Install CA certificates for HF Space upstream git clone

Dockerfile

@@ -12,7 +12,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright
 # Install system dependencies in one layer, clear APT cache
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        build-essential python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git && \
+        build-essential ca-certificates python3 ripgrep ffmpeg gcc python3-dev libffi-dev procps git && \
     rm -rf /var/lib/apt/lists/*
 
 # Non-root user for runtime; UID can be overridden via HERMES_UID at runtime

tests/hermes_cli/test_space_web_ui_runtime_requirements.py

@@ -15,3 +15,9 @@ def test_space_dockerfile_keeps_latest_web_ui_install_path():
 
     assert "ARG HERMES_WEB_UI_VERSION=latest" in dockerfile
     assert 'npm install -g --no-audit "hermes-web-ui@${HERMES_WEB_UI_VERSION}"' in dockerfile
+
+
+def test_space_dockerfile_installs_ca_certificates_for_git_clone():
+    dockerfile = Path("Dockerfile").read_text(encoding="utf-8")
+
+    assert "ca-certificates" in dockerfile