Add inst.cert boot option for CA certificates import. by rvykydal · Pull Request #7343 · rhinstaller/anaconda

rvykydal · 2026-10-09T10:03:59Z

Initiated by this user feature request (pull request): #7307
The option addresses some feature gaps in CA certificates import by installer:

import preceding kickstart download
import independent of kickstart modification

Resolves: INSTALLER-4927

Kickstart test: rhinstaller/kickstart-tests#1779

Add a new boot option inst.cert that imports a CA trust anchor
certificate from the installation medium or any other disk device
before kickstart or stage2 is fetched over HTTPS.

Supported formats:

  inst.cert=cdrom:/path/to/cert.pem
  inst.cert=hd:<dev>:/path/to/cert.pem

The certificate is:

trusted immediately in the installer environment
installed into the target system during installation

This is equivalent to using the kickstart %certificate section with --type anchor.

See the commit message for implementation details.

rvykydal · 2026-10-09T12:57:07Z

/build-image

github-actions · 2026-10-09T13:11:23Z

Images built based on commit 5b3760d:

boot.iso: failure

Download the images from the bottom of the job status page.

rvykydal · 2026-10-09T14:30:57Z

/build-image

github-actions · 2026-10-09T14:41:45Z

Images built based on commit 173c2fc:

boot.iso: success

Download the images from the bottom of the job status page.

rvykydal · 2026-10-12T11:56:06Z

/kickstart-test --kstest-pr 1779 certificates-inst-cert-curl

rvykydal · 2026-10-12T12:23:33Z

/kickstart-test --kstest-pr 1779 certificate-inst-cert-curl

rvykydal · 2026-10-12T12:50:52Z

/kickstart-test --kstest-pr 1779 certificate-inst-cert-curl

Passed: https://github.com/rhinstaller/anaconda/actions/runs/38248744030

Add a new boot option inst.cert= that imports a CA trust anchor certificate from the installation medium or any other disk device before kickstart or stage2 is fetched over HTTPS. Supported formats: inst.cert=cdrom:/path/to/cert.pem inst.cert=hd:<dev>:/path/to/cert.pem The certificate source device is mounted independently (not relying on /run/install/repo) using udev rules that trigger when the block device appears, similar to how inst.dd= works. The certificate is: - trusted immediately in the installer environment - installed into the target system during installation This is equivalent to using the kickstart %certificate section with --type anchor. To ensure certificates are imported before any HTTPS fetches, the initqueue job is named "01-anaconda-cert" so it sorts before "99-nm-run.sh" in the settled hook directory. This required adding an explicit job name parameter to when_diskdev_appears and when_any_cdrom_appears in anaconda-lib.sh (all existing callers updated to preserve their current behavior). After switchroot, certificates staged at /run/install/certificates/ are collected into CertificatesModule so they are installed to the target system alongside any kickstart %certificate entries. New dracut files: parse-anaconda-cert.sh - cmdline hook (priority 24) parsing inst.cert= cert-genrules.sh - pre-trigger hook generating udev rules anaconda-fetch-cert - mounts device and imports certificate(s) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Resolves: INSTALLER-4927

The test_find_rw_mounts test strips log messages before checking for non-read-only mount commands, but the log regex only matched info, warn, and error. The warn_critical function used in anaconda-fetch-cert was not matched, causing the test to flag "failed to mount" in the log message as a non-read-only mount command. Broaden the regex to match warn and any warn_* variants. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Related: INSTALLER-4927

Related: INSTALLER-4927

rvykydal · 2026-10-12T14:12:08Z

/kickstart-test --kstest-pr 1779 certificate-inst-cert-curl

rvykydal · 2026-10-12T14:31:58Z

/kickstart-test --testtype smoke

rvykydal · 2026-10-12T14:32:10Z

/kickstart-test --kstest-pr 1779 certificate-inst-cert-curl

https://github.com/rhinstaller/anaconda/actions/runs/38261187961

rvykydal · 2026-10-13T07:05:08Z

/kickstart-test --testtype smoke

lzap · 2026-10-13T09:48:04Z

I can confirm that this is sufficient, actually better, than what I asked for. Thanks for looking in into this.

