Function write_ca_files

crates/openshell-supervisor-network/src/l7/tls.rs:241–262

Write CA certificate files for the sandbox trust store. Writes: 1. Standalone CA cert PEM (for `NODE_EXTRA_CA_CERTS` which is additive) 2. Combined bundle: system CAs + sandbox CA (for `SSL_CERT_FILE` which replaces default) `system_ca_bundle` is the pre-read PEM contents of the system CA bundle (from [`read_system_ca_bundle`]). Pass the same string to [`build_upstream_client_config`] to avoid r

(
    ca: &SandboxCa,
    output_dir: &Path,
    system_ca_bundle: &str,
)

///
/// Returns `(ca_cert_path, combined_bundle_path)`.
pub fn write_ca_files(
    ca: &SandboxCa,
    output_dir: &Path,
    system_ca_bundle: &str,
) -> Result<(PathBuf, PathBuf)> {
    std::fs::create_dir_all(output_dir).into_diagnostic()?;

    let ca_cert_path = output_dir.join("openshell-ca.pem");
    std::fs::write(&ca_cert_path, ca.cert_pem()).into_diagnostic()?;

    // Combine system CAs with our sandbox CA
    let mut combined = system_ca_bundle.to_string();
    if !combined.is_empty() && !combined.ends_with('\n') {
        combined.push('\n');
    }
    combined.push_str(ca.cert_pem());

    let combined_path = output_dir.join("ca-bundle.pem");
    std::fs::write(&combined_path, &combined).into_diagnostic()?;

    Ok((ca_cert_path, combined_path))
}

/// Load PEM-encoded certificates from a string into a root certificate store.
///