pkgbase: fix caroot packaging and add post-install script

The original intention for caroot was to be packaged separately, perhaps so
that users can have a more/less conservative upgrade policy for this
separated from the rest of base.

secure/caroot/Makefile doesn't have anything interesting to package, but its
subdirectories might. Move the PACKAGE= to Makefile.inc so both blacklisted
and trusted get packaged consistently into the correct one rather than the
default -utilities. Also tag the directories for package=caroot, as they
could also be empty; blacklisted is empty by default, but trusted is not.

Add a post-install script to do certctl rehash, along with a note should we
eventually come up with a way to detect that files have been added or
removed that requires a rehash.

-caroot gets a dependency on -utilities, as that's where we provide certctl
at the moment. We can perhaps reconsider this and put certctl into this
package in the future, but there are some bits within -utilities that
unconditionally invoke certctl so let's hold off for now.

Reviewed by:	manu (earlier version, before -utilities dep added)
Differential Revision:	https://reviews.freebsd.org/D23352

2 files changed, 3 insertions, 2 deletions

diff --git a/secure/caroot/Makefile b/secure/caroot/Makefile
index 7c0831d2ac2f..50f92ecc6542 100644
--- a/secure/caroot/Makefile
+++ b/secure/caroot/Makefile
@@ -1,7 +1,5 @@
 # $FreeBSD$
 
-PACKAGE=	caroot
-
 CLEANFILES+=	certdata.txt
 
 SUBDIR+=	trusted
diff --git a/secure/caroot/Makefile.inc b/secure/caroot/Makefile.inc
new file mode 100644
index 000000000000..9475e35f5854
--- /dev/null
+++ b/secure/caroot/Makefile.inc
@@ -0,0 +1,3 @@
+# $FreeBSD$
+
+PACKAGE=	caroot