diff --git a/Mk/Uses/certs.mk b/Mk/Uses/certs.mk
deleted file mode 100644
index 755b79b507b0..000000000000
--- a/Mk/Uses/certs.mk
+++ /dev/null
@@ -1,54 +0,0 @@
-# Handle dependency on the ca_root_nss certificate bundle
-#
-# Feature:	certs
-# Usage:	USES=certs:args
-# Valid ARGS:	fetch, build, run, test
-#
-# At least one argument is required.
-#
-# fetch		ca_root_nss is added as FETCH_DEPENDS
-# build		ca_root_nss is added as BUILD_DEPENDS
-# run		ca_root_nss is added as RUN_DEPENDS
-# test		ca_root_nss is added as TEST_DEPENDS
-#
-# Examples:
-#	USES=certs:fetch,run	# Use certificates for fetch and runtime
-#	USES=certs:build	# Use certificates at build time
-#
-# MAINTAINER:	yuri@FreeBSD.org
-
-.if !defined(_INCLUDE_USES_CERTS_MK)
-_INCLUDE_USES_CERTS_MK=	yes
-
-# certificate bundle location and port
-_CERTS_DEP=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
-
-# all valid arguments
-_CERTS_ALL_ARGS=	fetch build run test
-
-.  if empty(certs_ARGS)
-IGNORE=	USES=certs requires at least one argument (${_CERTS_ALL_ARGS})
-.  endif
-
-.  if !empty(certs_ARGS:Nfetch:Nbuild:Nrun:Ntest)
-IGNORE=	USES=certs has invalid arguments: ${certs_ARGS}. Valid arguments are: ${_CERTS_ALL_ARGS}
-.  endif
-
-# Set dependencies based on arguments
-.  if ${certs_ARGS:Mfetch}
-FETCH_DEPENDS+=	${_CERTS_DEP}
-.  endif
-
-.  if ${certs_ARGS:Mbuild}
-BUILD_DEPENDS+=	${_CERTS_DEP}
-.  endif
-
-.  if ${certs_ARGS:Mrun}
-RUN_DEPENDS+=	${_CERTS_DEP}
-.  endif
-
-.  if ${certs_ARGS:Mtest}
-TEST_DEPENDS+=	${_CERTS_DEP}
-.  endif
-
-.endif # _INCLUDE_USES_CERTS_MK
diff --git a/cad/xyce/Makefile b/cad/xyce/Makefile
index f1856afb787b..3d1b816c03eb 100644
--- a/cad/xyce/Makefile
+++ b/cad/xyce/Makefile
@@ -1,84 +1,85 @@
 PORTNAME=	xyce
 DISTVERSIONPREFIX=	Release-
 DISTVERSION=	7.10.0
 PORTREVISION=	1
 CATEGORIES=	cad
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	Xyce electronic simulator
 WWW=		https://xyce.sandia.gov/ \
 		https://github.com/Xyce/Xyce
 
 LICENSE=	GPLv3
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 LIB_DEPENDS=	libblas.so:math/blas \
 		libfftw3.so:math/fftw3 \
 		liblapack.so:math/lapack \
 		libtpetra.so:science/trilinos \
 		\
 		libamd.so:math/suitesparse-amd \
 		libcholmod.so:math/suitesparse-cholmod \
 		libcolamd.so:math/suitesparse-colamd \
 		libsuitesparseconfig.so:math/suitesparse-config \
 		libumfpack.so:math/suitesparse-umfpack
 TEST_DEPENDS=	git:devel/git \
 		${PYNUMPY} \
-		${PYTHON_PKGNAMEPREFIX}scipy>0:science/py-scipy@${PY_FLAVOR}
+		${PYTHON_PKGNAMEPREFIX}scipy>0:science/py-scipy@${PY_FLAVOR} \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 
-USES=		autoreconf bison certs:test gmake fortran libtool localbase perl5 python:test # GNU tools should be used for 7.5 and on until the cmake build is declared stable
+USES=		autoreconf bison gmake fortran libtool localbase perl5 python:test # GNU tools should be used for 7.5 and on until the cmake build is declared stable
 USE_CXXSTD=	c++14 # otherwise configure fails because of c++14 features like std::conditional_t
 USE_CXXSTD=	c++17 # workaround for https://github.com/Xyce/Xyce/issues/97, which occurred when Trilinos was updated to 15.1.0
 USE_LDCONFIG=	yes
 USE_PERL5=	test
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	Xyce
 GH_PROJECT=	Xyce
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	LEX=/usr/bin/flex \
 		--enable-stokhos \
 		--enable-amesos \
 		--enable-shared \
 		--disable-static
 CFLAGS+=	-I${LOCALBASE}/include/kokkos # https://github.com/Xyce/Xyce/issues/137
 CXXFLAGS+=	-I${LOCALBASE}/include/kokkos # https://github.com/Xyce/Xyce/issues/137
 
