Using nss-3.115.1-1.fc42.x86_64 trying to set the "c" trust flag on a certificate is not stored.

$ certutil -N -d /tmp/nssdb --empty-password
$ certutil -A -d /tmp/nssdb -n test -t C,c,p -a -i ~/ca.crt
$ certutil -L -d /tmp/nssdb/

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

test                                                         C,,p 

Using the previous version, nss-3.109.0-1.fc42.x86_64, works as expected.

<same steps to create the db, import cert, etc>
$ certutil -L -d /tmp/nssdb

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

test                                                         C,c,p

This regression was discovered by the certmonger unit tests and is preventing updating the package because the unit tests are run in the %check step. So it is a blocker in that regard.


Reproducible: Always

Steps to Reproduce:
Put a valid CA certificate into ~/ca.crt

1. mkdir /tmp/nssdb
2. certutil -N -d /tmp/nssdb --empty-password
3. certutil -A -d /tmp/nssdb -n test -t C,c,p -a -i ~/ca.crt
4. certutil -L -d /tmp/nssdb
Actual Results:
Missing c (valid ca) flag

Expected Results:
The c flag set