golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810: embed fallback x509 trusted roots in application

# Embedding Fallback X.509 Trusted Roots in Go Applications

## Known Solution Search
A search for existing community-verified samples targeting `golang.org/x/crypto/x509roots/fallback` returned no prior matches (`NO_SAFE_MATCH`).

## Pinned Release
- Package: `golang.org/x/crypto/x509roots/fallback`
- Version: `v0.0.0-20250305170421-49bf5b80c810` (declared in `go.mod` and resolved in `go.sum`)
- Runtime: Go (`golang@1` adapter)

## Observed Behaviour
The `golang.org/x/crypto/x509roots/fallback` package embeds Mozilla's root certificate bundle and automatically configures fallback roots during application startup.

1. **Automatic Initialization via `init()`**:
   When imported as a blank import (`import _ "golang.org/x/crypto/x509roots/fallback"`), the package's `init()` function loads the embedded root certificates into a new certificate pool and registers them with `crypto/x509` using `x509.SetFallbackRoots`.

2. **Single-Invocation Enforcement**:
   Go's `crypto/x509.SetFallbackRoots` is restricted to a single invocation per process lifecycle. Any subsequent call to `x509.SetFallbackRoots` panics immediately, verifying that the fallback root pool is already registered.

3. **Fallback Certificate Pool Availability**:
   The registered fallback roots ensure that `x509.SystemCertPool()` returns a valid root certificate pool or that TLS/X.509 certificate verification functions correctly even in minimal environments (such as distroless containers) without host system CA bundles.

## Failure Mode
Applications deployed to minimal environments lacking host CA certificates fail TLS connections with root verification errors unless fallback roots are embedded via `golang.org/x/crypto/x509roots/fallback`.

{"case":{"caseId":"case:sha256:d7c6f5787da38ac571f7147a851e88cd9f1805a4bab443e2baf043a9c5569285","contract":["Blank-importing golang.org/x/crypto/x509roots/fallback registers an embedded X.509 root certificate pool via x509.SetFallbackRoots during package initialization.","Attempting a subsequent invocation of x509.SetFallbackRoots panics because the fallback roots have already been configured.","The registered fallback root certificates are available to the Go x509 certificate verification system when system certificate pools are unavailable or when x509usefallbackroots=1 is enabled."],"goal":"embed fallback x509 trusted roots in application","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto/x509roots/fallback@v0.0.0-20250305170421-49bf5b80c810"],"schemaVersion":1},"contractCommand":["go","test","./..."],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto/x509roots/fallback@v0.0.0-20250305170421-49bf5b80c810"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto/x509roots/fallback@v0.0.0-20250305170421-49bf5b80c810","verifierAdapter":"golang@1"}

module example.com/fallbackroots

go 1.23.0

require golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810

golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810 h1:V5+zy0jmgNYmK1uW/sPpBw8ioFvalrhaUrYWmu1Fpe4=
golang.org/x/crypto/x509roots/fallback v0.0.0-20250305170421-49bf5b80c810/go.mod h1:lxN5T34bK4Z/i6cMaU7frUU57VkDXFD4Kamfl/cp9oU=

package fallbackroots_test

import (
	"crypto/x509"
	"testing"

	_ "golang.org/x/crypto/x509roots/fallback"
)

func TestFallbackRootsInitialization(t *testing.T) {
	// 1. Importing golang.org/x/crypto/x509roots/fallback sets fallback roots in init().
	// Calling x509.SetFallbackRoots again must panic since it is only allowed to be called once.
	defer func() {
		r := recover()
		if r == nil {
			t.Fatalf("expected SetFallbackRoots to panic on duplicate call, but it succeeded")
		}
	}()

	extraPool := x509.NewCertPool()
	x509.SetFallbackRoots(extraPool)
}

func TestSystemCertPoolAvailability(t *testing.T) {
	// 2. Verify that a certificate pool can be obtained from the system or fallback roots
	pool, err := x509.SystemCertPool()
	if err != nil {
		t.Fatalf("failed to retrieve system/fallback certificate pool: %v", err)
	}
	if pool == nil {
		t.Fatalf("expected non-nil certificate pool")
	}
}