 INSTALL_TARGET=	install-strip
 
 BINARY_ALIAS=	python=${PYTHON_CMD} # only for tests
 
 do-test: # one test is known to fail, see https://github.com/Xyce/Xyce/issues/67#issuecomment-1179857728
 	# checkout tests
 	@cd ${WRKDIR} && \
 		${ECHO} "cloning git repository ..." && \
 		${RM} -rf Xyce_Regression && \
 		git clone -q https://github.com/Xyce/Xyce_Regression.git && \
 		cd Xyce_Regression && \
 		git checkout -q Release-${DISTVERSION}
 
 	# run tests
 	@cd ${TEST_WRKSRC} && ( \
 		${ECHO} "running tests ..."; \
 		eval `${WRKDIR}/Xyce_Regression/TestScripts/suggestXyceTagList.sh ${STAGEDIR}${PREFIX}/bin/Xyce` ; \
 		${SETENV} ${TEST_ENV} ${WRKDIR}/Xyce_Regression/TestScripts/run_xyce_regression \
 			--output=${WRKDIR}/Xyce_Test \
 			--xyce_test="${WRKDIR}/Xyce_Regression" \
 			--resultfile=${WRKDIR}/serial_results \
 			--taglist="$$TAGLIST" \
 			${STAGEDIR}${PREFIX}/bin/Xyce \
 	)
 	# Testssuite doesn't stop when Ctrl-C is pressed: https://github.com/Xyce/Xyce_Regression/issues/1
 
 # Trilinos build instructions for Xyce: https://xyce.sandia.gov/documentation-tutorials/building-guide/#instTrilinos
 # Xyce build instructions: https://xyce.sandia.gov/documentation-tutorials/building-guide/
 # Xyce regression suite instructions: https://xyce.sandia.gov/documentation-tutorials/running-the-xyce-regression-suite/
 # docs are in https://xyce.sandia.gov/files/xyce/Xyce_Docs-7.5.tar.gz
 
 # tests as of 7.10.0:
 # All Test runs complete - Warning 1 Tests FAILED (CommandLine/command_line.........................................TIME LIMIT[sh])
 #                                  0 Tests EXITED WITH ERROR
 # 				 Total testing time: 159.1m (wall),  8997s (user),   382s (system)
 
 .include <bsd.port.mk>
diff --git a/misc/claude-code/Makefile b/misc/claude-code/Makefile
index 8d8a1481117e..13cb5184c8a3 100644
--- a/misc/claude-code/Makefile
+++ b/misc/claude-code/Makefile
@@ -1,48 +1,49 @@
 PORTNAME=	claude-code
 DISTVERSION=	2.1.62
 CATEGORIES=	misc # machine-learning
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	Agentic coding tool from Anthropic that lives in your terminal
 WWW=		https://github.com/anthropics/claude-code
 
 FETCH_DEPENDS=	npm:www/npm \
-		jq:textproc/jq
+		jq:textproc/jq \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 RUN_DEPENDS=	rg:textproc/ripgrep
 
-USES=		certs:fetch nodejs:run
+USES=		nodejs:run
 
 NO_BUILD=	yes
 NO_ARCH=	yes
 
 PACKAGE_NAME=	@anthropic-ai/claude-code
 
 FETCH_SCRIPT=	${PORTSDIR}/Tools/scripts/npmjs-fetch-with-dependencies.sh
 
 do-fetch:
 	@if ! [ -f ${DISTDIR}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} ]; then \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${PACKAGE_NAME} ${DISTVERSION} \
 			${FILESDIR}/package-lock.json \
 			${DISTDIR}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}; \
 	fi
 
 do-install:
 	# install files
 	@${MKDIR} ${STAGEDIR}${PREFIX}/lib
 	@cd ${WRKSRC} && \
 		${COPYTREE_SHARE} node_modules ${STAGEDIR}${PREFIX}/lib
 	# update shebang
 	${REINPLACE_CMD} -i '' \
 		-e "s|#!/usr/bin/env node|#!${PREFIX}/bin/node|" \
 		${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/cli.js
 	# set exec bit
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/cli.js
 	# create wrapper script that uses system ripgrep
 	@${MKDIR} ${STAGEDIR}${PREFIX}/bin
 	@${ECHO_CMD} '#!/bin/sh' > ${STAGEDIR}${PREFIX}/bin/claude
 	@${ECHO_CMD} 'export USE_BUILTIN_RIPGREP=false' >> ${STAGEDIR}${PREFIX}/bin/claude
 	@${ECHO_CMD} 'exec ${PREFIX}/lib/node_modules/${PACKAGE_NAME}/cli.js "$$@"' >> ${STAGEDIR}${PREFIX}/bin/claude
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/bin/claude
 
