From 533d703c9756ff1a632781c7111645b8d69aba9c Mon Sep 17 00:00:00 2001
From: Mikhail Chusavitin <mchusavitin@mchusmbp.local>
Date: Wed, 15 Apr 2026 17:24:20 +0300
Subject: [PATCH] Bootstrap ca-certificates so NVIDIA CUDA HTTPS source is
 trusted

debootstrap creates a minimal chroot without ca-certificates, causing
apt-get update to fail TLS verification for the NVIDIA CUDA apt source:
  "No system certificates available. Try installing ca-certificates."
Add ca-certificates to --bootstrap-packages so it is present before
lb chroot_archives configures the NVIDIA HTTPS source and runs apt-get update.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 iso/builder/auto/config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/iso/builder/auto/config b/iso/builder/auto/config
index c5217a2..12e636f 100755
--- a/iso/builder/auto/config
+++ b/iso/builder/auto/config
@@ -33,6 +33,7 @@ lb config noauto \
     --iso-volume "EASY_BEE_${BEE_GPU_VENDOR_UPPER:-NVIDIA}" \
     --iso-application "EASY-BEE-${BEE_GPU_VENDOR_UPPER:-NVIDIA}" \
     --bootappend-live "boot=live components video=1920x1080 console=tty0 console=ttyS0,115200n8 loglevel=3 systemd.show_status=1 username=bee user-fullname=Bee modprobe.blacklist=nouveau,snd_hda_intel,snd_hda_codec_realtek,snd_hda_codec_generic,soundcore" \
+    --bootstrap-packages "ca-certificates" \
     --apt-recommends false \
     --chroot-squashfs-compression-type zstd \
     "${@}"