alt Hacker NewsWhy don't these massive package managers use the host OS CA store, with an optional preconfigured "additional" store if clients need them?
Is the update cadence of CAs that different between the sources? Is the list of CAs included so different from OS vendors and the package managers?
Creating a dependency on OS specific APIs solves this one niche problem but causes a hundred more.