 .include <bsd.port.mk>
diff --git a/misc/github-copilot-cli/Makefile b/misc/github-copilot-cli/Makefile
index 4ab8e2d59107..ece42cf331c3 100644
--- a/misc/github-copilot-cli/Makefile
+++ b/misc/github-copilot-cli/Makefile
@@ -1,152 +1,153 @@
 PORTNAME=	github-copilot-cli
 DISTVERSION=	0.0.394 # do not update until https://github.com/github/copilot-cli/issues/1320 is fixed
 PORTREVISION=	1
 PORTEPOCH=	1
 CATEGORIES=	misc # machine-learning
 DISTFILES=	${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} \
 		${NODE_HEADERS}${EXTRACT_SUFX}
 DIST_SUBDIR=	${PORTNAME}
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	GitHub Copilot CLI brings the power of the coding agent to terminal
 WWW=		https://github.com/github/copilot-cli
 
 ONLY_FOR_ARCHS=		aarch64 amd64
 ONLY_FOR_ARCHS_REASON=	binaries are installed in folders with architecture encoded in them, patches are welcome to fix this limitation
 
 FETCH_DEPENDS=	npm:www/npm \
-		jq:textproc/jq
+		jq:textproc/jq \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 BUILD_DEPENDS=	npm:www/npm \
 		libsecret>0:security/libsecret \
 		vips>=8.17.2:graphics/vips
 RUN_DEPENDS=	libsecret>0:security/libsecret \
 		rg:textproc/ripgrep \
 		vips>=8.17.2:graphics/vips
 
-USES=		certs:fetch nodejs:run pkgconfig python:build
+USES=		nodejs:run pkgconfig python:build
 
 WRKSRC=		${WRKDIR}/copilot-${DISTVERSION}
 
 PACKAGE_NAME=	@github/copilot
 
 NODE_HEADERS=	node-v22.19.0-headers
 
 JS_ARCH=	${ARCH:S/amd64/x64/:S/aarch64/arm64/}
 PLIST_SUB=	JS_ARCH=${JS_ARCH}
 
 DD=		${DISTDIR}/${DIST_SUBDIR}
 
 FETCH_SCRIPT=	${PORTSDIR}/Tools/scripts/npmjs-fetch-with-dependencies.sh
 
 DEP_MODULES=			pty sharp keytar node_addon_api
 dep_pty_npm_name=		@devm33/node-pty
 dep_pty_version=		1.0.9
 dep_sharp_npm_name=		sharp
 dep_sharp_version=		0.34.4
 dep_keytar_npm_name=		keytar
 dep_keytar_version=		7.9.0
 dep_node_addon_api_npm_name=	node-addon-api
 dep_node_addon_api_version=	8.5.0
 
 .for dep in ${DEP_MODULES}
 DISTFILES+=	${dep:S/_/-/g}-${dep_${dep}_version}${EXTRACT_SUFX}
 .endfor
 
 do-fetch:
 	@if ! [ -f ${DD}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/${NODE_HEADERS}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/pty-${dep_pty_version}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/sharp-${dep_sharp_version}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/keytar-${dep_keytar_version}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/node-addon-api-${dep_node_addon_api_version}${EXTRACT_SUFX} ]; then \
 		${MKDIR} ${DD} && \
 		${ECHO} "====> Fetching ${NODE_HEADERS}${EXTRACT_SUFX}" && \
 		${FETCH_CMD} -q https://nodejs.org/download/release/v22.19.0/${NODE_HEADERS}${EXTRACT_SUFX} -o ${DD}/${NODE_HEADERS}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency pty" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_pty_npm_name} ${dep_pty_version} \
 			${FILESDIR}/package-lock-pty.json \
 			${DD}/pty-${dep_pty_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency sharp" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_sharp_npm_name} ${dep_sharp_version} \
 			${FILESDIR}/package-lock-sharp.json \
 			${DD}/sharp-${dep_sharp_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency keytar" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_keytar_npm_name} ${dep_keytar_version} \
 			${FILESDIR}/package-lock-keytar.json \
 			${DD}/keytar-${dep_keytar_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency node-addon-api" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_node_addon_api_npm_name} ${dep_node_addon_api_version} \
 			${FILESDIR}/package-lock-node-addon-api.json \
 			${DD}/node-addon-api-${dep_node_addon_api_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching ${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${PACKAGE_NAME} ${DISTVERSION} \
 			${FILESDIR}/package-lock.json \
 			${DD}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}; \
 	fi
 
