ship root SSL certificates along with ziglang.org-vendored tarballs #14168
Description
Normally, it is best for applications to rely on their system for providing root SSL certificates. However, Zig is a bit of a special case because it aims to be "Dependency Zero" - a self-contained binary that one can use to build & install other things.
In order to do this consistently across the many different platforms that Zig aims to target, dependencies must be eliminated. There are environments where we want the zig package manager to work, for example, that will not necessarily have any root certificates installed.
Other notable applications that ship their own certificates:
- curl (as with Zig, curl is often "dependency zero")
- Firefox, Chromium (as with Zig, they want the user experience to be consistent across operating systems)
These certificates would be file(s) inside of a sub-directory in lib. Any std lib code that needs a std.Certificate.Bundle would use @embedFile to obtain this set, and then at runtime augment it with the ones found locally on the OS, if any.
Open questions:
- where to get the set of root certificates for distribution?