From c6d79fa2adeed7691470542eb3f2af26e458699a Mon Sep 17 00:00:00 2001
From: cneicy <im@crash.work>
Date: Sat, 5 Sep 2026 04:04:38 +0800
Subject: [PATCH] ci: trust bundled CAs during NuGet publish

---
 .gitea/workflows/publish-nuget.yml | 4 ++++
 Directory.Build.props.meta         | 2 ++
 NuGet.Config.meta                  | 2 ++
 3 files changed, 8 insertions(+)
 create mode 100644 Directory.Build.props.meta
 create mode 100644 NuGet.Config.meta

diff --git a/.gitea/workflows/publish-nuget.yml b/.gitea/workflows/publish-nuget.yml
index 1b18a2f..6c47920 100644
--- a/.gitea/workflows/publish-nuget.yml
+++ b/.gitea/workflows/publish-nuget.yml
@@ -17,6 +17,7 @@ jobs:
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: '1'
       DOTNET_CLI_TELEMETRY_OPTOUT: '1'
       LD_LIBRARY_PATH: /opt/dotnet-libs/usr/lib/x86_64-linux-gnu
+      SSL_CERT_FILE: /opt/ca-certificates.crt
     steps:
       - name: Fetch exact tagged source
         env:
@@ -51,6 +52,9 @@ jobs:
           set -euo pipefail
           node --input-type=module <<'NODE'
           import { writeFile } from 'node:fs/promises';
+          import { rootCertificates } from 'node:tls';
+
+          await writeFile('/opt/ca-certificates.crt', rootCertificates.join('\n'));
 
           const metadataResponse = await fetch('https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json');
           if (!metadataResponse.ok) throw new Error(`Release metadata download failed: ${metadataResponse.status}`);
diff --git a/Directory.Build.props.meta b/Directory.Build.props.meta
new file mode 100644
index 0000000..bb9fcc9
--- /dev/null
+++ b/Directory.Build.props.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: c36280bbe9441a74383b8075143c623f
\ No newline at end of file
diff --git a/NuGet.Config.meta b/NuGet.Config.meta
new file mode 100644
index 0000000..a5f7d2e
--- /dev/null
+++ b/NuGet.Config.meta
@@ -0,0 +1,2 @@
+fileFormatVersion: 2
+guid: 1b69be49e86a0a74c8ef026adbeff3e1
\ No newline at end of file