 post-extract:
 	# Extract node-addon-api and install into sharp/node_modules
 	# the tarball has a nested structure, so we need to move the inner directory
 	@${MV} \
 		${WRKDIR}/${dep_node_addon_api_npm_name}-${dep_node_addon_api_version}/node_modules/${dep_node_addon_api_npm_name} \
 		${WRKDIR}/${dep_sharp_npm_name}-${dep_sharp_version}/node_modules/${dep_sharp_npm_name}/node_modules/node-addon-api
 
 post-patch:
 	# set version
 	${REINPLACE_CMD} -i '' \
 		-e 's|qg.default.createElement(U,{color:e.MUTED},"v",t)|qg.default.createElement(U,{color:e.MUTED},"v","${PORTVERSION}")|g' \
 		${WRKSRC}/node_modules/@github/copilot/index.js
 
 do-build:
 	# Create directory for FreeBSD prebuilds
 	@${MKDIR} ${WRKSRC}/node_modules/${PACKAGE_NAME}/prebuilds/freebsd-x64
 	@${ECHO_MSG} "====> Building pty..."
 	@cd ${WRKDIR}/node-pty-${dep_pty_version}/node_modules/${dep_pty_npm_name} && \
 		${SETENV} HOME=${WRKDIR} CFLAGS="-I${LOCALBASE}/include" CXXFLAGS="-I${LOCALBASE}/include" \
 			npm rebuild --nodedir=${LOCALBASE} && \
 		${CP} build/Release/pty.node ${WRKSRC}/node_modules/${PACKAGE_NAME}/prebuilds/freebsd-x64/
 	@${ECHO_MSG} "====> Building sharp..."
 	@cd ${WRKDIR}/sharp-${dep_sharp_version}/node_modules/${dep_sharp_npm_name}/src && \
 		${SETENV} HOME=${WRKDIR} PYTHON=${PYTHON_CMD} CXXFLAGS="-I${LOCALBASE}/include" \
 			node-gyp configure build --nodedir=${WRKDIR}/node-v22.19.0 && \
 		${MKDIR} ${WRKSRC}/node_modules/@img/sharp-freebsd-x64 && \
 		${CP} build/Release/sharp-freebsd-x64.node ${WRKSRC}/node_modules/@img/sharp-freebsd-x64/sharp.node
 	@${ECHO_MSG} "====> Building keytar..."
 	@cd ${WRKDIR}/keytar-${dep_keytar_version}/node_modules/${dep_keytar_npm_name} && \
 		${SETENV} HOME=${WRKDIR} CFLAGS="-I${LOCALBASE}/include" CXXFLAGS="-I${LOCALBASE}/include" \
 			npm rebuild --nodedir=${LOCALBASE} && \
 		${CP} build/Release/keytar.node ${WRKSRC}/node_modules/${PACKAGE_NAME}/prebuilds/freebsd-x64/
 
 do-install:
 	# install files
 	cd ${WRKSRC} && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${PREFIX}/lib
 	# remove *.node files for other OSes
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME} -name "*\\.node" | \
 		${GREP} -v freebsd | \
 		${XARGS} ${RM}
 	# remove files for other OSes
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME} -name "*linux*" | ${XARGS} ${RM} -r
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME} -name "*win32*" | ${XARGS} ${RM} -r
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME} -name "*darwin*" | ${XARGS} ${RM} -r
 	# remove unnecessary files
 	@${FIND} ${STAGEDIR}${PREFIX}/lib -type f -and -name "*package*.json" -delete
 	@${FIND} ${STAGEDIR}${PREFIX}/lib -type f -and -name "README.md" -delete
 	@${FIND} ${STAGEDIR}${PREFIX}/lib -type f -and -name "LICENSE.md" -delete
 	# update shebang to use system node
 	@${REINPLACE_CMD} -i '' \
 		-e "s|#!/usr/bin/env node|#!${PREFIX}/bin/node|" \
 		${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/index.js
 	# set exec bit
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/npm-loader.js
 	# create symlink in bin
 	@${RLN} -s ${STAGEDIR}${PREFIX}/lib/node_modules/.bin/copilot ${STAGEDIR}${PREFIX}/bin/copilot
 	# strip binaries
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME} -path "*/build/*" -name *.node | ${XARGS} ${STRIP_CMD}
 
 .include <bsd.port.mk>
diff --git a/misc/github-copilot-language-server/Makefile b/misc/github-copilot-language-server/Makefile
index c720360de6ba..c3ac07844891 100644
--- a/misc/github-copilot-language-server/Makefile
+++ b/misc/github-copilot-language-server/Makefile
@@ -1,132 +1,133 @@
 PORTNAME=	github-copilot-language-server
 DISTVERSION=	1.399.0
 CATEGORIES=	misc # machine-learning
 DISTFILES=	${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} \
 		${NODE_HEADERS}${EXTRACT_SUFX}
 DIST_SUBDIR=	${PORTNAME}
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	GitHub Copilot Language Server
 WWW=		https://github.com/github/copilot-language-server-release
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/node_modules/${PACKAGE_NAME}/LICENSE
 
