<commit_before>{ config, lib, pkgs, ... }:

with lib;

{

  options = {

    security.pki.certificateFiles = mkOption {
      type = types.listOf types.path;
      default = [];
      example = literalExample "[ \"\${pkgs.cacert}/etc/ca-bundle.crt\" ]";
      description = ''
        A list of files containing trusted root certificates in PEM
        format. These are concatenated to form
        <filename>/etc/ssl/certs/ca-bundle.crt</filename>, which is
        used by many programs that use OpenSSL, such as
        <command>curl</command> and <command>git</command>.
      '';
    };

    security.pki.certificates = mkOption {
      type = types.listOf types.string;
      default = [];
      example = singleton ''
        NixOS.org
        =========
        -----BEGIN CERTIFICATE-----
        MIIGUDCCBTigAwIBAgIDD8KWMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ
        TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0
        ...
        -----END CERTIFICATE-----
      '';
      description = ''
        A list of trusted root certificates in PEM format.
      '';
    };

  };

  config = {

    security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ca-bundle.crt" ];

    environment.etc =
      [ { source = pkgs.runCommand "ca-bundle.crt"
          { files =
              config.security.pki.certificateFiles ++
              [ (builtins.toFile "extra.crt" (concatStringsSep "\n" config.security.pki.certificates)) ];
           }
          ''
            cat $files > $out
          '';
          target = "ssl/certs/ca-bundle.crt";
        }
      ];

    environment.sessionVariables =
      { SSL_CERT_FILE          = "/etc/ssl/certs/ca-bundle.crt";
        # FIXME: unneeded - remove eventually.
        OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
        # FIXME: unneeded - remove eventually.
        GIT_SSL_CAINFO         = "/etc/ssl/certs/ca-bundle.crt";
      };

  };

}
<commit_msg>Provide symlinks to ca-bundle.crt for compat with other distros<commit_after>{ config, lib, pkgs, ... }:

with lib;

let

  caBundle = pkgs.runCommand "ca-bundle.crt"
    { files =
        config.security.pki.certificateFiles ++
        [ (builtins.toFile "extra.crt" (concatStringsSep "\n" config.security.pki.certificates)) ];
     }
    ''
      cat $files > $out
    '';

in

{

  options = {

    security.pki.certificateFiles = mkOption {
      type = types.listOf types.path;
      default = [];
      example = literalExample "[ \"\${pkgs.cacert}/etc/ca-bundle.crt\" ]";
      description = ''
        A list of files containing trusted root certificates in PEM
        format. These are concatenated to form
        <filename>/etc/ssl/certs/ca-bundle.crt</filename>, which is
        used by many programs that use OpenSSL, such as
        <command>curl</command> and <command>git</command>.
      '';
    };

    security.pki.certificates = mkOption {
      type = types.listOf types.string;
      default = [];
      example = singleton ''
        NixOS.org
        =========
        -----BEGIN CERTIFICATE-----
        MIIGUDCCBTigAwIBAgIDD8KWMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ
        TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0
        ...
        -----END CERTIFICATE-----
      '';
      description = ''
        A list of trusted root certificates in PEM format.
      '';
    };

  };

  config = {

    security.pki.certificateFiles = [ "${pkgs.cacert}/etc/ca-bundle.crt" ];

    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;

    # CentOS/Fedora compatibility.
    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;

    # Debian/Ubuntu/Arch/Gentoo compatibility.
    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;

    environment.sessionVariables =
      { SSL_CERT_FILE          = "/etc/ssl/certs/ca-bundle.crt";
        # FIXME: unneeded - remove eventually.
        OPENSSL_X509_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt";
        # FIXME: unneeded - remove eventually.
        GIT_SSL_CAINFO         = "/etc/ssl/certs/ca-bundle.crt";
      };

  };

}

{'fraction_non_alphanumeric': 0.13409868099658037, 'fraction_numerical': 0.006839276990718124, 'mean_word_length': 2.0999242997728995, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5190720', 'n_tokens_mistral': 1438, 'n_tokens_neox': 1368, 'n_words': 231}