From 5b301fa4a667053becce5ceca5a47de92087224d Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 7 Nov 2026 16:58:18 +0100 Subject: [PATCH 1/2] tools: use vendored trust store in `shell.nix` Signed-off-by: Antoine du Hamel --- shell.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/shell.nix b/shell.nix index cb5f0a8f102b..a42f70ed7b5a 100644 --- a/shell.nix +++ b/shell.nix @@ -149,6 +149,14 @@ pkgs.mkShell { ) ) ); + + # CA bundle built from the vendored Mozilla trust store, so Nix-built tools + # (curl, git, shared OpenSSL) don't fall back to the user's possibly stale one. + NIX_SSL_CERT_FILE = "${ + pkgs.cacert.overrideAttrs { + src = ./tools/certdata.txt; + } + }/etc/ssl/certs/ca-bundle.crt"; } // ( let From c8578f86907b07b0387564823e1140ae2bcf55fb Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Sat, 7 Nov 2026 23:56:54 +0100 Subject: [PATCH 2/2] fixup! tools: use vendored trust store in `shell.nix` --- .github/workflows/nix-changes.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml index 85fba6798bcf..45640902d5a7 100644 --- a/.github/workflows/nix-changes.yml +++ b/.github/workflows/nix-changes.yml @@ -11,11 +11,13 @@ on: - v[0-9]+.x paths: - '**.nix' + - tools/certdata.txt - tools/nix/** - .github/workflows/nix-changes.yml pull_request: paths: - '**.nix' + - tools/certdata.txt - tools/nix/** - .github/workflows/nix-changes.yml types: [opened, synchronize, reopened, ready_for_review] @@ -52,6 +54,7 @@ jobs: sparse-checkout: | shell.nix tools/nix/ + tools/certdata.txt sparse-checkout-cone-mode: false - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # v31.11.3