fix: resolve loading certificates root certs

Author: patrickjcasey

Cargo.lock

@@ -47,11 +47,14 @@ env_logger = { version = "0.11.6" }
 flate2 = "1.0.35"
 fs_extra = "1.3.0"
 futures = "0.3.31"
-gix = { version = "0.70.0", features = [
+gix = { version = "0.70.0", default-features = false, features = [
+    "basic",
+    "dirwalk",
+    "worktree-mutation",
     "max-control",
     # use reqwest/rustls to avoid needing openssl
     "blocking-http-transport-reqwest-rust-tls",
-    "zlib-stock"
+    "zlib-stock",
 ] }
 # Include with both a `path` and `version` reference.
 # Local builds will use the `path` dependency, which may be a newer
@@ -70,7 +73,7 @@ log = "0.4.25"
 logos = "0.15.0"
 miette = { version = "7.4.0", features = ["fancy"] }
 minijinja = "2.7.0"
-minijinja-contrib = { version ="2.7.0", features = ["datetime"] }
+minijinja-contrib = { version = "2.7.0", features = ["datetime"] }
 nom = "7.1.3"
 num-traits = "0.2.19"
 once_cell = "1.20.3"
@@ -98,7 +101,7 @@ rustls = { version = "0.23.10", default-features = false, features = [
     "ring",
 ] }
 rustls-native-certs = "0.8.1"
-salsa = { git = "https://github.com/mitre/salsa.git", tag = "hipcheck-v3.11.0"}
+salsa = { git = "https://github.com/mitre/salsa.git", tag = "hipcheck-v3.11.0" }
 schemars = { version = "0.8.21", default-features = false, features = [
     "derive",
     "preserve_order",
@@ -141,6 +144,18 @@ hipcheck-common = { version = "0.3.0", path = "../hipcheck-common", features = [
 ] }
 serde_with = "3.12.0"
 
+# This is needed to force reqwest, which is used by gix, to build reqwest with support
+# for rustls-tls-native-roots, which is needed to automatically configure system certificates
+[dependencies.reqwest]
+version = "0.12"
+default-features = false
+features = [
+    "blocking",
+    "http2",
+    "rustls-tls-native-roots",
+    "macos-system-configuration",
+]
+
 [build-dependencies]
 
 anyhow = "1.0.96"