Switch from bremcl/rootcerts to x/crypto/x509roots

[stapelberg]

We first need to add a Bundle() accessor to the x509roots/fallback package, then we can dump the certificates (in internal/packer/cacerts.go) like so:

	b := new(bytes.Buffer)
	for _, cert := range fallback.Bundle() {
		fmt.Fprintf(b, "# %s\n# %x\n", cert.Subject.String(), sha256.Sum256(cert.Raw))
		pem.Encode(b, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
	}

	return string(b.Bytes()), nil

[dolmen]

@stapelberg I'm working on it!

[dolmen]

@stapelberg I'm working on it!

Nope. The Bundle() accessor isn't available.

[stapelberg]

Yeah, I filed https://github.com/golang/go/issues/69898 to export it. I’ll ping Roland again to see where this stands.

[dolmen]

What about this alternative: just to download the certificates directly from the Mozilla source while building the image and store the file where Go expects it.

[stapelberg]

This is done with commit https://github.com/gokrazy/tools/commit/19d09ffb32b78f5e868812eeef905e7452d391f4 🎉