Arch Linux

It would probably be a good idea to also patch the vars.example file to reflect the changed default value.

The paths are still wrong in easy-rsa 3.0.6-1 and breaks init-ca after init-pki since openssl-easyrsa.cnf is not copied.

From https://github.com/OpenVPN/easy-rsa/blob/master/doc/EasyRSA-Advanced.md
EASYRSA - should point to the Easy-RSA top-level dir, where the easyrsa script is located.
EASYRSA_PKI (CLI: --pki-dir) - dir to use to hold all PKI-specific files, defaults to $PWD/pki.

So EASYRSA seems to contain the readonly configuration (vars, openssl config) while EASYRSA_PKI seems to contain the local PKI config.

$EASYRSA should probably become ${0%/*}/../../etc/easy-rsa while EASYRSA_PKI should be restored to $PWD/pki. I have tested this and it works.

This is still a problem for me with

```
$ pacman -Qi easy-rsa
Name : easy-rsa
Version : 3.0.8-2
Description : Simple shell based CA utility
Architecture : any
URL : https://github.com/OpenVPN/easy-rsa
Licenses : custom
Groups : None
Provides : None
Depends On : openssl sh grep
Optional Deps : None
Required By : None
Optional For : openvpn
Conflicts With : None
Replaces : None
Installed Size : 124.94 KiB
Packager : Christian Hesse <arch@eworm.de>
Build Date : Sat 10 Oct 2020 02:51:55 PM
Install Date : Tue 23 Feb 2021 11:46:28 AM
Install Reason : Explicitly installed
Install Script : No
Validated By : Signature
```

If I try to use it I see the same error everyone else is:

```
$ mkdir test
$ cd test
$ easyrsa init-pki

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /home/kousu/src/certs/test/test/pki


$ easyrsa build-ca
Using SSL: openssl OpenSSL 1.1.1j 16 Feb 2021

Easy-RSA error:

The OpenSSL config file cannot be found.
Expected location: /home/kousu/src/certs/test/test/pki/openssl-easyrsa.cnf

```

I can workaround it by just:

```
mkdir test
cd test
easyrsa init-pki
cp /etc/easy-rsa/openssl-easyrsa.cnf pki/
easyrsa build-ca
```

Would it be more robust to patch init_pki instead of the EASYRSA variable?

```
--- /usr/bin/easyrsa 2020-10-10 14:51:55.000000000 -0400
+++ easyrsa 2021-02-23 12:15:20.407264578 -0500
@@ -551,9 +551,9 @@
done

# Create $EASYRSA_SAFE_CONF ($OPENSSL_CONF) prevents bogus warnings (especially useful on win32)
- if [ ! -f "$EASYRSA_SSL_CONF" ] && [ -f "$EASYRSA/openssl-easyrsa.cnf" ];
+ if [ ! -f "$EASYRSA_SSL_CONF" ] && [ -f "/etc/easy-rsa/openssl-easyrsa.cnf" ];
then
- cp "$EASYRSA/openssl-easyrsa.cnf" "$EASYRSA_SSL_CONF"
+ cp "/etc/easy-rsa/openssl-easyrsa.cnf" "$EASYRSA_SSL_CONF"
easyrsa_openssl makesafeconf
fi
```

I also vouch that EASYRSA_PKI should be restored to $PWD/pki. Otherwise, trying to work around this with `export EASYRSA=/etc/easy-rsa` gets you get warnings that should probably be errors but aren't:

$ export EASYRSA=/etc/easy-rsa
$ easyrsa sign-req server don
Can't open /home/kousu/src/certs/test/test/pki/safessl-easyrsa.cnf for reading, No such file or directory
140691190113664:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:69:fopen('/home/kousu/src/certs/test/test/pki/safessl-easyrsa.cnf','r')
140691190113664:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:76:

The patch that caused issues got removed with the upgrade to 3.0.9[0]
Is this still of concern? If not, maybe someone, who was hit by that in the past, could confirm and request closure?
_________
[0] https://github.com/archlinux/svntogit-packages/commit/eaf8e184443c8b4dd907f2b751538a00cbc0035c

Yes, works like intended now. Can be closed.