ci: trust bundled CAs during NuGet publish

.gitea/workflows/publish-nuget.yml

@@ -17,6 +17,7 @@ jobs:
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: '1'
       DOTNET_CLI_TELEMETRY_OPTOUT: '1'
       LD_LIBRARY_PATH: /opt/dotnet-libs/usr/lib/x86_64-linux-gnu
+      SSL_CERT_FILE: /opt/ca-certificates.crt
     steps:
       - name: Fetch exact tagged source
         env:
@@ -51,6 +52,9 @@ jobs:
           set -euo pipefail
           node --input-type=module <<'NODE'
           import { writeFile } from 'node:fs/promises';
+          import { rootCertificates } from 'node:tls';
+
+          await writeFile('/opt/ca-certificates.crt', rootCertificates.join('\n'));
 
           const metadataResponse = await fetch('https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json');
           if (!metadataResponse.ok) throw new Error(`Release metadata download failed: ${metadataResponse.status}`);

Directory.Build.props.meta

@@ -0,0 +1,7 @@
+fileFormatVersion: 2
+guid: d140bb75fc94441478cc9940e7c72b25
+DefaultImporter:
+  externalObjects: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

NuGet.Config.meta

@@ -0,0 +1,32 @@
+fileFormatVersion: 2
+guid: 1ab0ff9bd01e028498ce7014915607a9
+PluginImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  iconMap: {}
+  executionOrder: {}
+  defineConstraints: []
+  isPreloaded: 0
+  isOverridable: 0
+  isExplicitlyReferenced: 0
+  validateReferences: 1
+  platformData:
+  - first:
+      Any: 
+    second:
+      enabled: 0
+      settings: {}
+  - first:
+      Editor: Editor
+    second:
+      enabled: 0
+      settings:
+        DefaultValueInitialized: true
+  - first:
+      Windows Store Apps: WindowsStoreApps
+    second:
+      enabled: 1
+      settings: {}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: