package nss-cacert {
	description = "bundle of X.509 certificates of public Certificate Authorities";
	website = "https://firefox-source-docs.mozilla.org/security/nss/index.html";
	anitya = 2503;

	version# = "3.128";
	source = remoteGitHub {
		suffix = "nss-dev/nss";
		tag = "NSS_"+join {
			elems = split {
				s = version;
				sep = ".";
				n = 3;
			};
			sep = "_";
		}+"_RTM";
		checksum = "uVP9Tbv17Vo7tUAm1LK16vu-9PA4Mecjc1Kr6y4ptXby9e0zT7I15rzsD2fMApqA";
	};

	enterSource = true;
	exec = generic {
		chdir = false;
		build = `
mkdir -p /work/system/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
buildcatrust \
	--certdata_input lib/ckfw/builtins/certdata.txt \
	--ca_bundle_output /work/system/etc/ssl/certs/ca-bundle.crt \
	--ca_standard_bundle_output /work/system/etc/ssl/certs/ca-no-trust-rules-bundle.crt \
	--ca_unpacked_output /work/system/etc/ssl/certs/unbundled \
	--ca_hashed_unpacked_output /work/system/etc/ssl/certs/hashed \
	--p11kit_output /work/system/etc/ssl/trust-source/ca-bundle.trust.p11-kit
`;
	};

	inputs = [
		bash,

		buildcatrust,
	];
}