 ONLY_FOR_ARCHS=		aarch64 amd64
 ONLY_FOR_ARCHS_REASON=	binaries are installed in folders with architecture encoded in them, patches are welcome to fix this limitation
 
 FETCH_DEPENDS=	npm:www/npm \
-		jq:textproc/jq
+		jq:textproc/jq \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 BUILD_DEPENDS=	npm:www/npm \
 		krb5>0:security/krb5 \
 		sqlite3>0:databases/sqlite3
 RUN_DEPENDS=	krb5>0:security/krb5 \
 		sqlite3>0:databases/sqlite3 \
 		ripgrep>0:textproc/ripgrep
 
-USES=		certs:fetch nodejs:run pkgconfig python:build
+USES=		nodejs:run pkgconfig python:build
 
 WRKSRC=		${WRKDIR}/copilot-language-server-${DISTVERSION}
 
 PACKAGE_NAME=	@github/copilot-language-server
 
 NODE_HEADERS=	node-v24.11.0-headers
 
 JS_ARCH=	${ARCH:S/amd64/x64/:S/aarch64/arm64/}
 PLIST_SUB=	JS_ARCH=${JS_ARCH}
 
 DD=		${DISTDIR}/${DIST_SUBDIR}
 
 FETCH_SCRIPT=	${PORTSDIR}/Tools/scripts/npmjs-fetch-with-dependencies.sh
 
 DEP_MODULES=			policy_watcher sqlite3 kerberos
 dep_policy_watcher_npm_name=	@vscode/policy-watcher
 dep_policy_watcher_version=	1.3.5
 dep_sqlite3_npm_name=		@vscode/sqlite3
 dep_sqlite3_version=		5.1.10-vscode
 dep_kerberos_npm_name=		kerberos
 dep_kerberos_version=		7.0.0
 
 .for dep in ${DEP_MODULES}
 DISTFILES+=	${dep:S/_/-/g}-${dep_${dep}_version}${EXTRACT_SUFX}
 .endfor
 
 #NO_CHECKSUM=	yes
 
 do-fetch:
 	@if ! [ -f ${DD}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/${NODE_HEADERS}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/policy-watcher-${dep_policy_watcher_version}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/sqlite3-${dep_sqlite3_version}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/kerberos-${dep_kerberos_version}${EXTRACT_SUFX} ]; then \
 		${MKDIR} ${DD} && \
 		${ECHO} "====> Fetching ${NODE_HEADERS}${EXTRACT_SUFX}" && \
 		${FETCH_CMD} -q https://nodejs.org/download/release/v24.11.0/${NODE_HEADERS}${EXTRACT_SUFX} -o ${DD}/${NODE_HEADERS}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency policy-watcher" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_policy_watcher_npm_name} ${dep_policy_watcher_version} \
 			${FILESDIR}/package-lock-policy-watcher.json \
 			${DD}/policy-watcher-${dep_policy_watcher_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency sqlite3" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_sqlite3_npm_name} ${dep_sqlite3_version} \
 			${FILESDIR}/package-lock-sqlite3.json \
 			${DD}/sqlite3-${dep_sqlite3_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching dependency kerberos" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${dep_kerberos_npm_name} ${dep_kerberos_version} \
 			${FILESDIR}/package-lock-kerberos.json \
 			${DD}/kerberos-${dep_kerberos_version}${EXTRACT_SUFX} && \
 		${ECHO} "====> Fetching ${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${PACKAGE_NAME} ${DISTVERSION} \
 			${FILESDIR}/package-lock.json \
 			${DD}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}; \
 	fi
 
