cc_ca_certs: add RHEL support (#633)

This refactors cc_ca_certs to support non-ca-certificates distros, and
adds RHEL support.

3 files changed, 267 insertions, 149 deletions

diff --git a/cloudinit/config/cc_ca_certs.py b/cloudinit/config/cc_ca_certs.py
index 3c453d91..bd7bead9 100644
--- a/cloudinit/config/cc_ca_certs.py
+++ b/cloudinit/config/cc_ca_certs.py
@@ -25,7 +25,7 @@ can be removed from the system with the configuration option
 
 **Module frequency:** per instance
 
-**Supported distros:** alpine, debian, ubuntu
+**Supported distros:** alpine, debian, ubuntu, rhel
 
 **Config keys**::
 
@@ -44,60 +44,104 @@ import os
 from cloudinit import subp
 from cloudinit import util
 
-CA_CERT_PATH = "/usr/share/ca-certificates/"
-CA_CERT_FILENAME = "cloud-init-ca-certs.crt"
-CA_CERT_CONFIG = "/etc/ca-certificates.conf"
-CA_CERT_SYSTEM_PATH = "/etc/ssl/certs/"
-CA_CERT_FULL_PATH = os.path.join(CA_CERT_PATH, CA_CERT_FILENAME)
+DEFAULT_CONFIG = {
+    'ca_cert_path': '/usr/share/ca-certificates/',
+    'ca_cert_filename': 'cloud-init-ca-certs.crt',
+    'ca_cert_config': '/etc/ca-certificates.conf',
+    'ca_cert_system_path': '/etc/ssl/certs/',
+    'ca_cert_update_cmd': ['update-ca-certificates']
+}
+DISTRO_OVERRIDES = {
+    'rhel': {
+        'ca_cert_path': '/usr/share/pki/ca-trust-source/',
+        'ca_cert_filename': 'anchors/cloud-init-ca-certs.crt',
+        'ca_cert_config': None,
+        'ca_cert_system_path': '/etc/pki/ca-trust/',
+        'ca_cert_update_cmd': ['update-ca-trust']
+    }
+}
 
-distros = ['alpine', 'debian', 'ubuntu']
 
+distros = ['alpine', 'debian', 'ubuntu', 'rhel']
 
-def update_ca_certs():
+
+def _distro_ca_certs_configs(distro_name):
+    """Return a distro-specific ca_certs config dictionary
+
+    @param distro_name: String providing the distro class name.
+    @returns: Dict of distro configurations for ca-cert.
+    """
+    cfg = DISTRO_OVERRIDES.get(distro_name, DEFAULT_CONFIG)
+    cfg['ca_cert_full_path'] = os.path.join(cfg['ca_cert_path'],
+                                            cfg['ca_cert_filename'])
+    return cfg
+
+
+def update_ca_certs(distro_cfg):
     """
     Updates the CA certificate cache on the current machine.
+
+    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
     """
-    subp.subp(["update-ca-certificates"], capture=False)
+    subp.subp(distro_cfg['ca_cert_update_cmd'], capture=False)
 
 
-def add_ca_certs(certs):
+def add_ca_certs(distro_cfg, certs):
     """
     Adds certificates to the system. To actually apply the new certificates
     you must also call L{update_ca_certs}.
 
