build: finish cross-platform release tooling

src/tools/tools.c

@@ -659,9 +659,10 @@ static int plan_patch(const char *ws, const char *patch, patch_plan_t *pl,
     pl->full[i] = malloc(OS_PATH_MAX);
     if (!pl->full[i] ||
         cst_sandbox_resolve(ws, target, pl->full[i], OS_PATH_MAX) != 0) {
-      if (dry && pl->full[i] && !pl->del[i] && is_new) {
+      if (dry && pl->full[i] && !pl->del[i] && is_new &&
+          strlen(target) < OS_PATH_MAX) {
         /* parent dirs do not exist yet; the write would create them */
-        snprintf(pl->full[i], OS_PATH_MAX, "%s", target);
+        memcpy(pl->full[i], target, strlen(target) + 1);
       } else {
         snprintf(err, err_sz, "error: path outside workspace: %.200s",
                  target);

src/tools/web.c

@@ -215,6 +215,7 @@ int cst_tool_web_fetch(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c,
   memset(&f, 0, sizeof(f));
   char errbuf[CURL_ERROR_SIZE];
   errbuf[0] = 0;
+  cst_curl_apply_ca(curl);
   curl_easy_setopt(curl, CURLOPT_URL, url);
   curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
   curl_easy_setopt(curl, CURLOPT_MAXREDIRS, 5L);