I am aiming for fully encrypted TLS provisioning workflow via ISO media:

User creates a modified netboot.iso with Satellite certificate using this new feature
A system is booted via removable media (physically or virtually using BMC)
Kickstart is downloaded over HTTPS with TLS server CA validation on
The kickstart contains repository HTTPS URL (Satellite uses the same certificate)
Satellite does not enforce client certificates for kickstart repos so the installation proceeds

A logical extension would be support for client certificates, but at this point I think this is a good enough start and we do not have a hard requirement from the customer for client certs at this point. May I assume that as long as the OS supports PQC, this will also accept PQC certificates?

rvykydal · 2026-10-13T11:21:48Z

...May I assume that as long as the OS supports PQC, this will also accept PQC certificates?

I am not sure, it depends on the OS mechanism for PQC certificates import. Currently, in initramfs we just append the certificate to the bundle (don't run any tool) so there might be some update needed (like adding the tool to the intiramfs). We haven't scoped adding import tool to the initramfs yet.
After switchroot, and for installed system, we use the trust tool.

github-actions Bot added the f46 label Oct 9, 2026

rvykydal deployed to gh-cockpituous October 9, 2026 10:04 — with GitHub Actions Active

rvykydal force-pushed the inst-cert branch from 556e940 to 5b3760d Compare October 9, 2026 11:00

rvykydal deployed to gh-cockpituous October 9, 2026 11:00 — with GitHub Actions Active

rvykydal changed the title ~~Inst cert~~ Add inst.cert boot option for CA certificates import. Oct 9, 2026

rvykydal force-pushed the inst-cert branch from 5b3760d to 173c2fc Compare October 9, 2026 14:30

rvykydal deployed to gh-cockpituous October 9, 2026 14:30 — with GitHub Actions Active

rvykydal force-pushed the inst-cert branch from 173c2fc to a5cb89e Compare October 12, 2026 11:08

rvykydal deployed to gh-cockpituous October 12, 2026 11:09 — with GitHub Actions Active

rvykydal deployed to gh-cockpituous October 12, 2026 11:29 — with GitHub Actions Active

rvykydal force-pushed the inst-cert branch from 6bfe1a7 to 6d4d670 Compare October 12, 2026 11:34

rvykydal deployed to gh-cockpituous October 12, 2026 11:34 — with GitHub Actions Active

rvykydal force-pushed the inst-cert branch from 6d4d670 to c18ff07 Compare October 12, 2026 11:52

rvykydal deployed to gh-cockpituous October 12, 2026 11:52 — with GitHub Actions Active

rvykydal mentioned this pull request Oct 12, 2026

dracut: add CA certificates from installation media #7307

Closed

3 of 5 tasks

rvykydal added 3 commits October 12, 2026 16:11

docs: add release note for inst.cert boot option

799304b

Related: INSTALLER-4927

rvykydal force-pushed the inst-cert branch from c18ff07 to 799304b Compare October 12, 2026 14:11

rvykydal deployed to gh-cockpituous October 12, 2026 14:12 — with GitHub Actions Active

rvykydal marked this pull request as ready for review October 13, 2026 07:32

rvykydal requested review from KKoukiou, M4rtinK, bookwar, bruno-fs, jikortus and jstodola and removed request for KKoukiou October 13, 2026 07:32

rvykydal mentioned this pull request Oct 13, 2026

Add kickstart test for inst.cert boot option rhinstaller/kickstart-tests#1779

Open

KKoukiou approved these changes Oct 19, 2026

View reviewed changes

tomasfratrik self-requested a review October 20, 2026 07:44

Navigation Menu

Repository navigation

Add inst.cert boot option for CA certificates import. - #7343

Add inst.cert boot option for CA certificates import.#7343
rvykydal wants to merge 3 commits into
rhinstaller:mainfrom
rvykydal:inst-cert

rvykydal commented Oct 9, 2026 •

edited

Loading

Uh oh!

rvykydal commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

rvykydal commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 13, 2026

Uh oh!

lzap commented Oct 13, 2026

Uh oh!

rvykydal commented Oct 13, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

rvykydal commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rvykydal commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

rvykydal commented Oct 9, 2026

Uh oh!

github-actions Bot commented Oct 9, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 12, 2026

Uh oh!

rvykydal commented Oct 13, 2026

Uh oh!

lzap commented Oct 13, 2026

Uh oh!

rvykydal commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

rvykydal commented Oct 9, 2026 •

edited

Loading

rvykydal commented Oct 13, 2026 •

edited

Loading