From ff75058b04ec63c6df1831dd9c938f7c9362fbc6 Mon Sep 17 00:00:00 2001
From: Matus Honek <mhonek@redhat.com>
Date: Dec 03 2019 13:35:10 +0000
Subject: Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt


Bug Description:
`NssSsl` always creates `README.txt` which describes the purpose of SSCA, even
when creating only an instance-specific certificate database.

Fix Description:
Create the README.txt only when creating cert DB for a specified DS instance.

Fixes https://pagure.io/389-ds-base/issue/50734

Author: Matus Honek <mhonek@redhat.com>

Review by: Mark, William (thanks!)

---

diff --git a/src/lib389/lib389/instance/setup.py b/src/lib389/lib389/instance/setup.py
index bb0ff32..073c7c7 100644
--- a/src/lib389/lib389/instance/setup.py
+++ b/src/lib389/lib389/instance/setup.py
@@ -822,7 +822,7 @@ class SetupDs(object):
         assert_c(ds_instance.exists(), "Instance failed to install, does not exist when expected")
 
         # Create a certificate database.
-        tlsdb = NssSsl(dbpath=slapd['cert_dir'])
+        tlsdb = NssSsl(dirsrv=ds_instance, dbpath=slapd['cert_dir'])
         if not tlsdb._db_exists():
             tlsdb.reinit()
 
diff --git a/src/lib389/lib389/nss_ssl.py b/src/lib389/lib389/nss_ssl.py
index 2a7d163..7c985d5 100644
--- a/src/lib389/lib389/nss_ssl.py
+++ b/src/lib389/lib389/nss_ssl.py
@@ -151,18 +151,19 @@ class NssSsl(object):
         except FileExistsError:
             pass
 
-        # Write a README to let people know what this is
-        readme_file = '%s/%s' % (self._certdb, 'README.txt')
-        if not os.path.exists(readme_file):
-            with open(readme_file, 'w') as f:
-                f.write("""
+        if self.dirsrv is None:
+            # Write a README to let people know what this is
+            readme_file = '%s/%s' % (self._certdb, 'README.txt')
+            if not os.path.exists(readme_file):
+                with open(readme_file, 'w') as f:
+                    f.write("""
 SSCA - Simple Self-Signed Certificate Authority
 
 This is part of the 389 Directory Server project's lib389 toolkit. It
 creates a simple, standalone certificate authority for testing and
 development purposes. It's suitable for evaluation and testing purposes
 only.
-                """)
+                    """)
 
         # In the future we may add the needed option to avoid writing the pin
         # files.