PKI files should live in /var/lib

[madduck]

The files in /etc/salt/pki are not configuration files in the sense of the FHS ("local file used to control the operation of a program") and hence do not belong in /etc.

The FHS-proper location for these auto-generated but static files is /var/lib. I suggest that the defaults be changed to `/var/lib/salt/{master,minion}/pki.

To assist users with the migration, /etc/salt/pki could be used as a fallback, in combination with an appropriate warning and reference to a README file or so.

[madduck]

On the minion, the minion subdirectory won't be necessary either, that is: /etc/salt/pki/minion → /var/lib/salt/minion/pki.

[thatch45]

I am sorry @madduck, I don't think we should change the default here. In freebsd for instance this is a violation, and in Red Hat they often put certs in /etc/pki
In the end this is a distro specific thing, also, it is configurable via the pki_dir option

[madduck]

I am sorry @madduck, I don't think we should change the default
here. In freebsd for instance this is a violation, and in Red Hat
they often put certs in /etc/pki

Sure, every distro does their own thing, which is why I was
suggesting to go by the only accepted higher-level standard, which
the FHS undoubtedly is.

[thatch45]

But distro and especially unixes do not follow this standard, this is a dead end debate and I would prefer to not get drawn into it, if our package maintainers all agree that we should create a new sub-directory and recreate all keys so that they can foll the FHS that is their thing.

[madduck]

For future reference: http://bugs.debian.org/698898