ca-certificates: guard bbappend with virtualization DISTRO_FEATURESHEADmaster

The unconditional bbappend to ca-certificates breaks yocto-check-layer
compatibility when the layer is included without 'virtualization' in
DISTRO_FEATURES. Guard both the SRC_URI additions and the do_install
append with a bb.utils.contains check, matching the pattern used by
other bbappends in the layer (busybox, qemu, etc.).

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 7 insertions, 5 deletions

diff --git a/recipes-support/ca-certificates/ca-certificates_%.bbappend b/recipes-support/ca-certificates/ca-certificates_%.bbappend
index 4f276522..e659f1ed 100644
--- a/recipes-support/ca-certificates/ca-certificates_%.bbappend
+++ b/recipes-support/ca-certificates/ca-certificates_%.bbappend
@@ -1,5 +1,7 @@
 # Install Let's Encrypt intermediate certificates (E8/ECDSA, R11/RSA).
 #
+# Only active when 'virtualization' is in DISTRO_FEATURES.
+#
 # Some container registries (e.g., registry.yocto.io) don't send the
 # full certificate chain. Go's TLS library (used by Docker, skopeo,
 # podman) cannot verify the server certificate without the intermediate,
@@ -11,17 +13,17 @@
 #
 # Source: https://letsencrypt.org/certificates/
 
-SRC_URI += " \
-    https://letsencrypt.org/certs/2024/e8.pem;name=le-e8;unpack=0 \
-    https://letsencrypt.org/certs/2024/r11.pem;name=le-r11;unpack=0 \
-"
+SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'virtualization', \
+    'https://letsencrypt.org/certs/2024/e8.pem;name=le-e8;unpack=0 \
+     https://letsencrypt.org/certs/2024/r11.pem;name=le-r11;unpack=0', \
+    '', d)}"
 SRC_URI[le-e8.sha256sum] = "f2c0dde62e2c90e6332fa55af79ed1a0c41329ad03ecf812bd89817a2fc340a9"
 SRC_URI[le-r11.sha256sum] = "6c06a45850f93aa6e31f9388f956379d8b4fb7ffca5211b9bab4ad159bdfb7b9"
 
 do_install:append () {
-    install -d ${D}${datadir}/ca-certificates/letsencrypt
     for pem in ${UNPACKDIR}/e8.pem ${UNPACKDIR}/r11.pem; do
         if [ -f "$pem" ]; then
+            install -d ${D}${datadir}/ca-certificates/letsencrypt
             # ca-certificates expects .crt extension
             base=$(basename "$pem" .pem)
             install -m 0644 "$pem" ${D}${datadir}/ca-certificates/letsencrypt/lets-encrypt-${base}.crt