/*
 * ca-certificates — the Mozilla CA root bundle (121 roots).
 *
 * A data package: no build.  The bundle is the curl.se snapshot; bump
 * the version + sha256 when updating.  Installed to the path that
 * openssl's --openssldir and curl's --with-ca-bundle both expect.
 */
package "ca-certificates" {
    const version = "2026-08-18"
    const source  = "https://curl.se/ca/cacert.pem"
    sha256 = "f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9"
    license = "MPL-2.0"

    provides = ["ca-certificates"]

    prepare {
        curl -L -o cacert.pem ${source}
        echo "f66dff1bdf8f96060b8177976f8b7d9254bc89bc4db933d769f7384d28480bc9  cacert.pem" | sha256sum -c -
    }

    build {
        true
    }

    install {
        mkdir -p ${destdir}/etc/ssl/certs
        cp cacert.pem ${destdir}/etc/ssl/certs/ca-certificates.crt
    }
}