curl: Set cabundle in configure. Closes NixOS#3382

pkgs/tools/networking/curl/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchurl
 , zlibSupport ? false, zlib ? null
 , sslSupport ? false, openssl ? null
+, withCacert ? false, cacert ? null
 , scpSupport ? false, libssh2 ? null
 , gssSupport ? false, gss ? null
 , c-aresSupport ? false, c-ares ? null
@@ -9,6 +10,7 @@
 
 assert zlibSupport -> zlib != null;
 assert sslSupport -> openssl != null;
+assert withCacert -> cacert != null;
 assert scpSupport -> libssh2 != null;
 assert c-aresSupport -> c-ares != null;
 
@@ -41,6 +43,7 @@ stdenv.mkDerivation rec {
       ( if scpSupport then "--with-libssh2=${libssh2}" else "--without-libssh2" )
     ]
     ++ stdenv.lib.optional c-aresSupport "--enable-ares=${c-ares}"
+    ++ stdenv.lib.optional withCacert "--with-ca-bundle=${cacert}/etc/ca-bundle.crt"
     ++ stdenv.lib.optional gssSupport "--with-gssapi=${gss}"
     ++ stdenv.lib.optionals linkStatic [ "--enable-static" "--disable-shared" ]
   ;

pkgs/top-level/all-packages.nix

@@ -827,6 +827,7 @@ let
   curl = callPackage ../tools/networking/curl rec {
     fetchurl = fetchurlBoot;
     zlibSupport = true;
+    withCacert = true;
     sslSupport = zlibSupport;
     scpSupport = zlibSupport && !stdenv.isSunOS && !stdenv.isCygwin;
   };
@@ -7887,7 +7888,13 @@ let
 
   bakoma_ttf = callPackage ../data/fonts/bakoma-ttf { };
 
-  cacert = callPackage ../data/misc/cacert { };
+  cacert =
+    let
+      fetchurl = import ../build-support/fetchurl {
+        inherit stdenv;
+        curl = curl.override { withCacert = false; };
+      };
+    in callPackage ../data/misc/cacert { inherit fetchurl; };
 
   cantarell_fonts = callPackage ../data/fonts/cantarell-fonts { };