core: add "tls-ca-path" option

Some organizations will want to use private Certificate Authorities to
serve content to their clients.  While it's possible to add the CA
to the system-wide CA store, that has two drawbacks:

1) Compromise of that cert means it can be used for other web traffic
2) All of ca-certificates is trusted

This patch allows a much stronger scenario where *only* the CAs in
tls-ca-path are used for verification from the given repository.

https://bugzilla.gnome.org/show_bug.cgi?id=726256

src/libostree/ostree-repo-pull.c

@@ -1129,6 +1129,22 @@ ostree_repo_pull (OstreeRepo               *self,
       }
   }
 
+  {
+    gs_free char *tls_ca_path = NULL;
+    gs_unref_object GTlsDatabase *db = NULL;
+
+    if (!ot_keyfile_get_value_with_default (config, remote_key,
+                                            "tls-ca-path",
+                                            NULL, &tls_ca_path, error))
+      goto out;
+
+    db = g_tls_file_database_new (tls_ca_path, error);
+    if (!db)
+      goto out;
+
+    _ostree_fetcher_set_tls_database (pull_data->fetcher, db);
+  }
+
   if (!pull_data->base_uri)
     {
       g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED,