Read system certs directly from /etc/ssl

[masnax]

If LXD failed to pick up system certs from /etc/ssl via x509.SystemCertPool (https://pkg.go.dev/crypto/x509#SystemCertPool and https://cs.opensource.google/go/go/+/master:src/crypto/x509/root_linux.go) then it would try to read /var/lib/snapd/hostfs/etc/ssl, which is itself symlinked to /etc/ssl in the LXD snap confinement.

As of https://forum.snapcraft.io/t/custom-certificate-support/28168, snaps should be able to read /etc/ssl directly, so this makes the second check redundant. Additionally, any other snap using ConnectLXD should be able to read the system certs as well, though they may fail to read /var/lib/snapd/hostfs.

[simondeziel]

@masnax I think that https://pkg.go.dev/crypto/x509#SystemCertPool and https://cs.opensource.google/go/go/+/master:src/crypto/x509/root_linux.go suggest that this is already done by default. Same for Windows but a bit more opaque https://cs.opensource.google/go/go/+/master:src/crypto/x509/root_windows.go

[masnax]

@masnax I think that https://pkg.go.dev/crypto/x509#SystemCertPool and https://cs.opensource.google/go/go/+/master:src/crypto/x509/root_linux.go suggest that this is already done by default. Same for Windows but a bit more opaque https://cs.opensource.google/go/go/+/master:src/crypto/x509/root_windows.go

Hm, in that case the whole block was always redundant.