+    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
     @param certs: A list of certificate strings.
     """
-    if certs:
-        # First ensure they are strings...
-        cert_file_contents = "\n".join([str(c) for c in certs])
-        util.write_file(CA_CERT_FULL_PATH, cert_file_contents, mode=0o644)
-
-        if os.stat(CA_CERT_CONFIG).st_size == 0:
-            # If the CA_CERT_CONFIG file is empty (i.e. all existing
-            # CA certs have been deleted) then simply output a single
-            # line with the cloud-init cert filename.
-            out = "%s\n" % CA_CERT_FILENAME
-        else:
-            # Append cert filename to CA_CERT_CONFIG file.
-            # We have to strip the content because blank lines in the file
-            # causes subsequent entries to be ignored. (LP: #1077020)
-            orig = util.load_file(CA_CERT_CONFIG)
-            cur_cont = '\n'.join([line for line in orig.splitlines()
-                                  if line != CA_CERT_FILENAME])
-            out = "%s\n%s\n" % (cur_cont.rstrip(), CA_CERT_FILENAME)
-        util.write_file(CA_CERT_CONFIG, out, omode="wb")
-
-
-def remove_default_ca_certs(distro_name):
+    if not certs:
+        return
+    # First ensure they are strings...
+    cert_file_contents = "\n".join([str(c) for c in certs])
+    util.write_file(distro_cfg['ca_cert_full_path'],
+                    cert_file_contents,
+                    mode=0o644)
+    update_cert_config(distro_cfg)
+
+
+def update_cert_config(distro_cfg):
+    """
+    Update Certificate config file to add the file path managed cloud-init
+
+    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
+    """
+    if distro_cfg['ca_cert_config'] is None:
+        return
+    if os.stat(distro_cfg['ca_cert_config']).st_size == 0:
+        # If the CA_CERT_CONFIG file is empty (i.e. all existing
+        # CA certs have been deleted) then simply output a single
+        # line with the cloud-init cert filename.
+        out = "%s\n" % distro_cfg['ca_cert_filename']
+    else:
+        # Append cert filename to CA_CERT_CONFIG file.
+        # We have to strip the content because blank lines in the file
+        # causes subsequent entries to be ignored. (LP: #1077020)
+        orig = util.load_file(distro_cfg['ca_cert_config'])
+        cr_cont = '\n'.join([line for line in orig.splitlines()
+                            if line != distro_cfg['ca_cert_filename']])
+        out = "%s\n%s\n" % (cr_cont.rstrip(),
+                            distro_cfg['ca_cert_filename'])
+    util.write_file(distro_cfg['ca_cert_config'], out, omode="wb")
+
+
+def remove_default_ca_certs(distro_name, distro_cfg):
     """
     Removes all default trusted CA certificates from the system. To actually
     apply the change you must also call L{update_ca_certs}.
+
+    @param distro_name: String providing the distro class name.
+    @param distro_cfg: A hash providing _distro_ca_certs_configs function.
     """
-    util.delete_dir_contents(CA_CERT_PATH)
-    util.delete_dir_contents(CA_CERT_SYSTEM_PATH)
-    util.write_file(CA_CERT_CONFIG, "", mode=0o644)
+    util.delete_dir_contents(distro_cfg['ca_cert_path'])
+    util.delete_dir_contents(distro_cfg['ca_cert_system_path'])
+    util.write_file(distro_cfg['ca_cert_config'], "", mode=0o644)
 
-    if distro_name != 'alpine':
+    if distro_name in ['debian', 'ubuntu']:
         debconf_sel = (
             "ca-certificates ca-certificates/trust_new_crts " + "select no")
         subp.subp(('debconf-set-selections', '-'), debconf_sel)
@@ -120,22 +164,23 @@ def handle(name, cfg, cloud, log, _args):
         return
 
     ca_cert_cfg = cfg['ca-certs']
+    distro_cfg = _distro_ca_certs_configs(cloud.distro.name)
 
     # If there is a remove-defaults option set to true, remove the system
     # default trusted CA certs first.
     if ca_cert_cfg.get("remove-defaults", False):
         log.debug("Removing default certificates")
-        remove_default_ca_certs(cloud.distro.name)
+        remove_default_ca_certs(cloud.distro.name, distro_cfg)
 
     # If we are given any new trusted CA certs to add, add them.
     if "trusted" in ca_cert_cfg:
         trusted_certs = util.get_cfg_option_list(ca_cert_cfg, "trusted")
         if trusted_certs:
             log.debug("Adding %d certificates" % len(trusted_certs))
-            add_ca_certs(trusted_certs)
+            add_ca_certs(distro_cfg, trusted_certs)
 
     # Update the system with the new cert configuration.
     log.debug("Updating certificates")
-    update_ca_certs()
+    update_ca_certs(distro_cfg)
 
 # vi: ts=4 expandtab
diff --git a/tests/unittests/test_handler/test_handler_ca_certs.py b/tests/unittests/test_handler/test_handler_ca_certs.py
index a16430d5..6e3831ed 100644
--- a/tests/unittests/test_handler/test_handler_ca_certs.py
+++ b/tests/unittests/test_handler/test_handler_ca_certs.py
@@ -47,12 +47,20 @@ class TestConfig(TestCase):
     def setUp(self):
         super(TestConfig, self).setUp()
         self.name = "ca-certs"
-        distro = self._fetch_distro('ubuntu')
         self.paths = None
-        self.cloud = cloud.Cloud(None, self.paths, None, distro, None)
         self.log = logging.getLogger("TestNoConfig")
         self.args = []
 
+    def _fetch_distro(self, kind):
+        cls = distros.fetch(kind)
+        paths = helpers.Paths({})
+        return cls(kind, {}, paths)
+
+    def _get_cloud(self, kind):
+        distro = self._fetch_distro(kind)
+        return cloud.Cloud(None, self.paths, None, distro, None)
+
+    def _mock_init(self):
         self.mocks = ExitStack()
         self.addCleanup(self.mocks.close)
 
@@ -64,11 +72,6 @@ class TestConfig(TestCase):
         self.mock_remove = self.mocks.enter_context(
             mock.patch.object(cc_ca_certs, 'remove_default_ca_certs'))
 
-    def _fetch_distro(self, kind):
-        cls = distros.fetch(kind)
-        paths = helpers.Paths({})
-        return cls(kind, {}, paths)
-
     def test_no_trusted_list(self):
         """
         Test that no certificates are written if the 'trusted' key is not
@@ -76,71 +79,95 @@ class TestConfig(TestCase):
         """
         config = {"ca-certs": {}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.assertEqual(self.mock_add.call_count, 0)
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 0)
+            self.assertEqual(self.mock_add.call_count, 0)
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 0)
 
     def test_empty_trusted_list(self):
         """Test that no certificate are written if 'trusted' list is empty."""
         config = {"ca-certs": {"trusted": []}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.assertEqual(self.mock_add.call_count, 0)
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 0)
+            self.assertEqual(self.mock_add.call_count, 0)
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 0)
 
     def test_single_trusted(self):
         """Test that a single cert gets passed to add_ca_certs."""
         config = {"ca-certs": {"trusted": ["CERT1"]}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.mock_add.assert_called_once_with(['CERT1'])
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 0)
+            self.mock_add.assert_called_once_with(conf, ['CERT1'])
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 0)
 
     def test_multiple_trusted(self):
         """Test that multiple certs get passed to add_ca_certs."""
         config = {"ca-certs": {"trusted": ["CERT1", "CERT2"]}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.mock_add.assert_called_once_with(['CERT1', 'CERT2'])
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 0)
+            self.mock_add.assert_called_once_with(conf, ['CERT1', 'CERT2'])
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 0)
 
     def test_remove_default_ca_certs(self):
         """Test remove_defaults works as expected."""
         config = {"ca-certs": {"remove-defaults": True}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.assertEqual(self.mock_add.call_count, 0)
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 1)
+            self.assertEqual(self.mock_add.call_count, 0)
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 1)
 
     def test_no_remove_defaults_if_false(self):
         """Test remove_defaults is not called when config value is False."""
         config = {"ca-certs": {"remove-defaults": False}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.assertEqual(self.mock_add.call_count, 0)
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 0)
+            self.assertEqual(self.mock_add.call_count, 0)
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 0)
 
     def test_correct_order_for_remove_then_add(self):
         """Test remove_defaults is not called when config value is False."""
         config = {"ca-certs": {"remove-defaults": True, "trusted": ["CERT1"]}}
 
