dprint: use system CA by default (#576933)

pkgs/by-name/dp/dprint/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   rustPlatform,
   buildPackages,
+  makeBinaryWrapper,
   installShellFiles,
   pkg-config,
   zstd,
@@ -30,6 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-oz7Y31PncII6J/XoKHwmvhvvX5F7lBHRBpwxfV9zI6g=";
 
   nativeBuildInputs = [
+    makeBinaryWrapper
     installShellFiles
     pkg-config
   ];
@@ -59,13 +61,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   checkFlags = [
-    # Require creating directory and network access
-    "--skip=plugins::cache_fs_locks::test"
-    "--skip=utils::lax_single_process_fs_flag::test"
     # Require cargo is running
     "--skip=utils::process::test"
-    # Requires deno for the testing, and making unstable results on darwin
-    "--skip=utils::url::test::unsafe_ignore_cert"
   ];
 
   postInstall =
@@ -76,8 +73,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
         else
           lib.getExe buildPackages.dprint;
     in
+    # dprint only supports a runtime switch (DPRINT_TLS_CA_STORE) to prefer system certs.
+    # Avoid the upstream default `mozilla,system` to reduce risks like https://github.com/NixOS/nixpkgs/issues/576485
     ''
       rm "$out/bin/test-process-plugin"
+      wrapProgram "$out/bin/dprint" \
+        --set-default DPRINT_TLS_CA_STORE system
       export DPRINT_CACHE_DIR="$(mktemp -d)"
       installShellCompletion --cmd dprint \
         --bash <(${dprint} completions bash) \