transport: resolve import TLS paths against base_path - #81
Merged
doanac merged 1 commit intoAug 13, 2026
Conversation
There was a problem hiding this comment.
Pull request overview
Fixes TLS certificate/key file resolution when [import] paths are configured as relative values by resolving them against import.base_path, aligning fioconfig behavior with other [import] consumers.
Changes:
- Add
importPathhelper to join relative[import]paths ontoimport.base_path(pass through absolute paths unchanged). - Use
importPathforimport.tls_cacert_path,import.tls_clientcert_path, andimport.tls_pkey_pathbefore reading/loading TLS material.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The TLS bootstrap in transport.GetTlsConfig + loadCertLocal read import.tls_cacert_path, import.tls_clientcert_path, and import.tls_pkey_path with raw cfg.Get calls. The returned values were then passed straight to os.ReadFile / tls.LoadX509KeyPair, so relative entries like [import] base_path = "/var/sota/import" tls_clientcert_path = "client.pem" tls_pkey_path = "pkey.pem" tls_cacert_path = "root.crt" resolved to bare filenames in the process CWD instead of under base_path. The file lookup failed, fioconfig logged a generic "no such file" error from libcurl/Go, and the device aborted before reaching the config decryption path. Add a small importPath helper that joins relative values onto import.base_path (and passes absolute values through unchanged), matching how every other [import] consumer behaves (lmp-device-register, aktualizr-lite, aktualizr). No change for users who already supply absolute paths. Tests: new transport/tls_test.go covers the helper directly + exercises GetTlsConfig with a relative [import] layout and a chdir away from the cert files. The integration test fails on either branch of the bug (raw cfg.Get or a helper that drops the base) and passes only with the full fix. Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
EmbeddedAndroid
force-pushed
the
fix-tls-import-base-path
branch
from
May 22, 2026 18:14
6ac2f89 to
9f937bd
Compare
Contributor
Author
|
Related to: foundriesio/aktualizr-lite#463 |
doanac
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The TLS bootstrap in transport.GetTlsConfig + loadCertLocal read import.tls_cacert_path, import.tls_clientcert_path, and import.tls_pkey_path with raw cfg.Get calls. The returned values were then passed straight to os.ReadFile / tls.LoadX509KeyPair, so relative entries like
[import]
base_path = "/var/sota/import"
tls_clientcert_path = "client.pem"
tls_pkey_path = "pkey.pem"
tls_cacert_path = "root.crt"
resolved to bare filenames in the process CWD instead of under base_path. The file lookup failed, fioconfig logged a generic "no such file" error from libcurl/Go, and the device aborted before reaching the config decryption path.
Add a small importPath helper that joins relative values onto import.base_path (and passes absolute values through unchanged), matching how every other [import] consumer behaves (lmp-device-register, aktualizr-lite, aktualizr).
No change for users who already supply absolute paths.