From 67404c98d9090e25988816f2f44f0d1a2e6db0c5 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Mon, 20 Apr 2026 02:09:24 +0900
Subject: [PATCH] internal/rosa/nss: install buildcatrust from source

Dependencies are now available, so this no longer has to rely on the release.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 internal/rosa/nss.go | 36 +++++++++++++++---------------------
 1 file changed, 15 insertions(+), 21 deletions(-)

diff --git a/internal/rosa/nss.go b/internal/rosa/nss.go
index 2c493786..4f010699 100644
--- a/internal/rosa/nss.go
+++ b/internal/rosa/nss.go
@@ -82,30 +82,24 @@ func init() {
 	}
 }
 
-func (t Toolchain) newBuildCATrust() (pkg.Artifact, string) {
+func init() {
 	const (
 		version  = "0.5.1"
-		checksum = "g9AqIksz-hvCUceSR7ZKwfqf8Y_UsJU_3_zLUIdc4IkxFVkgdv9kKVvhFjE4s1-7"
+		checksum = "oxjnuIrPVMPvD6x8VFLqB7EdbfuhouGQdtPuHDpEHGzoyH5nkxqtYN9UthMY9noA"
+	)
+	artifactsM[buildcatrust] = newPythonPackage(
+		"buildcatrust", 233988,
+		"transform certificate stores between formats",
+		"https://github.com/nix-community/buildcatrust",
+		version, newFromGitHub(
+			"nix-community/buildcatrust",
+			"v"+version, checksum,
+		), &PackageAttr{
+			ScriptEarly: `
+rm buildcatrust/tests/test_nonhermetic.py
+`,
+		}, nil, P{PythonFlitCore},
 	)
-	return t.newViaPip("buildcatrust", version,
-		"https://github.com/nix-community/buildcatrust/releases/"+
-			"download/v"+version+"/buildcatrust-"+version+"-py3-none-any.whl",
-		checksum), version
-}
-func init() {
-	artifactsM[buildcatrust] = Metadata{
-		f: Toolchain.newBuildCATrust,
-
-		Name:        "buildcatrust",
-		Description: "transform certificate stores between formats",
-		Website:     "https://github.com/nix-community/buildcatrust",
-
-		Dependencies: P{
-			Python,
-		},
-
-		ID: 233988,
-	}
 }
 
 func (t Toolchain) newNSSCACert() (pkg.Artifact, string) {