bin/60916: certctl(8) doesn't gracefully handle deleting untrusted certs

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60916
>Category:       bin
>Synopsis:       certctl(8) doesn't gracefully handle deleting untrusted certs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 22 16:35:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10
>Organization:
Acme Certification Authority Kits LLC
>Environment:
>Description:

	Suppose the operator distrusts a CA certificate and codifies
	this by running

# certctl untrust /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem

	and then updates the system so that the certificate is deleted
	altogether.

	After this, certctl(8) will complain because there is an
	inconsistent configuration that _could_ mean something went
	wrong, e.g. a typo somewhere led to distrusting a nonexistent
	certificate when the operator meant to distrust an existing
	one:

# rm /usr/share/certs/mozilla/all/emSign_ECC_Root_CA_-_G3.pem
# certctl rehash
certctl: distrusted certificate not found: emSign_ECC_Root_CA_-_G3.pem

	Fortunately, it will fail safe in this scenario and leave the
	system with _everything_ distrusted:

# ls /etc/openssl/certs/ca-certificates.crt
ls: /etc/openssl/certs/ca-certificates.crt: No such file or directory

	However, that's not great either, because you get stuck without
	some kind of manual intervention!  There has to be some way for
	this transition path to work gracefully.

>How-To-Repeat:

	global fire drill of CA certificate removal, brought to you by
	the number 4

>Fix:

	Since `certctl untrust X' already verifies whether X exists,
	perhaps that's good enough:

# certctl untrust /usr/share/certs/mozilla/all/emSign_Root_CA_-_G1x.pem
certctl: no such certificate: /usr/share/certs/mozilla/all/emSign_Root_CA_-_G1x.pem

	So maybe we can just remove the `distrusted certificate not
	found' failure mode -- eliminate the warning (warning fatigue
	is bad and there's no documented user interface for updating
	the state to avoid the warning) and make certctl(8) succeed.

	That does leave dangling symlinks in /etc/openssl/untrusted
	indefinitely with no way to clean them up, but does it matter?