UX: Embed CA bundle as fallback (Better support for FROM scratch base image) #222

Presently chisel expects the CA bundle to exist externally to contact Github over HTTPS. It would be beneficial to have an embedded fallback (even if opt-in via CLI flag) instead of failing, as it simplifies FROM scratch image usage which can avoid an intermediary --root path + COPY from an earlier stage.

FROM scratch
SHELL ["/nu", "-c"]
# NOTE: `chisel` is a prior stage (no official image yet)
RUN --mount=type=bind,from=chisel,source=/usr/local/bin/chisel,target=/chisel \
    --mount=type=bind,from=ghcr.io/nushell/nushell,source=/usr/bin/nu,target=/nu \
    /chisel cut --release ubuntu-24.04 --root / base-files_base

0.410 2025/04/26 01:52:05 Consulting release repository...
0.603 error: cannot talk to release repository: Get "https://codeload.github.com/canonical/chisel-releases/tar.gz/refs/heads/ubuntu-24.04": tls: failed to verify certificate: x509: certificate signed by unknown authority

The binary size should not increase that much and this would allow for running chisel on FROM scratch without having to provide ca-certificates.crt upfront (which can either add extra layer weight or conflict with chisel writing to the same location that's a temporary bind mount when using --root /).

There is a Go package rootcerts which can embed the CA bundle into the Chisel build? That will be used as a fallback when there is no trust store on the filesystem to leverage. I've not explored other options for approaching this, so there might be a better option if rootcerts is not something you're comfortable with.

Reference: Another user also pointed out the concern with an external CA bundle at the end of this comment.