fix(console): netcheck - option b points to the device's manual

How a CA gets into the trust store depends on who builds and configures
the device: custom_ca_certs, or the vendor's image. The report cannot
know which, so it refers to the manual; the API docs name both ways and
ask vendors to describe theirs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon Walz <contact@simonwalz.de>

Author: simonwalz

docs/common/cuos-api.md

@@ -156,8 +156,11 @@ failure behind it.
   inspection is a supported mode, as update images are verified by digest, not
   by trusting the connection. Any other CA is an error
   with two ways out: exempt the registry from inspection, or have the inspection
-  CA added to the device — by its vendor, in the image, or in `custom_ca_certs`
-  where the customer manages the system configuration.
+  CA added to the device's trust store. The report refers to the device's
+  manual for how, since that depends on who builds and configures the device:
+  in CuOS it is `custom_ca_certs` in `system.json`, or the CA built into the
+  image. A vendor shipping CuOS-based devices should describe this in its
+  manual.
 - **Credentials** are checked by a `docker login` through the docker daemon,
   into a temporary client configuration — the daemon is what pulls the update,
   with its own TLS implementation.

system/cuos/netcheck.sh

@@ -686,7 +686,7 @@ check_cert_ca() {
       record cert_ca error "issued by an unknown CA (TLS inspection?)" \
         "The connection is probably inspected by a device whose CA this device does not trust. Two options, both supported:
 a) Exempt ${HOST} from TLS inspection.
-b) Have the CA certificate of the inspection added to the device: ask the vendor of the device to include it in its image, or, if you manage the system configuration of the device yourself, add it to custom_ca_certs.
+b) Have the CA certificate of the inspection added to the trust store of the device, as described in the device's manual.
 Note: with b) the inspection infrastructure sees this traffic, credentials included, in clear text; securing it is your responsibility."
       ;;
     *)

system/cuos/netcheck.test.sh

@@ -285,8 +285,7 @@ MOCK_SYS="60 20"
 run
 expect "unknown CA: error" "[ERROR]" line "Certificate / CA"
 expect "unknown CA: option a" "yes" has "a) Exempt registry.example.org from TLS inspection."
-expect "unknown CA: option b, the vendor" "yes" has "vendor of the device to include it in its image"
-expect "unknown CA: option b, custom_ca_certs" "yes" has "add it to custom_ca_certs"
+expect "unknown CA: option b" "yes" has "b) Have the CA certificate of the inspection added to the trust store"
 expect "unknown CA: the hostname is still checked" "[OK]" line "Hostname"
 expect "unknown CA: the connection is skipped" "[SKIPPED]" line "TLS connection"