Control: tag -1 - patch + moreinfo There is more to it ...
update-ca-certificates provides the hook scripts with +/- prefixed certificates on stdin. But ca-certificates runs update-ca-certificates twice: once during configure step (without hooks, which may not be callable because their packages are not configured) and once in a deferred trigger (with hooks), but the list of changes for the second run is of course empty ... ... thinking about it ... Andreas