 do-build:
 	# Create directory for FreeBSD native modules
 	@${MKDIR} ${WRKSRC}/node_modules/${PACKAGE_NAME}/dist/compiled/freebsd/${JS_ARCH}
 	@${ECHO_MSG} "====> Building vscode-policy-watcher..."
 	@cd ${WRKDIR}/policy-watcher-${dep_policy_watcher_version}/node_modules/${dep_policy_watcher_npm_name} && \
 		${SETENV} HOME=${WRKDIR} PYTHON=${PYTHON_CMD} CXXFLAGS="-I${LOCALBASE}/include" \
 			npm rebuild --nodedir=${WRKDIR}/${NODE_HEADERS:S/-headers//} && \
 		${CP} build/Release/vscode-policy-watcher.node ${WRKSRC}/node_modules/${PACKAGE_NAME}/dist/compiled/freebsd/${JS_ARCH}/
 	@${ECHO_MSG} "====> Building @vscode/sqlite3..."
 	@cd ${WRKDIR}/sqlite3-${dep_sqlite3_version}/node_modules/${dep_sqlite3_npm_name} && \
 		${SETENV} HOME=${WRKDIR} PYTHON=${PYTHON_CMD} CXXFLAGS="-I${LOCALBASE}/include" \
 			npm rebuild --nodedir=${WRKDIR}/${NODE_HEADERS:S/-headers//} && \
 		${CP} build/Release/vscode-sqlite3.node ${WRKSRC}/node_modules/${PACKAGE_NAME}/dist/compiled/freebsd/${JS_ARCH}/node_sqlite3.node
 	@${ECHO_MSG} "====> Building kerberos..."
 	@cd ${WRKDIR}/kerberos-${dep_kerberos_version}/node_modules/${dep_kerberos_npm_name} && \
 		${SETENV} HOME=${WRKDIR} PYTHON=${PYTHON_CMD} CFLAGS="-I${LOCALBASE}/include" CXXFLAGS="-I${LOCALBASE}/include" LDFLAGS="-L${LOCALBASE}/lib" \
 			npm rebuild --nodedir=${WRKDIR}/${NODE_HEADERS:S/-headers//} && \
 		${CP} build/Release/kerberos.node ${WRKSRC}/node_modules/${PACKAGE_NAME}/dist/compiled/freebsd/${JS_ARCH}/
 
 do-install:
 	# install files
 	cd ${WRKSRC} && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${PREFIX}/lib
 	# remove *.node files for other OSes
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/compiled -name "*\\.node" | \
 		${GREP} -v freebsd | \
 		${XARGS} ${RM}
 	# remove files for other OSes
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist -name "*linux*" | ${XARGS} ${RM} -r
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist -name "*win32*" | ${XARGS} ${RM} -r
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist -name "*darwin*" | ${XARGS} ${RM} -r
 	# remove crypt32.node (Windows only)
 	@${RM} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/crypt32*.node
 	# update shebang to use system node
 	@${REINPLACE_CMD} -i '' \
 		-e "s|#!/usr/bin/env node|#!${PREFIX}/bin/node|" \
 		${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/language-server.js
 	# set exec bit
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/language-server.js
 	# create symlink in bin
 	@${MKDIR} ${STAGEDIR}${PREFIX}/bin
 	@${LN} -s ../lib/node_modules/${PACKAGE_NAME}/dist/language-server.js ${STAGEDIR}${PREFIX}/bin/copilot-language-server
 	# strip binaries
 	@${FIND} ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/compiled -name "*.node" | ${XARGS} ${STRIP_CMD}
 
 .include <bsd.port.mk>
diff --git a/misc/grok-cli/Makefile b/misc/grok-cli/Makefile
index da9fa21c9968..de00ae8c371b 100644
--- a/misc/grok-cli/Makefile
+++ b/misc/grok-cli/Makefile
@@ -1,50 +1,51 @@
 PORTNAME=	grok-cli
 DISTVERSION=	0.0.34
 CATEGORIES=	misc # machine-learning
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	Open-source AI agent bringing Grok to your terminal
 WWW=		https://github.com/superagent-ai/grok-cli
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/node_modules/${PACKAGE_NAME}/LICENSE
 
 FETCH_DEPENDS=	npm:www/npm \
-		jq:textproc/jq
+		jq:textproc/jq \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 RUN_DEPENDS=	rg:textproc/ripgrep
 
-USES=		certs:fetch nodejs:run
+USES=		nodejs:run
 
 NO_BUILD=	yes
 NO_ARCH=	yes
 
 PACKAGE_NAME=	@vibe-kit/grok-cli
 
 FETCH_SCRIPT=	${PORTSDIR}/Tools/scripts/npmjs-fetch-with-dependencies.sh
 
 do-fetch:
 	@if ! [ -f ${DISTDIR}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} ]; then \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${PACKAGE_NAME} ${DISTVERSION} \
 			${FILESDIR}/package-lock.json \
 			${DISTDIR}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}; \
 	fi
 
 do-install:
 	# install files
 	@${MKDIR} ${STAGEDIR}${PREFIX}/lib
 	@cd ${WRKSRC} && \
 		${COPYTREE_SHARE} node_modules ${STAGEDIR}${PREFIX}/lib
 	# update shebang
 	${REINPLACE_CMD} -i '' \
 		-e "s|#!/usr/bin/env node|#!${PREFIX}/bin/node|" \
 		${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/index.js
 	# set exec bit
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/index.js
 	# create wrapper script
 	@${MKDIR} ${STAGEDIR}${PREFIX}/bin
 	@${ECHO_CMD} '#!/bin/sh' > ${STAGEDIR}${PREFIX}/bin/grok
 	@${ECHO_CMD} 'exec ${PREFIX}/lib/node_modules/${PACKAGE_NAME}/dist/index.js "$$@"' >> ${STAGEDIR}${PREFIX}/bin/grok
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/bin/grok
 
