Hello,

On core-updates-frozen, the ca-certificate-bundle derivation produces an
empty output. That's because nss-certs only contains .crt files that are
ignored by ca-certificate-bundle procedure.

The following patches should fix the situation.

Thanks,

Mathieu