From edecaf64ea628f8fb55fd26ff6021717145e3bc4 Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Wed, 1 Jan 2025 13:04:31 -0500
Subject: [PATCH] cacert: add hashed output

---
 pkgs/data/misc/cacert/default.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/data/misc/cacert/default.nix b/pkgs/data/misc/cacert/default.nix
index d3f4c4f2eb60..15b1528316f8 100644
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@@ -74,12 +74,13 @@ stdenv.mkDerivation rec {
     "out"
     "unbundled"
     "p11kit"
+    "hashed"
   ];
 
   nativeBuildInputs = [ buildcatrust ];
 
   buildPhase = ''
-    mkdir unbundled
+    mkdir unbundled hashed
     buildcatrust \
       --certdata_input certdata.txt \
       --ca_bundle_input "${extraCertificatesBundle}" ${
@@ -89,6 +90,7 @@ stdenv.mkDerivation rec {
       --ca_bundle_output ca-bundle.crt \
       --ca_standard_bundle_output ca-no-trust-rules-bundle.crt \
       --ca_unpacked_output unbundled \
+      --ca_hashed_unpacked_output hashed \
       --p11kit_output ca-bundle.trust.p11-kit
   '';
 
@@ -103,6 +105,11 @@ stdenv.mkDerivation rec {
 
     # install individual certs in unbundled output
     install -D -t "$unbundled/etc/ssl/certs" unbundled/*.crt
+
+    # install hashed certs in hashed output
+    # use cp as install doesn't copy symlinks
+    mkdir -p $hashed/etc/ssl/certs/
+    cp -P hashed/* $hashed/etc/ssl/certs/
   '';
 
   setupHook = ./setup-hook.sh;