pkg/58144: SSLCERTBUNDLE isn't set reliably for clean builds or cross-builds

[campbell+netbsd%mumble.net@localhost]

>Number:         58144
>Category:       pkg
>Synopsis:       SSLCERTBUNDLE isn't set reliably for clean builds or cross-builds
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Apr 12 14:40:00 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The NetSSL Certbundle
>Environment:
>Description:
security/openssl/builtin.mk has a variable SSLCERTBUNDLE pointing to a single-file bundle of system trust anchors for TLS.

It is unconditionally initialized to ${SSLDIR}/certs/ca-bundle.crt, but only if that file exists at build-time (under ${_CROSS_DESTDIR}).

In a NetBSD 10 cross-build, this file usually _doesn't_ exist at build-time -- it's created at install- or upgrade-time by certctl(8), not at build-time by build.sh/make.

In a NetBSD 9 clean build, this file also doesn't exist in a clean build environment, such as pbulk, even if users typically use mozilla-rootcerts or mozilla-rootcerts-openssl.  Thus, e.g., https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/x86_64/10.0/All/curl-8.7.1.tgz has SSLCERTBUNDLE empty instead of /etc/openssl/certs/ca-bundle.crt.
>How-To-Repeat:
build www/curl for NetBSD with mozilla-rootcerts-openssl installed or not
>Fix:
Yes, please!