feat: optional embedded Mozilla fallback roots (EMBED_CA=1)

Build tag embedca blank-imports x/crypto/x509roots/fallback: the
embedded bundle activates only when the system provides no certificate
pool, so HTTPS plugins work on minimal images (OpenWrt before 21.02,
bare buildroot) without ca-certificates. Off by default; costs ~160KB
when enabled.

Signed-off-by: Date Huang <tjjh89017@hotmail.com>

Author: tjjh89017

.golangci.yaml

@@ -3,6 +3,7 @@ run:
   # builtin_all lints every built-in at once; GOOS is swept by `make lint`.
   build-tags:
     - builtin_all
+    - embedca
 linters:
   enable:
     - protogetter

Makefile

@@ -9,6 +9,9 @@ TRIMPATH ?= 1
 UPX ?= 0
 EXTRA_MIN ?= 0
 BUILTIN ?= all
+# EMBED_CA=1 embeds the Mozilla root bundle (build tag embedca), used only
+# when the system has no CA store. For images without ca-certificates.
+EMBED_CA ?= 0
 # Empty selects the per-platform default from the internal/wg build constraints:
 # wgcli on freebsd, wgctrl elsewhere. Set to override.
 BACKEND ?=
@@ -49,9 +52,14 @@ ifeq ($(BUILTIN),all)
 	override BUILTIN := builtin_all
 endif
 
-# Combine BUILTIN and BACKEND tags. An empty BACKEND adds no tag, leaving the
-# backend choice to the build constraints in internal/wg.
-ALL_TAGS := $(strip $(BUILTIN) $(BACKEND))
+CA_TAG =
+ifneq ($(EMBED_CA),0)
+	CA_TAG := embedca
+endif
+
+# Combine BUILTIN, BACKEND and EMBED_CA tags. An empty BACKEND adds no tag,
+# leaving the backend choice to the build constraints in internal/wg.
+ALL_TAGS := $(strip $(BUILTIN) $(BACKEND) $(CA_TAG))
 TAGS_FLAGS = $(if $(ALL_TAGS),-tags '$(ALL_TAGS)',)
 
 UPX_TARGET =

embedca.go

@@ -0,0 +1,8 @@
+//go:build embedca
+
+package main
+
+// The embedded Mozilla roots activate only when the system provides no
+// certificate store, so HTTPS plugins work on minimal images (e.g. OpenWrt
+// before 21.02, bare buildroot) without a ca-certificates package.
+import _ "golang.org/x/crypto/x509roots/fallback"

go.mod

@@ -11,6 +11,7 @@ require (
 	go.uber.org/mock v0.6.0
 	go.yaml.in/yaml/v3 v3.0.4
 	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto/x509roots/fallback v0.0.0-20260723152544-d701c51f7e4e
 	golang.org/x/net v0.57.0
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 )

go.sum

@@ -60,6 +60,8 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20260723152544-d701c51f7e4e h1:9TjMDOuGaMMTP5f7GXeHeA0JvFqGmv4DYRIWkzoePGI=
+golang.org/x/crypto/x509roots/fallback v0.0.0-20260723152544-d701c51f7e4e/go.mod h1:+UoQFNBq2p2wO+Q6ddVtYc25GZ6VNdOMyyrd4nrqrKs=
 golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
 golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=