Make libcurl respect the SSL_CERT_{DIR,FILE} variables by default. The variables
are fetched during initialization to preserve thread-safety (curl_global_init(3)
must be called when no other threads exist).

This fixes network functionality in rust:cargo, and probably removes the need
for other future workarounds.
===================================================================
--- curl-8.5.0.orig/lib/easy.c	2023-12-17 00:36:32.400468561 -0500
+++ curl-8.5.0/lib/easy.c	2023-12-17 00:39:08.898612331 -0500
@@ -137,6 +137,9 @@
 static char *leakpointer;
 #endif

+char * Curl_ssl_cert_dir = NULL;
+char * Curl_ssl_cert_file = NULL;
+
 /**
  * curl_global_init() globally initializes curl given a bitwise set of the
  * different features of what to initialize.
@@ -163,6 +166,9 @@
     goto fail;
   }

+  Curl_ssl_cert_dir = curl_getenv("SSL_CERT_DIR");
+  Curl_ssl_cert_file = curl_getenv("SSL_CERT_FILE");
+
   if(!Curl_ssl_init()) {
     DEBUGF(fprintf(stderr, "Error: Curl_ssl_init failed\n"));
     goto fail;
@@ -287,6 +293,9 @@
   Curl_ssl_cleanup();
   Curl_resolver_global_cleanup();

+  free(Curl_ssl_cert_dir);
+  free(Curl_ssl_cert_file);
+
 #ifdef _WIN32
   Curl_win32_cleanup(easy_init_flags);
 #endif
diff -ur curl-7.66.0.orig/lib/url.c curl-7.66.0/lib/url.c
--- curl-7.66.0.orig/lib/url.c	2020-01-02 15:43:11.883921171 +0100
+++ curl-7.66.0/lib/url.c	2020-01-02 16:21:11.563880346 +0100
@@ -524,6 +524,21 @@
     if(result)
       return result;
 #endif
+    extern char * Curl_ssl_cert_dir;
+    extern char * Curl_ssl_cert_file;
+    if(Curl_ssl_cert_dir) {
+        if(result = Curl_setstropt(&set->str[STRING_SSL_CAPATH], Curl_ssl_cert_dir))
+            return result;
+        if(result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_PROXY], Curl_ssl_cert_dir))
+            return result;
+    }
+
+    if(Curl_ssl_cert_file) {
+        if(result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], Curl_ssl_cert_file))
+            return result;
+        if(result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_PROXY], Curl_ssl_cert_file))
+            return result;
+    }
   }
 
   set->wildcard_enabled = FALSE;
a href='/guix/log/tests?id=57334d189dc326594ffde8858af5d2b86f64e354'>tests</a>/<a href='/guix/log/tests/guix-time-machine.sh?id=57334d189dc326594ffde8858af5d2b86f64e354'>guix-time-machine.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-time-machine.sh?id=57334d189dc326594ffde8858af5d2b86f64e354&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2024-03-11 22:12:34 +0100'>2024-03-11</span></td><td><a href='/guix/commit/tests/guix-time-machine.sh?id=a26bce55e60aa3444c4378d3996f3aa41b9661e9'>time-machine: Allow time travels to v0.16.0.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/time-machine.scm (%oldest-possible-commit): Change to
v0.16.0.
* tests/guix-time-machine.sh: Adjust comment.

Change-Id: I9ad82bd45fee0d172b5348a8ae16e990338a3a97
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2023-11-05 23:23:23 +0100'>2023-11-05</span></td><td><a href='/guix/commit/tests/guix-time-machine.sh?id=9f05fbb67d0de4d577c21a6fb6888cb6be67cd12'>tests: Make ‘guix time-machine’ test effective.</a><span class='msg-avail'>...<span class='msg-tooltip'>The test as added in 79ec651a286c71a3d4c72be33a1f80e76a560031 had no
effect: first because ‘guix time-machine --commit=X’, not followed by a
command, does nothing, and second because the “! COMMAND” shell stanza
does not have the desired effect (see &lt;https://issues.guix.gnu.org/62406&gt;).

This change rewrites the test to make it effective.

* tests/guix-time-machine.sh: Rewrite.

Change-Id: Ib44a11331c8625e346139a236cffa699cdbd02f2
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2023-08-16 21:34:13 -0400'>2023-08-16</span></td><td><a href='/guix/commit/tests/guix-time-machine.sh?id=79ec651a286c71a3d4c72be33a1f80e76a560031'>scripts: time-machine: Error when attempting to visit too old commits.</a><span class='msg-avail'>...<span class='msg-tooltip'>* doc/guix.texi (Invoking guix time-machine): Document limitation.
* guix/inferior.scm (cached-channel-instance): New VALIDATE-CHANNELS
argument.  Use it to validate channels when there are no cache hit.
* guix/scripts/time-machine.scm
(%options): Tag the given reference with 'tag-or-commit instead of 'commit.
(%oldest-possible-commit): New variable.
(guix-time-machine) &lt;validate-guix-channel&gt;: New nested procedure.  Pass it to
the 'cached-channel-instance' call.
* tests/guix-time-machine.sh: New test.
* Makefile.am (SH_TESTS): Register it.

Suggested-by: Simon Tournier &lt;zimon.toutoune@gmail.com&gt;
Reviewed-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
Reviewed-by: Simon Tournier &lt;zimon.toutoune@gmail.com&gt;
</span></span></td><td>Maxim Cournoyer</td></tr>