-        cc_ca_certs.handle(self.name, config, self.cloud, self.log, self.args)
+        for distro_name in cc_ca_certs.distros:
+            self._mock_init()
+            cloud = self._get_cloud(distro_name)
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+            cc_ca_certs.handle(self.name, config, cloud, self.log, self.args)
 
-        self.mock_add.assert_called_once_with(['CERT1'])
-        self.assertEqual(self.mock_update.call_count, 1)
-        self.assertEqual(self.mock_remove.call_count, 1)
+            self.mock_add.assert_called_once_with(conf, ['CERT1'])
+            self.assertEqual(self.mock_update.call_count, 1)
+            self.assertEqual(self.mock_remove.call_count, 1)
 
 
 class TestAddCaCerts(TestCase):
@@ -154,11 +181,18 @@ class TestAddCaCerts(TestCase):
         })
         self.add_patch("cloudinit.config.cc_ca_certs.os.stat", "m_stat")
 
+    def _fetch_distro(self, kind):
+        cls = distros.fetch(kind)
+        paths = helpers.Paths({})
+        return cls(kind, {}, paths)
+
     def test_no_certs_in_list(self):
         """Test that no certificate are written if not provided."""
-        with mock.patch.object(util, 'write_file') as mockobj:
-            cc_ca_certs.add_ca_certs([])
-        self.assertEqual(mockobj.call_count, 0)
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+            with mock.patch.object(util, 'write_file') as mockobj:
+                cc_ca_certs.add_ca_certs(conf, [])
+            self.assertEqual(mockobj.call_count, 0)
 
     def test_single_cert_trailing_cr(self):
         """Test adding a single certificate to the trusted CAs
@@ -168,20 +202,28 @@ class TestAddCaCerts(TestCase):
         ca_certs_content = "line1\nline2\ncloud-init-ca-certs.crt\nline3\n"
         expected = "line1\nline2\nline3\ncloud-init-ca-certs.crt\n"
 
-        with ExitStack() as mocks:
-            mock_write = mocks.enter_context(
-                mock.patch.object(util, 'write_file'))
-            mock_load = mocks.enter_context(
-                mock.patch.object(util, 'load_file',
-                                  return_value=ca_certs_content))
+        self.m_stat.return_value.st_size = 1
 
-            cc_ca_certs.add_ca_certs([cert])
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
 
-            mock_write.assert_has_calls([
-                mock.call("/usr/share/ca-certificates/cloud-init-ca-certs.crt",
-                          cert, mode=0o644),
-                mock.call("/etc/ca-certificates.conf", expected, omode="wb")])
-            mock_load.assert_called_once_with("/etc/ca-certificates.conf")
+            with ExitStack() as mocks:
+                mock_write = mocks.enter_context(
+                    mock.patch.object(util, 'write_file'))
+                mock_load = mocks.enter_context(
+                    mock.patch.object(util, 'load_file',
+                                      return_value=ca_certs_content))
+
+                cc_ca_certs.add_ca_certs(conf, [cert])
+
+                mock_write.assert_has_calls([
+                    mock.call(conf['ca_cert_full_path'],
+                              cert, mode=0o644)])
+                if conf['ca_cert_config'] is not None:
+                    mock_write.assert_has_calls([
+                        mock.call(conf['ca_cert_config'],
+                                  expected, omode="wb")])
+                    mock_load.assert_called_once_with(conf['ca_cert_config'])
 
     def test_single_cert_no_trailing_cr(self):
         """Test adding a single certificate to the trusted CAs
@@ -190,24 +232,31 @@ class TestAddCaCerts(TestCase):
 
         ca_certs_content = "line1\nline2\nline3"
 
-        with ExitStack() as mocks:
-            mock_write = mocks.enter_context(
-                mock.patch.object(util, 'write_file'))
-            mock_load = mocks.enter_context(
-                mock.patch.object(util, 'load_file',
-                                  return_value=ca_certs_content))
+        self.m_stat.return_value.st_size = 1
+
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
 
