Cant get ssl cert durring fixed output drv

Help
1

Im trying to build an app that uses download im running the commands that download extra things in separate fixed output derivations but they are throwing this error

GotError [RequestError]: unable to get local issuer certificate
    at ClientRequest.<anonymous> (/build/source/node_modules/got/index.js:182:22)
    at Object.onceWrapper (node:events:633:26)
    at ClientRequest.emit (node:events:518:28)
    at emitErrorEvent (node:_http_client:104:11)
    at TLSSocket.socketErrorListener (node:_http_client:518:5)
    at TLSSocket.emit (node:events:518:28)
    at emitErrorNT (node:internal/streams/destroy:170:8)
    at emitErrorCloseNT (node:internal/streams/destroy:129:3)
    at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
  host: 'github.com',
  hostname: 'github.com',
  method: 'GET',
  path: '/Mechanical-Advantage/AdvantageScopeAssets/releases/download/default-assets-v2/Field2d_2025FRCFieldWeldedV2.zip',
  protocol: 'https:',
  url: 'https://github.com/Mechanical-Advantage/AdvantageScopeAssets/releases/download/default-assets-v2/Field2d_2025FRCFieldWeldedV2.zip'
}

it should be able to fetch it because its in a fixed output derivation, so im not sure why it cant get the certificate.

advantagescope.nix

{
  lib,
  buildNpmPackage,
  fetchFromGitHub,
  emscripten,
  electron,
  nodejs
}:
let
    pname = "AdvantageScope";
    version = "4.1.7";
    src = fetchFromGitHub {
        owner = "me-it-is";
        repo = "AdvantageScope";
        #tag = "v${finalAttrs.version}";
        rev = "main";
        hash = "sha256-fipv+0jzKrAArMexV22AhGtFL2agEXLkwIynPAAjRkc=";
    }; 
    docs = import ./docs.nix {
        inherit buildNpmPackage;
        inherit pname;
        inherit version;
        inherit src;
    };
    assets = import ./assets.nix {
        inherit buildNpmPackage;
        inherit pname;
        inherit version;
        inherit src;
        inherit nodejs;
        inherit npmDepsHash;
    };
    licenses = import ./licenses.nix {
        inherit buildNpmPackage;
        inherit pname;
        inherit version;
        inherit src;
        inherit nodejs;
        inherit npmDepsHash;
    };
    npmDepsHash = "sha256-eXdJojXZ40/avMKzWAsw87t8xobYKO/es3h5HxJ1cA8=";
in 
buildNpmPackage (finalAttrs: {
    inherit pname;
    inherit version;
    inherit src;

    inherit npmDepsHash;    
    makeCacheWritable = true;
    npmFlags = [ "--legacy-peer-deps" "--ignore-scripts" ];
    dontStrip = true;

    preBuild = ''
        cd $TMPDIR
        export EMSCRIPTENCACHE=$(mkdir emscriptencache)
        cd $./source
    '';
    buildPhase = ''
        npm run compile
        npm run wasm:compile
        cp -r ${docs} ./docs/build/
        cp ${assets}/eng.traineddata.gz ./
        cp ${licenses}/licenses.json ./src/
        cp -r ${electron.dist} electron-dist
        chmod -R u+w electron-dist
        npx electron-builder build -l -c.electronDist=electron-dist -c.electronVersion=${electron.version}
    '';
    installPhase = ''
        cp -r ./dist $out
    '';

    meta = {
        description = "AdvantageScope is a robot diagnostics, log review/analysis, and data visualization application for FIRST teams developed by Team 6328";
        homepage = "https://docs.advantagescope.org/";
        license = lib.licenses.mit;
        maintainers = with lib.maintainers; [ ];
    };

    nativeBuildInputs = [ emscripten electron nodejs ];
    buildInputs = [ emscripten electron nodejs ];
})

docs.nix

{
  buildNpmPackage,
  src,
  pname,
  version
}:
buildNpmPackage (finalAttrs: {
  pname = pname + "docs";
  inherit version;

  inherit src;
  sourceRoot = "${finalAttrs.src.name}/docs";
  npmDepsHash = "sha256-BhFRRsRKujqOaBnkkco2HdNaiANTX3v4LBl+NH05lZw=";
  dontStrip = true;
  buildPhase = ''
    npm run build-embed
  '';
  installPhase = ''
    ls
    cp -r ./build $out
  '';
})

assets.nix

{
  buildNpmPackage,
  src,
  pname,
  version,
  nodejs,
  npmDepsHash
}:
buildNpmPackage (finalAttrs: {
  pname = pname + "assets";
  inherit version;
  inherit src;

  inherit npmDepsHash;
  makeCacheWritable = true;
  npmFlags = ["--ignore-scripts"];

  buildPhase = ''
    node bundleLiteAssets.mjs
  '';
  installPhase = ''
    cp ./eng.traineddata.gz $out
  '';

  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
  outputHash = "";

  buildInputs = [nodejs];
})

licenses.nix

{
  buildNpmPackage,
  src,
  pname,
  version,
  nodejs,
  npmDepsHash
}:
buildNpmPackage (finalAttrs: {
  pname = pname + "licenses";
  inherit version;
  inherit src;

  inherit npmDepsHash;
  makeCacheWritable = true;
  npmFlags = ["--ignore-scripts"];

  buildPhase = ''
    node getLicenses.mjs
  '';
  installPhase = ''
    cp ./src/licenses.json $out
  '';

  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
  outputHash = "";

  buildInputs = [nodejs];
})
2

Wild guess, you might need cacert in your FODs.

3

how would i get the cert to add from nix? edit i was able to get it working by adding this to my build phase export NODE_EXTRA_CA_CERTS="${cacert}/etc/ssl/certs/ca-bundle.crt"