Related: RHEL-44988
original issue - FC-986
Add the --output option to update-ca-trust so that trust stores can be
written to a different output directory. This is useful to prepare trust
store directories that can be used in containers.
Additionally, fix running update-ca-trust as non-root user
(specifically, without CAP_DAC_OVERRIDE) which was previously required
to create two symbolic links.
Quote all uses of $DEST since a user-specified path could contain
spaces.
