Add DEFAULT_SSL_CA_CERTIFICATES_BUNDLE_LINK and update sync_system_ssl_symlinks function

src/main.rs

@@ -15,6 +15,7 @@ const DEFAULT_ROOT: &str = "/";
 const DEFAULT_ANCHORS_DIR: &str = "/etc/ca-certificates/trust-source/anchors";
 const DEFAULT_EXTRACTED_DIR: &str = "/etc/ca-certificates/extracted";
 const DEFAULT_SSL_CERTS_DIR: &str = "/etc/ssl/certs";
+const DEFAULT_SSL_CA_CERTIFICATES_BUNDLE_LINK: &str = "/etc/ssl/certs/ca-certificates.crt";
 const DEFAULT_JAVA_CACERTS_LINK: &str = "/etc/ssl/certs/java/cacerts";
 const DEFAULT_CERTDATA_URL: &str =
     "https://hg.mozilla.org/projects/nss/raw-file/tip/lib/ckfw/builtins/certdata.txt";
@@ -1438,7 +1439,10 @@ fn run_trust_extract_job(
 
 fn sync_system_ssl_symlinks(root: &Path, extracted_target: &Path, dry_run: bool) -> Result<()> {
     let ssl_certs_host = path_in_root(root, Path::new(DEFAULT_SSL_CERTS_DIR));
+    let ca_bundle_link_host =
+        path_in_root(root, Path::new(DEFAULT_SSL_CA_CERTIFICATES_BUNDLE_LINK));
     let java_link_host = path_in_root(root, Path::new(DEFAULT_JAVA_CACERTS_LINK));
+    let tls_bundle_src_host = path_in_root(root, &extracted_target.join("tls-ca-bundle.pem"));
     let cadir_host = path_in_root(root, &extracted_target.join("cadir"));
     let java_src_host = path_in_root(root, &extracted_target.join("java-cacerts.jks"));
 
@@ -1455,6 +1459,11 @@ fn sync_system_ssl_symlinks(root: &Path, extracted_target: &Path, dry_run: bool)
             "[dry-run] Would delete broken symlinks in {}",
             ssl_certs_host.display()
         );
+        println!(
+            "[dry-run] Would link {} -> {}",
+            ca_bundle_link_host.display(),
+            tls_bundle_src_host.display()
+        );
         println!(
             "[dry-run] Would link {} -> {}",
             java_link_host.display(),
@@ -1482,6 +1491,7 @@ fn sync_system_ssl_symlinks(root: &Path, extracted_target: &Path, dry_run: bool)
     }
 
     remove_broken_symlinks(&ssl_certs_host)?;
+    replace_symlink(&tls_bundle_src_host, &ca_bundle_link_host)?;
     replace_symlink(&java_src_host, &java_link_host)?;
     Ok(())
 }