Bug
status() correctly reports a system CA store as not installed when the anchor file exists but the rebuilt trust bundle does not contain it. However, uninstall() treats that status as proof that nothing is present and returns before deleting the anchor file.
This leaves a dormant root certificate in the distribution's anchor directory after the user asked to remove it. A later package update or manual update-ca-certificates run can add that root back to the active bundle.
Reproduction
- Place moshpit-local-ca.crt in a recognized system anchor directory.
- Leave the generated bundle without that certificate (for example, the original refresh failed).
- Run uninstall.
- The command reports that the root was not present, but the anchor file remains.
Expected
For system CA stores, uninstall should remove an existing anchor file and rebuild the bundle even when the root is not currently active.
Reactions are currently unavailable
Bug
status() correctly reports a system CA store as not installed when the anchor file exists but the rebuilt trust bundle does not contain it. However, uninstall() treats that status as proof that nothing is present and returns before deleting the anchor file.
This leaves a dormant root certificate in the distribution's anchor directory after the user asked to remove it. A later package update or manual update-ca-certificates run can add that root back to the active bundle.
Reproduction
Expected
For system CA stores, uninstall should remove an existing anchor file and rebuild the bundle even when the root is not currently active.