useful: thanks, as ever, for LFS/BLFS/JHALFS.

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page