# Vendored NSS certutil

Runestone vendors NSS `certutil` so `runestone certs install` can import the
Runestone root CA into Firefox/Chrome NSS databases without requiring users to
install `libnss3-tools`.

The current binaries were extracted from Homebrew bottles:

- `nss` 3.125
- `nspr`
- `sqlite`

Supported layouts:

- `linux-x64/certutil`
- `linux-arm64/certutil`
- `darwin-x64/certutil`
- `darwin-arm64/certutil`

Each platform directory includes a `lib/` folder with the runtime libraries
needed by that `certutil` binary. The CLI sets the platform library path before
spawning `certutil`.