-            cc_ca_certs.add_ca_certs([cert])
+            with ExitStack() as mocks:
+                mock_write = mocks.enter_context(
+                    mock.patch.object(util, 'write_file'))
+                mock_load = mocks.enter_context(
+                    mock.patch.object(util, 'load_file',
+                                      return_value=ca_certs_content))
 
-            mock_write.assert_has_calls([
-                mock.call("/usr/share/ca-certificates/cloud-init-ca-certs.crt",
-                          cert, mode=0o644),
-                mock.call("/etc/ca-certificates.conf",
-                          "%s\n%s\n" % (ca_certs_content,
-                                        "cloud-init-ca-certs.crt"),
-                          omode="wb")])
+                cc_ca_certs.add_ca_certs(conf, [cert])
 
-            mock_load.assert_called_once_with("/etc/ca-certificates.conf")
+                mock_write.assert_has_calls([
+                    mock.call(conf['ca_cert_full_path'],
+                              cert, mode=0o644)])
+                if conf['ca_cert_config'] is not None:
+                    mock_write.assert_has_calls([
+                        mock.call(conf['ca_cert_config'],
+                                  "%s\n%s\n" % (ca_certs_content,
+                                                conf['ca_cert_filename']),
+                                  omode="wb")])
+
+                    mock_load.assert_called_once_with(conf['ca_cert_config'])
 
     def test_single_cert_to_empty_existing_ca_file(self):
         """Test adding a single certificate to the trusted CAs
@@ -216,15 +265,22 @@ class TestAddCaCerts(TestCase):
 
         expected = "cloud-init-ca-certs.crt\n"
 
-        with mock.patch.object(util, 'write_file', autospec=True) as m_write:
-            self.m_stat.return_value.st_size = 0
+        self.m_stat.return_value.st_size = 0
+
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+            with mock.patch.object(util, 'write_file',
+                                   autospec=True) as m_write:
 
-            cc_ca_certs.add_ca_certs([cert])
+                cc_ca_certs.add_ca_certs(conf, [cert])
 
-            m_write.assert_has_calls([
-                mock.call("/usr/share/ca-certificates/cloud-init-ca-certs.crt",
-                          cert, mode=0o644),
-                mock.call("/etc/ca-certificates.conf", expected, omode="wb")])
+                m_write.assert_has_calls([
+                    mock.call(conf['ca_cert_full_path'],
+                              cert, mode=0o644)])
+                if conf['ca_cert_config'] is not None:
+                    m_write.assert_has_calls([
+                        mock.call(conf['ca_cert_config'],
+                                  expected, omode="wb")])
 
     def test_multiple_certs(self):
         """Test adding multiple certificates to the trusted CAs."""
@@ -232,32 +288,41 @@ class TestAddCaCerts(TestCase):
         expected_cert_file = "\n".join(certs)
         ca_certs_content = "line1\nline2\nline3"
 
-        with ExitStack() as mocks:
-            mock_write = mocks.enter_context(
-                mock.patch.object(util, 'write_file'))
-            mock_load = mocks.enter_context(
-                mock.patch.object(util, 'load_file',
-                                  return_value=ca_certs_content))
+        self.m_stat.return_value.st_size = 1
 
-            cc_ca_certs.add_ca_certs(certs)
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
 
-            mock_write.assert_has_calls([
-                mock.call("/usr/share/ca-certificates/cloud-init-ca-certs.crt",
-                          expected_cert_file, mode=0o644),
-                mock.call("/etc/ca-certificates.conf",
-                          "%s\n%s\n" % (ca_certs_content,
-                                        "cloud-init-ca-certs.crt"),
-                          omode='wb')])
+            with ExitStack() as mocks:
+                mock_write = mocks.enter_context(
+                    mock.patch.object(util, 'write_file'))
+                mock_load = mocks.enter_context(
+                    mock.patch.object(util, 'load_file',
+                                      return_value=ca_certs_content))
 
