Commit 04cd8c1f570 for nodejs

commit 04cd8c1f5703fd235756baa9f237bdd777b9d4c4
Author: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date:   Mon Nov 9 17:07:19 2026 +0100

    tools: use vendored trust store in `shell.nix`

    Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
    PR-URL: https://github.com/nodejs/node/pull/67318
    Reviewed-By: Filip Skokan <panva.ip@gmail.com>
    Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index 85fba6798bc..45640902d5a 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -11,11 +11,13 @@ on:
       - v[0-9]+.x
     paths:
       - '**.nix'
+      - tools/certdata.txt
       - tools/nix/**
       - .github/workflows/nix-changes.yml
   pull_request:
     paths:
       - '**.nix'
+      - tools/certdata.txt
       - tools/nix/**
       - .github/workflows/nix-changes.yml
     types: [opened, synchronize, reopened, ready_for_review]
@@ -52,6 +54,7 @@ jobs:
           sparse-checkout: |
             shell.nix
             tools/nix/
+            tools/certdata.txt
           sparse-checkout-cone-mode: false

       - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b  # v31.11.3
diff --git a/shell.nix b/shell.nix
index cb5f0a8f102..a42f70ed7b5 100644
--- a/shell.nix
+++ b/shell.nix
@@ -149,6 +149,14 @@ pkgs.mkShell {
         )
       )
     );
+
+    # CA bundle built from the vendored Mozilla trust store, so Nix-built tools
+    # (curl, git, shared OpenSSL) don't fall back to the user's possibly stale one.
+    NIX_SSL_CERT_FILE = "${
+      pkgs.cacert.overrideAttrs {
+        src = ./tools/certdata.txt;
+      }
+    }/etc/ssl/certs/ca-bundle.crt";
   }
   // (
     let