I have been looking at the ca-certificate story for flatpak. Currently each runtime ships a ca-certificatates bundle and is set up to use that. However, that is basically wrong, what we want to do is expose the ca-certs from the host (in a read-only fashion). I looked into exporting the raw files, but it seems like every distro is doing things in their own way, so this seems pretty painful.

Instead we could rely on the host shipping with p11-kit, and bind-mount a unix socket into the sandbox in a well known location (this is how we expose X11/wayland/pulseaudio too). Then the runtime/apps could be configured with modules to get ca:s from there.

Would this be a reasonable approach? And would it work for both OpenSSL and gnutls? Does it work already, or does it require any p11-kit work?