-            mock_load.assert_called_once_with("/etc/ca-certificates.conf")
+                cc_ca_certs.add_ca_certs(conf, certs)
+
+                mock_write.assert_has_calls([
+                    mock.call(conf['ca_cert_full_path'],
+                              expected_cert_file, mode=0o644)])
+                if conf['ca_cert_config'] is not None:
+                    mock_write.assert_has_calls([
+                        mock.call(conf['ca_cert_config'],
+                                  "%s\n%s\n" % (ca_certs_content,
+                                                conf['ca_cert_filename']),
+                                  omode='wb')])
+
+                    mock_load.assert_called_once_with(conf['ca_cert_config'])
 
 
 class TestUpdateCaCerts(unittest.TestCase):
     def test_commands(self):
-        with mock.patch.object(subp, 'subp') as mockobj:
-            cc_ca_certs.update_ca_certs()
-            mockobj.assert_called_once_with(
-                ["update-ca-certificates"], capture=False)
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+            with mock.patch.object(subp, 'subp') as mockobj:
+                cc_ca_certs.update_ca_certs(conf)
+                mockobj.assert_called_once_with(
+                    conf['ca_cert_update_cmd'], capture=False)
 
 
 class TestRemoveDefaultCaCerts(TestCase):
@@ -271,24 +336,31 @@ class TestRemoveDefaultCaCerts(TestCase):
         })
 
     def test_commands(self):
-        with ExitStack() as mocks:
-            mock_delete = mocks.enter_context(
-                mock.patch.object(util, 'delete_dir_contents'))
-            mock_write = mocks.enter_context(
-                mock.patch.object(util, 'write_file'))
-            mock_subp = mocks.enter_context(mock.patch.object(subp, 'subp'))
-
-            cc_ca_certs.remove_default_ca_certs('ubuntu')
-
-            mock_delete.assert_has_calls([
-                mock.call("/usr/share/ca-certificates/"),
-                mock.call("/etc/ssl/certs/")])
-
-            mock_write.assert_called_once_with(
-                "/etc/ca-certificates.conf", "", mode=0o644)
-
-            mock_subp.assert_called_once_with(
-                ('debconf-set-selections', '-'),
-                "ca-certificates ca-certificates/trust_new_crts select no")
+        for distro_name in cc_ca_certs.distros:
+            conf = cc_ca_certs._distro_ca_certs_configs(distro_name)
+
+            with ExitStack() as mocks:
+                mock_delete = mocks.enter_context(
+                    mock.patch.object(util, 'delete_dir_contents'))
+                mock_write = mocks.enter_context(
+                    mock.patch.object(util, 'write_file'))
+                mock_subp = mocks.enter_context(
+                    mock.patch.object(subp, 'subp'))
+
+                cc_ca_certs.remove_default_ca_certs(distro_name, conf)
+
+                mock_delete.assert_has_calls([
+                    mock.call(conf['ca_cert_path']),
+                    mock.call(conf['ca_cert_system_path'])])
+
+                if conf['ca_cert_config'] is not None:
+                    mock_write.assert_called_once_with(
+                        conf['ca_cert_config'], "", mode=0o644)
+
+                if distro_name in ['debian', 'ubuntu']:
+                    mock_subp.assert_called_once_with(
+                        ('debconf-set-selections', '-'),
+                        "ca-certificates \
+ca-certificates/trust_new_crts select no")
 
 # vi: ts=4 expandtab
diff --git a/tools/.github-cla-signers b/tools/.github-cla-signers
index c278b032..c843e475 100644
--- a/tools/.github-cla-signers
+++ b/tools/.github-cla-signers
@@ -6,6 +6,7 @@ beezly
 bipinbachhao
 BirknerAlex
 candlerb
+cawamata
 dermotbradley
 dhensby
 eandersson