[OmniOS-discuss] CA certs redux

[Eric Sproul]

On Sun, Nov 4, 2012 at 1:20 AM, Paul B. Henson <henson at acm.org> wrote:
> Heh, I'm glad you think it's an issue :). I didn't really want to harp
> on it as it seemed like I was starting to nitpick ;). I originally
> suggested to Eric that rather than pull the bundled CA cert file off
> curl.haxx.se that the build process for nss rip them out of the
> libnssckbi.so library instead, so the nss bundled version and the
> external copies were in sync.

I agree that pulling them from libnssckbi is the most desirable
outcome, and superior to arbitrary syncing from curl.haxx.se.  I can
look into changing the mozilla-nss build process to extract these
during the build, and potentially produce the cert package as part of
the overall nss build as well.

Eric