Don't rely on order in trust agent/controller role check

Resolves: RHEL-99554

0012-IPAOpenSSLChainValidation-ignore-default-trust-store.patch

@@ -0,0 +1,39 @@
+From 8af886c515c2e3bc8a2233202c275f6ca9c87b3b Mon Sep 17 00:00:00 2001
+From: Florence Blanc-Renaud <flo@redhat.com>
+Date: Wed, 9 Oct 2024 16:02:28 +0200
+Subject: [PATCH] IPAOpenSSLChainValidation: ignore default trust store
+
+The check IPAOpenSSLChainValidation is ensuring that the
+whole certification chain is present in IPA for httpd and RA
+certificates.
+It internally calls openssl verify -CAfile /etc/ipa/ca.crt.
+
+With the latest version of ca-certificates package shipped in
+rawhide/Fedora 42, openssl verify also uses the default trust
+store. Since the test wants to check the chain presence in
+/etc/ipa/ca.crt, add the -no-CAfile -no-CApath and -no-CAstore
+options to ensure that only /etc/ipa/ca.crt is used as trusted
+source.
+
+Fixes: https://github.com/freeipa/freeipa-healthcheck/issues/340
+
+Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
+---
+ src/ipahealthcheck/ipa/certs.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/ipahealthcheck/ipa/certs.py b/src/ipahealthcheck/ipa/certs.py
+index b73d63c..0b7a995 100644
+--- a/src/ipahealthcheck/ipa/certs.py
++++ b/src/ipahealthcheck/ipa/certs.py
+@@ -1074,6 +1074,7 @@ class IPAOpenSSLChainValidation(IPAPlugin):
+                 '-verbose',
+                 '-show_chain',
+                 '-CAfile', paths.IPA_CA_CRT,
++                '-no-CAfile', '-no-CApath', '-no-CAstore',
+                 file]
+ 
+         return ipautil.run(args, raiseonerr=False)
+-- 
+2.49.0
+

freeipa-healthcheck.spec

@@ -17,7 +17,7 @@
 
 Name:           %{prefix}-healthcheck
 Version:        0.16
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        Health check tool for %{productname}
 BuildArch:      noarch
 License:        GPLv3
@@ -36,6 +36,7 @@ Patch0008:      0008-Allow-WARNING-in-the-files-test.patch
 Patch0009:      0009-Check-user-provided-certificates-for-expiration.patch 
 Patch0010:      0010-Warn-if-krbLastSuccessfulAuth-replication-is-enabled.patch
 Patch0011:      0011-Warn-about-unexpected-umask.patch 
+Patch0012:      0012-IPAOpenSSLChainValidation-ignore-default-trust-store.patch 
 
 Requires:       %{name}-core = %{version}-%{release}
 Requires:       %{prefix}-server
@@ -165,6 +166,9 @@ PYTHONPATH=src PATH=$PATH:$RPM_BUILD_ROOT/usr/bin pytest-3 tests/test_*
 
 
 %changelog
+* Thu Jun 26 2025 Rob Crittenden <rcritten@redhat.com> - 0.16-8
+- Don't rely on order in trust agent/controller role check (RHEL-99554)
+
 * Tue May 27 2025 Rob Crittenden <rcritten@redhat.com> - 0.16-7
 - Warn in ipa-healthcheck if umask is not 022 (RHEL-67901)