Hello, IIUC nss-certs uses certdata2pem to convert certdata.txt from nss to a series of pems that are placed in /etc/ssl/certs and p11-kit then points to that for its default trust store.
However, this is limiting compared to a .p11-kit file as pems don't carry over certificate attributes such as nss-mozilla-ca-policy. Unlike its counterparts in other distros (see e.g. certdata2pem.py in Debian/Arch), the certdata2pem implentation employed by Guix doesn't parse certificate attributes into a .p11-kit file. Some backstory: I stumbled upon this trying to resolve #10994 by doing what other distros did and linking p11-kit-trust.so to libnssckbi.so (the former being a drop-in replacement for the latter) in order to make nss use p11-kit i.e. the certificate store in /etc/ssl/certs. Doing this caused extensions in Librewolf to stop working. Apparently, Mozilla has a notion of "built-in" certificates (i.e. ones that contain the nss-mozilla-ca-policy attribute) which is invalidated when using the p11-kit module. Again, other distros ship a .p11-kit file which has the attribute so there's no problem. Thoughts? Alex
