#60110 – Добавить сертификат в /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem

Bug 60110 - Добавить сертификат в /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem

Summary: Добавить сертификат в /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem

Status:	NEW

Alias:	None

Product:	Sisyphus
Classification:	Development
Component:	ca-trust (show other bugs)
Version:	unstable
Hardware:	x86_64 Linux

Importance:	P5 normal
Assignee:	Mikhail Efremov
QA Contact:	qa-sisyphus

URL:
Keywords:

Depends on:
Blocks:

Reported:	2026-08-06 17:15 MSK by Белаш Константин
Modified:	2026-08-06 17:15 MSK (History)
CC List:	2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description

Белаш Константин 2026-08-06 17:15:34 MSK

При выполнении команды dotnet restore возникает ошибка:
.../_build.csproj : error NU3018: Package 'Microsoft.CodeAnalysis.CSharp 3.8.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's signing certificate is not trusted by the trust provider.
.../_build.csproj : warning NU3042:
  Package 'Microsoft.CodeAnalysis.CSharp 3.8.0' from source 'https://api.nuget.org/v3/index.json': The following X.509 root certificate is untrusted because it is not present in the certificate bundle at /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
.  For more information, see documentation for NU3042.
      Subject:  CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
      Fingerprint (SHA-256):  3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C
      Certificate (PEM):
  -----BEGIN CERTIFICATE-----
  MIIDtzCCAp+gAwIBAgIQDOfg5RfYRv6P5WD8G/AwOTANBgkqhkiG9w0BAQUFADBl
...
  +o0bJW1sj6W3YQGx0qMmoRBxna3iw/nDmVG3KwcIzi7mULKn+gpFL6Lw8g==
  -----END CERTIFICATE-----

Нужный сертификат с указанным отпечатком находится в /usr/share/pki/ca-trust-source/anchors/ca-certificates-nuget.org.pem (пакет ca-certificates-nuget.org). После установки пакета ca-certificates-nuget.org и выполнения update-ca-trust сертификат не попадает в /etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem.

В переписке на https://lore.altlinux.org/devel/20240408192303.20da765a@sem-nb2/t.atom говорится о ручном добавлении. Если требуется ручное добавление, то каким способом это корректно сделать?