Autocommit in repo: ros.vados.ru, generated by owner: root, in 09:10:02 01.05.2026.

diff --git a/html/AM-GlobalFunc.rsc b/html/AM-GlobalFunc.rsc
index 21435c22cc5761ed559fccdf296695a60ea3277c..f6a51582854a307c2e410e8246572b55c4cd7d83 100644 (file)
--- a/html/AM-GlobalFunc.rsc
+++ b/html/AM-GlobalFunc.rsc
@@ -17,9 +17,9 @@
 :global GlobalFuncReady false;
 
 # Git commit id & info, expected configuration version
-:global CommitId "main/366/ab812be1";
+:global CommitId "main/367/2a8f526e";
 :global CommitTAG "unknown";
-:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 08:50:03 01.05.2026.";
+:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 09:10:02 01.05.2026.";
 
 # The variables are received right here.
 :global GlobalConfVersion 138;
@@ -554,24 +554,32 @@
   :if ($Severity != "debug" || $Debug = true) do={:put ([ $PrintSeverity $Severity ] . ": " . $Message)}
 }
 
+# check and download required certificate
 :set CertificateAvailable do={
   :local CommonName [ :tostr $1 ];
   :local UseFor     [ :tostr $2 ];
+
   :global CertificateDownload;
-  :global EitherOr;
   :global LogPrint;
   :global ParseKeyValueStore;
-  :set UseFor [ $EitherOr $UseFor "undefined" ];
+
+  :if ([ :len $UseFor ] = 0) do={
+    $LogPrint warning $0 ("The intended use is undefined!");
+    :set UseFor "undefined";
+  }
+
   :if ([ /system/resource/get free-hdd-space ] < 8388608 && \
        [ /certificate/settings/get crl-download ] = true && \
        [ /certificate/settings/get crl-store ] = "system") do={
     $LogPrint warning $0 ("This system has low free flash space but " . \
       "is configured to download certificate CRLs to system!");
   }
+
   :if ([ :len $CommonName ] = 0) do={
     $LogPrint warning $0 ("No CommonName given!");
     :return false;
   }
+
   :local CertSettings [ /certificate/settings/get ];
   :if ((($CertSettings->"builtin-trust-anchors") = "trusted" || \
         ($CertSettings->"builtin-trust-store") ~ $UseFor || \
@@ -579,49 +587,65 @@
        [ :len [ /certificate/builtin/find where common-name=$CommonName ] ] > 0) do={
     :return true;
   }
+
   :if ([ :len [ /certificate/find where common-name=$CommonName ] ] = 0) do={
     $LogPrint info $0 ("Certificate with CommonName '" . $CommonName . "' not available.");
-    :if ([ $CertificateDownload $CommonName ] = false) do={:return false}
+    :if ([ $CertificateDownload $CommonName ] = false) do={
+      :return false;
+    }
   }
+
   :if ([ :len [ /certificate/find where common-name=$CommonName ] ] > 1) do={
     $LogPrint info $0 ("There are " . $CertCount . " Certificates with CommonName '" . $CommonName . "'. Should be ok.");
     :return true;
   }
+
   :local CertVal [ /certificate/get [ find where common-name=$CommonName ] ];
   :while (($CertVal->"akid") != "" && ($CertVal->"akid") != ($CertVal->"skid")) do={
     :if ([ :len [ /certificate/find where skid=($CertVal->"akid") ] ] = 0) do={
       :local IssuerCN ([ $ParseKeyValueStore ($CertVal->"issuer") ]->"CN");
       $LogPrint info $0 ("Certificate chain for '" . $CommonName . "' is incomplete, missing '" . $IssuerCN . "'.");
-      :if ([ $CertificateDownload $IssuerCN ] = false) do={:return false}
+      :if ([ $CertificateDownload $IssuerCN ] = false) do={
+        :return false;
+      }
     }
     :set CertVal [ /certificate/get [ find where skid=($CertVal->"akid") ] ];
   }
   :return true;
 }
 
+# download and import certificate
 :set CertificateDownload do={
   :local CommonName [ :tostr $1 ];
-  :global GlobalScriptsUrl;
-  :global GlobalScriptsUrlSuffix;
+
+  :global ScriptUpdatesBaseUrl;
+  :global ScriptUpdatesUrlSuffix;
+
   :global CertificateNameByCN;
   :global CleanName;
   :global FetchUserAgentStr;
   :global LogPrint;
   :global RmFile;
   :global WaitForFile;
-  
-  $LogPrint info $0 ("Downloading and importing certificate with CommonName '" . $CommonName . "'.");
-  
+
+  $LogPrint info $0 ("Downloading and importing certificate with " . \
+      "CommonName '" . $CommonName . "'.");
   :local FileName ([ $CleanName $CommonName ] . ".pem");
   :do {
     /tool/fetch check-certificate=yes-without-crl http-header-field=({ [ $FetchUserAgentStr $0 ] }) \
-      ($GlobalScriptsUrl . "certs/" . $FileName . $GlobalScriptsUrlSuffix) dst-path=$FileName as-value;
+      ($ScriptUpdatesBaseUrl . "certs/" . $FileName . $ScriptUpdatesUrlSuffix) \
+      dst-path=$FileName as-value;
     $WaitForFile $FileName;
   } on-error={
     $LogPrint warning $0 ("Failed downloading certificate with CommonName '" . $CommonName . \
       "' from repository! Trying fallback to mkcert.org...");
     :do {
-      :if ([ :len [ /certificate/find where common-name="ISRG Root X1" ] ] = 0) do={
+      :local CertSettings [ /certificate/settings/get ];
+      :if ([ :len [ /certificate/find where common-name="ISRG Root X1" ] ] = 0 && \
+           !((($CertSettings->"builtin-trust-anchors") = "trusted" || \
+              ($CertSettings->"builtin-trust-store") ~ "fetch" || \
+              ($CertSettings->"builtin-trust-store") = "all") && \
+             [ :len [ /certificate/builtin/find where common-name="ISRG Root X1" ] ] > 0)) do={
         $LogPrint error $0 ("Required certificate is not available.");
         :return false;
       }
@@ -648,16 +672,20 @@
     $LogPrint warning $0 ("Certificate with CommonName '" . $CommonName . "' still unavailable!");
     :return false;
   }
+
   :foreach Cert in=[ /certificate/find where name~("^" . $FileName . "_[0-9]+\$") ] do={
     $CertificateNameByCN [ /certificate/get $Cert common-name ];
   }
   :return true;
 }
 
+# name a certificate by its common-name
 :set CertificateNameByCN do={
   :local Match [ :tostr $1 ];
+
   :global CleanName;
   :global LogPrint;
+
   :local Cert ([ /certificate/find where (common-name=$Match or fingerprint=$Match or name=$Match) ]->0);
   :if ([ :len $Cert ] = 0) do={
     $LogPrint warning $0 ("No matching certificate found.");