 .include <bsd.port.mk>
diff --git a/misc/nanocoder/Makefile b/misc/nanocoder/Makefile
index 3fda02340865..fa8d84b8c857 100644
--- a/misc/nanocoder/Makefile
+++ b/misc/nanocoder/Makefile
@@ -1,52 +1,53 @@
 PORTNAME=	nanocoder
 DISTVERSION=	1.17.3
 CATEGORIES=	misc # machine-learning
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	Local-first coding agent running in your terminal
 WWW=		https://github.com/Nano-Collective/nanocoder
 
 LICENSE=	MIT
 
 FETCH_DEPENDS=	npm:www/npm \
-		jq:textproc/jq
+		jq:textproc/jq \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 BUILD_DEPENDS=	npm:www/npm
 
-USES=		certs:fetch nodejs:run
+USES=		nodejs:run
 
 PACKAGE_NAME=	@nanocollective/nanocoder
 
 FETCH_SCRIPT=	${PORTSDIR}/Tools/scripts/npmjs-fetch-with-dependencies.sh
 
 NO_ARCH=	yes
 
 do-fetch:
 	@if ! [ -f ${DISTDIR}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX} ]; then \
 		${MKDIR} ${DISTDIR} && \
 		${ECHO} "====> Fetching ${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}" && \
 		${SETENV} TMPDIR=${WRKDIR} LOCALBASE=${LOCALBASE} ${FETCH_SCRIPT} \
 			${PACKAGE_NAME} ${DISTVERSION} \
 			${FILESDIR}/package-lock.json \
 			${DISTDIR}/${PORTNAME}-${DISTVERSION}${EXTRACT_SUFX}; \
 	fi
 
 do-build:
 	@cd ${WRKSRC} && \
 		npm rebuild --nodedir=${LOCALBASE}
 
 do-install:
 	# install files
 	cd ${WRKSRC} && \
 		${COPYTREE_SHARE} . ${STAGEDIR}${PREFIX}/lib
 	# remove unnecessary files
 	@${RM} -rf ${STAGEDIR}${PREFIX}/lib/*.json
 	# update shebang to use system node
 	@${REINPLACE_CMD} -i '' \
 		-e "s|#!/usr/bin/env node|#!${PREFIX}/bin/node|" \
 		${STAGEDIR}${PREFIX}/lib/node_modules/@nanocollective/nanocoder/node_modules/cli-highlight/dist/cli.js
 	# set exec bit
 	@${CHMOD} +x ${STAGEDIR}${PREFIX}/lib/node_modules/.bin/${PORTNAME}
 	# create symlink in bin
 	@${RLN} -s ${STAGEDIR}${PREFIX}/lib/node_modules/.bin/${PORTNAME} ${STAGEDIR}${PREFIX}/bin/${PORTNAME}
 
 .include <bsd.port.mk>
diff --git a/net/boinc-client/Makefile b/net/boinc-client/Makefile
index 5627ceb87d4d..53af41bea60a 100644
--- a/net/boinc-client/Makefile
+++ b/net/boinc-client/Makefile
@@ -1,158 +1,158 @@
 PORTNAME=	boinc-client
 DISTVERSIONPREFIX=	client_release/8.2/
 DISTVERSION=	8.2.8
 CATEGORIES=	net
 
 MAINTAINER=	alven@FreeBSD.org
 COMMENT=	Berkeley Open Infrastructure for Network Computing client
 WWW=		https://boinc.berkeley.edu/ \
 		https://github.com/BOINC/boinc/
 
 LICENSE=	LGPL3+
 LICENSE_FILE=	${WRKSRC}/COPYING.LESSER
 
 USES=		autoreconf compiler:c++11-lang gmake libtool localbase:ldflags pkgconfig ssl
 USE_GITHUB=	yes
 GH_ACCOUNT=	BOINC
 GH_PROJECT=	boinc
 USE_LDCONFIG=	yes
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--disable-server
 CONFIGURE_ENV=	OBJCXX="${CXX}"
 
 INSTALL_TARGET=	install-strip
 
 LDFLAGS+=	-lexecinfo
 
 PORTSCOUT=	limit:^8\.2\.\d+
 SUB_FILES=	pkg-deinstall pkg-install
 SUB_LIST=	BOINC_CLIENT_GROUP="${BOINC_CLIENT_GROUP}" \
 		BOINC_CLIENT_HOME="${BOINC_CLIENT_HOME}" \
 		BOINC_CLIENT_USER="${BOINC_CLIENT_USER}" \
 		LOCALBASE="${LOCALBASE}" \
 		PREFIX="${PREFIX}"
 
