#34948 missed the package nss-certs in splitting the codesigning to a separate guix manifest. This results in an error during codesigining: Use the "-CAfile" option to add one or more trusted CA certificates to verify the signature.
However, introducing the package is not enough to make codesigning work. #34550 switched us to using osslsigncode 2.13 from upstream, but osslsigncode versions 2.6 through 2.13 all require network access as they validate CRLs. While the verify command has the ability to skip CRL validation, attach-signature does not.
osslsigncode 2.14 resolves both issues for us by removing signature validation, instead it only checks that the hash in the signature matches the hash of the binary. But we still want to do a belt-and-suspenders signature validation, and we can achieve this by calling verify afterwards with CRL validation disabled to avoid the network access issue, along with including the nss-certs package.
Lastly, guix upstream already has 2.14, so we could get it by bumping the time-machine commit. But it seems like bumping that is problematic for other packages, see #36233 and #35855. Instead, this PR copies in the package definition from upstream.
