the cacert file is uploaded to the s3 bucket and cached so it won't be changing.

of course that exposes the problem that 3 years from now we'll have a stale cacert.pem file, but you basically pick your poison here, and repeatable builds seemed the better choice.