From 6f736f3082a1db36d667d0d6b0bd8a7641ccf61a Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 20 Oct 2026 22:38:04 -0400
Subject: [PATCH] beamPackages.hex: replace bundled CA certs with cacert

Assisted-By: Claude Opus 5.5 low in claude-code/2.1.303
---
 pkgs/development/beam-modules/hex/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/beam-modules/hex/default.nix b/pkgs/development/beam-modules/hex/default.nix
index ba8a5016a51e..b34b350907ff 100644
--- a/pkgs/development/beam-modules/hex/default.nix
+++ b/pkgs/development/beam-modules/hex/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  cacert,
   fetchFromGitHub,
   writeText,
   elixir,
@@ -27,6 +28,10 @@ let
         sha256 = "sha256-lOoD6mzctGk9xHNJiribDMVWQ9xrr2N5eluJalirESk=";
       };
 
+      postPatch = ''
+        cp ${cacert}/etc/ssl/certs/ca-bundle.crt lib/hex/http/ca-bundle.crt
+      '';
+
       setupHook = writeText "setupHook.sh" ''
         addToSearchPath ERL_LIBS "$1/lib/erlang/lib/"
       '';