Build Firefox with SoftCloud.dev trusted CA

[tulik]

Summary

Build a Firefox artifact that trusts certificates issued by the SoftCloud.dev CA used for E2Guardian TLS interception.

Build behavior

• fetch https://ipa.softcloud.dev/ipa/config/ca.crt with curl -k -fL
• require a parseable X.509 certificate
• require Basic Constraints CA:TRUE
• log the SHA-256 certificate fingerprint
• convert the certificate to NSS builtin-root data with nss-addbuiltin
• grant trust for TLS server authentication only (C,,)
• remove CKA_NSS_MOZILLA_CA_POLICY so this private CA is not marked as a Mozilla public CA
• build and package Firefox from the modified NSS trust data
• never store or request the CA private key

Safety / verification

The helper is fail-closed and has regression tests covering:

• valid CA acceptance
• CA:FALSE rejection
• SHA-256 fingerprint logging
• TLS-server-only NSS trust
• idempotent repeated execution
• no Mozilla public-CA policy marker

Important trust-model note

This intentionally follows the requested curl -k design. The fingerprint is logged for audit, not pinned. Therefore the build trusts whichever valid CA:TRUE certificate the endpoint returns at build time. Pinning an expected SHA-256 fingerprint would provide stronger build-time authenticity but is deliberately not part of this change.

No private CA key material is included anywhere in the repository or Firefox artifact.