stdenv: set SSL_CERT_FILE only if it isn't already

[abbradar]

This would fix fetchcargo breakage caused by it setting SSL_CERT_FILE in the derivation, which would later be overridden by stdenv. This is very low-priority because workaround is available (testing in progress), but sounds nice to fix.

Things done:

• Fits CONTRIBUTING.md.

(Other points are removed because they are not applicable there IMHO)

[mention-bot]

By analyzing the blame information on this pull request, we identified @edolstra, @urkud and @vcunat to be potential reviewers

[domenkozar]

did you check original commit that added this and checked it still fits the purpose?

[abbradar]

The original hack was added in 788da68. Its purpose IIUC is to force SSL to skip searching CA bundle in system paths (which it does when the variable is not set) and fail instead. Therefore, if the variable is set by derivation already, it can be assumed that its author intended SSL to find its CA bundle where pointed. Search in system paths would be skipped either way.

cc @edolstra to check my reasoning

EDIT: By SSL here I mean SSL-as-library for some language (OpenSSL, LibreSSL, rust-ssl and so on).

[vcunat]

I probably don't fully understand the advantages of setting SSL_CERT_FILE=/no-cert-file.crt. It seems to be of no use if one builds with sandboxing and only little use when building without it. Note that it breaks https in nix-shell, and people tend to expect that to work, at least without --pure.

[peti]

I also believe that this change is of dubious value because of the reasons given in #13744 (comment).

[vcunat]

Oh, thanks for the link. It's hard to find one's way in our heap of tickets.