From 0cea5209def73e2c80721b8abe8aa02b5d125630 Mon Sep 17 00:00:00 2001
From: sergio <sergiovelasquezzeballos@gmail.com>
Date: Fri, 10 Jul 2026 22:52:02 -0400
Subject: [PATCH] =?UTF-8?q?base-system:=20ca-certificates=20construye=20?=
 =?UTF-8?q?=E2=80=94=20119=20ra=C3=ADces=20TLS=20(HTTPS=20valida)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

b3:c5a52051. Un solo cambio: [deps] build=[openssl]. La premisa era falsa: c_rehash es un binario
C (no el script perl) que sólo faltaba -lcrypto; perl SÍ está en la dev-fs (mk-ca-bundle.pl corre).
ca-certificates.crt con 119 certs + update-ca-certificates. Sin esto curl/wget HTTPS no validan.
---
 recipes/incoming-clib/ca-certificates.toml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/recipes/incoming-clib/ca-certificates.toml b/recipes/incoming-clib/ca-certificates.toml
index 9d135300..edf28d4f 100644
--- a/recipes/incoming-clib/ca-certificates.toml
+++ b/recipes/incoming-clib/ca-certificates.toml
@@ -16,6 +16,12 @@ target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
 
+# openssl aporta libcrypto.a al overlay del sandbox (/usr/lib) para enlazar c_rehash
+# (`-lcrypto`). El resto del build (mk-ca-bundle.pl → cert.pem → split-ca-bundle.sh) usa
+# el perl + coreutils del rootfs; no requiere el CLI de openssl.
+[deps]
+build = ["openssl"]
+
 [build.phases]
 # de build() de Alpine (traducido; el lab provee $CBUILD/$CHOST — Etapa G Fase 3; revisá --shared para estático):
 compile = '''