# Yocto - mender-client postinstall failing - ca-certificates dependency problem? **URL:** \ **Category:** General Discussions\ **Created:** [March 11, 2021, 11:43am UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328 "2021-03-11T11:43:43Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![matt](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/matt/32/998_2.png) [@matt](https://hub.mender.io/u/matt)\ **Post date:** [March 11, 2021, 11:43am UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/1 "2021-03-11T11:43:43Z")
Hi, I’ve been building a simple RaspberryPi yocto image (dunfell) with mender client and recently it has stopped building. At first my problem was initially [Mender-shell missing from mender github](https://hub.mender.io/t/mender-shell-missing-from-mender-github/3287) as I was using meta-mender tagged _dunfell-v2020.12_ … but I’ve not tried upgrading to _dunfell-v2021.03_ and am now getting this error (“my-image” is my own image recipe): ``` ERROR: my-image-1.0-r0 do_rootfs: Postinstall scriptlets of ['mender-client'] have failed. If the intention is to defer them to first boot, then please place them into pkg_postinst_ontarget_${PN} (). Deferring to first boot via 'exit 1' is no longer supported. ``` The first signs of a problem in the log file are here: ``` Installing : mender-client-2.5.0-r0.cortexa7t2hf_neon_vfpv4 88/95 Running scriptlet: mender-client-2.5.0-r0.cortexa7t2hf_neon_vfpv4 88/95 %post(mender-client-2.5.0-r0.cortexa7t2hf_neon_vfpv4): scriptlet start %post(mender-client-2.5.0-r0.cortexa7t2hf_neon_vfpv4): execv(/bin/sh) pid 308298 + set -e + SYSROOT=<>/poky/build/tmp/work/raspberrypi4-poky-linux-gnueabi/my-image/1.0-r0/rootfs <>/poky/build/tmp/work/raspberrypi4-poky-linux-gnuea bi/my-image/1.0-r0/rootfs/usr/sbin/update-ca-certificates /var/tmp/rpm-tmp.vzIDJQ: 4: <>/poky/build/tmp/work/raspberrypi4-poky-linux-gnueabi/my-image/1.0-r0/rootfs/usr/sbin/update-ca-certificates: not found %post(mender-client-2.5.0-r0.cortexa7t2hf_neon_vfpv4): waitpid(308298) rc 308298 status 7f00 warning: %post(mender-client-2.5.0-r0.cortexa7t2hf_neon_vfpv4) scriptlet failed, exit status 127 Error in POSTIN scriptlet in rpm package mender-client ``` Looking further down the log, it looks like mender-client is being built before ca-certificates recipe. Is there a dependency issue? My bblayers.conf contains: ``` BBLAYERS ?= " \ <>/poky/meta \ <>/poky/meta-poky \ <>/poky/meta-yocto-bsp \ <>/poky/meta-raspberrypi \ <>/poky/meta-mender/meta-mender-core \ <>/poky/meta-mender/meta-mender-raspberrypi \ <>/meta-my \ " ``` layer.conf contains: ``` FILESEXTRAPATHS_prepend_pn-mender := "${TOPDIR}/../build:" SRC_URI_append_pn-mender = "file://server.crt" MENDER_FEATURES_ENABLE_append = " mender-uboot mender-image mender-image-sd mender-systemd mender-growfs-data" MENDER_FEATURES_DISABLE_append = " mender-grub mender-image-uefi" MENDER_ARTIFACT_NAME = "my-rpi4-test" MENDER_PARTITION_ALIGNMENT = "8388608" MENDER_BOOT_PART_SIZE_MB = "80" IMAGE_FSTYPES_remove = " rpi-sdimg" SDIMG_ROOTFS_TYPE = "ext4" MACHINE = "raspberrypi4" KERNEL_DEVICETREE = "bcm2711-rpi-4-b.dtb" SDKMACHINE = "i686" ENABLE_UART = "1" ``` My “my-image” image recipe contains: ``` require recipes-core/images/core-image-minimal.bb IMAGE_INSTALL += " \ libstdc++ \ openssh \ sudo \ ca-certificates \ kernel-image \ kernel-devicetree \ " ``` I’m using the following source versions: - _poky_ tag ‘dunfell-23.0.6’ - _meta-raspberrypi_ branch ‘dunfell’ - _meta-mender_ tag ’ dunfell-v2021.03’ Any help much appreciated. I’m afraid this is beyond my current limits of understanding of yocto recipes and the build process. cheers ---
**Author:** ![drewmoseley](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/drewmoseley/32/47_2.png) [@drewmoseley](https://hub.mender.io/u/drewmoseley)\ **Post date:** [March 11, 2021, 5:54pm UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/2 "2021-03-11T17:54:35Z")
It looks like [this commit](https://github.com/mendersoftware/meta-mender/commit/58a741240c176c01b5b35d02249d023b9eb4352e) is the one adding the call to update-ca-certificates which is failing. And it looks like this logic has changed significantly in master. @lluiscampos do you have any thoughts on how to fix this for dunfell? ---
**Author:** ![matt](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/matt/32/998_2.png) [@matt](https://hub.mender.io/u/matt)\ **Post date:** [March 12, 2021, 4:29pm UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/3 "2021-03-12T16:29:54Z")
As a temporary workaround, I’ve added the following to mender-client recipe via a `.bbappend`: ``` RDEPENDS_${PN} += " ca-certificates " ``` ---
**Author:** ![lluiscampos](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/lluiscampos/32/112_2.png) [@lluiscampos](https://hub.mender.io/u/lluiscampos)\ **Post date:** [March 17, 2021, 2:19pm UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/4 "2021-03-17T14:19:48Z")
@matt Thanks for reporting, @drewmoseley thanks for pointing to the right fix. The dependency is indeed missing for `dunfell`, I’ll launch a fix for it ASAP. The implementation is completely different for `master` (see [commit](https://github.com/mendersoftware/meta-mender/commit/f484589886f86ed6d23333b04395b6fdcb0c2b5f)) and the `ca-certificates` dependency is correctly set. The reason they deviate is that for master we have deprecated the variable `MENDER_CERT_LOCATION`. See the [JIRA task](https://tracker.mender.io/browse/MEN-4273) for more details. ---
**Author:** ![lluiscampos](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/lluiscampos/32/112_2.png) [@lluiscampos](https://hub.mender.io/u/lluiscampos)\ **Post date:** [March 17, 2021, 2:52pm UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/5 "2021-03-17T14:52:08Z")
Mmm, on a second thought the dependency is already there, via `PACKAGECONFIG`, see [this line](https://github.com/mendersoftware/meta-mender/blob/dunfell-v2021.03/meta-mender-core/recipes-mender/mender-client/mender-client.inc#L106). On my setup, running `bitbake -e mender-client | egrep ^RDEPENDS_mender-client=` returns `ca-certificates` there. @matt Can you run this command without your `.bbapend` fix and post the output here? I don’t really know what can be wrong with your setup. I assume you have not disabled `mender-client-install` feature, and I don’t see how can then disappear. @kacf can you have a look on your end? ---
**Author:** ![matt](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/matt/32/998_2.png) [@matt](https://hub.mender.io/u/matt)\ **Post date:** [March 17, 2021, 3:50pm UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/6 "2021-03-17T15:50:59Z")
Hello @lluiscampos … correct, I have not done anything to disable `mender-client-install` as best as I know. My config is at the top of this thread. The output you requested, with my .bbappend fix commented out: ```auto $ bitbake -e mender-client | egrep ^RDEPENDS_mender-client= RDEPENDS_mender-client=" liblzma openssl parted util-linux-fdisk libubootenv-bin" ``` And with my .bbappend fix included: ```auto $ bitbake -e mender-client | egrep ^RDEPENDS_mender-client= RDEPENDS_mender-client=" liblzma openssl ca-certificates parted util-linux-fdisk libubootenv-bin" ``` ---
**Author:** ![lluiscampos](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/lluiscampos/32/112_2.png) [@lluiscampos](https://hub.mender.io/u/lluiscampos)\ **Post date:** [March 18, 2021, 8:24am UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/7 "2021-03-18T08:24:14Z")
Hi @matt, I see it now: you are missing `mender-client-install` in your `MENDER_FEATURES_ENABLE_append`. Adding that feature should solve the issue. The feature is to actually install mender client; your image is adding mender client through some other dependency (sorry, I cannot really tell) but then other parts, like the `ca-certificates` dependency, are missing. The recommended way to install the mender client is by enabling such feature See documentation on the feature in the source code [here](https://github.com/mendersoftware/meta-mender/blob/dunfell-v2021.03/meta-mender-core/classes/mender-maybe-setup.bbclass#L47) or in Mender Docs [here](https://docs.mender.io/system-updates-yocto-project/image-customization/features#list-of-features) (\*) (\*) obs! at the time of writing, Mender Docs feature has a typo: the feature is `mender-client-install` and not `mender-install`. I just caught it now and I am fixing [here](https://github.com/mendersoftware/mender-docs/pull/1374). ---
**Author:** ![matt](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/matt/32/998_2.png) [@matt](https://hub.mender.io/u/matt)\ **Post date:** [March 18, 2021, 12:19pm UTC](https://hub.mender.io/t/yocto-mender-client-postinstall-failing-ca-certificates-dependency-problem/3328/8 "2021-03-18T12:19:36Z")
Many thanks @lluiscampos … that seems to have fixed it.