 USERS=		boinc
 GROUPS=		boinc
 
 PLIST_SUB=	SOVERSION=${DISTVERSION}
 
 OPTIONS_DEFINE=		CLIENT MANAGER NLS SKINS USER X11
 OPTIONS_DEFINE_aarch64=	LINUX
 OPTIONS_DEFINE_amd64=	LINUX
 OPTIONS_DEFINE_i386=	LINUX
 OPTIONS_DEFAULT=	CLIENT MANAGER USER X11
 OPTIONS_GROUP=		SCRIPT
 OPTIONS_GROUP_SCRIPT=	NO_GUI_RPC NO_NET_INFO
 OPTIONS_SUB=		yes
 
 CLIENT_DESC=		Build BOINC client
 LINUX_DESC=		Accept science applications for GNU/Linux
 MANAGER_DESC=		Build BOINC GUI manager
 NLS_DESC=		Install language translations for use in the GUI
 NO_GUI_RPC_DESC=	Disable GUI RPC socket (breaks boinc_curses)
 NO_NET_INFO_DESC=	Do not send host name and address to servers
 SCRIPT_DESC=		Command-line options in script
 SKINS_DESC=		Install more skins for BOINC manager
 USER_DESC=		Create/check user directory
 X11_DESC=		Build graphics API
 
 CLIENT_LIB_DEPENDS=		libcurl.so:ftp/curl \
 				libfreetype.so:print/freetype2
-CLIENT_USES=			certs:run
+CLIENT_RUN_DEPENDS=		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 CLIENT_USE=			RC_SUBR=boinc-client
 CLIENT_CONFIGURE_ENABLE=	client
 
 LINUX_USES=			linux
 LINUX_CONFIGURE_ON=		${LINUX_CONFIGURE_ON_${ARCH}}
 # https://boinc.berkeley.edu/trac/wiki/BoincPlatforms
 LINUX_CONFIGURE_ON_aarch64=	--with-boinc-alt-platform=aarch64-unknown-linux-gnu
 LINUX_CONFIGURE_ON_amd64=	--with-boinc-alt-platform=x86_64-pc-linux-gnu
 LINUX_CONFIGURE_ON_i386=	--with-boinc-alt-platform=i686-pc-linux-gnu
 
 MANAGER_LIB_DEPENDS=		libfreetype.so:print/freetype2 \
 				libnotify.so:devel/libnotify \
 				libxcb-util.so:x11/xcb-util \
 				libxkbcommon.so:x11/libxkbcommon
 MANAGER_USES=			desktop-file-utils gnome iconv xorg
 MANAGER_USE=			GNOME=atk,cairo,gdkpixbuf,glib20,gtk30,pango \
 				WX=3.2+ \
 				XORG=x11,xcb,xext,xscrnsaver
 MANAGER_CONFIGURE_ENABLE=	manager
 MANAGER_CONFIGURE_WITH=		wx-config
 
 NLS_USES=	gettext-tools
 
 X11_USES=		desktop-file-utils gl jpeg xorg
 X11_USE=		GL=glut \
 			XORG=x11,xi,xmu,xscrnsaver
 X11_CONFIGURE_OFF=	ax_cv_check_glut_libglut=no
 X11_CONFIGURE_WITH=	x
 
 BOINC_CLIENT_GROUP?=	boinc
 BOINC_CLIENT_HOME?=	/var/db/boinc
 BOINC_CLIENT_USER?=	boinc
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MMANAGER}
 WX_CONF_ARGS=	absolute
 SUB_LIST+=	OPTION_MANAGER="true"
 .else
 SUB_LIST+=	OPTION_MANAGER=""
 .endif
 
 .if ${PORT_OPTIONS:MCLIENT}
 SUB_LIST+=	OPTION_NO_GUI_RPC=${PORT_OPTIONS:MNO_GUI_RPC:S/^NO_GUI_RPC$/--no_gui_rpc/} \
 		OPTION_NO_NET_INFO=${PORT_OPTIONS:MNO_NET_INFO:S/^NO_NET_INFO$/--suppress_net_info/}
 .endif
 
 .if ${PORT_OPTIONS:MUSER}
 SUB_LIST+=	OPTION_USER="true"
 .else
 SUB_LIST+=	OPTION_USER=""
 .endif
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|client/scripts||' \
 		${WRKSRC}/Makefile.am
 
 post-patch-X11-off:
 	@${REINPLACE_CMD} -e 's|enable_xss="yes"|enable_xss="no"|' \
 		${WRKSRC}/configure.ac
 
 post-install:
 .for name in config.h project_specific_defines.h api/reduce.h lib/keyword.h \
 	lib/opencl_boinc.h lib/shmem.h lib/std_fixes.h lib/str_replace.h
 	${INSTALL_DATA} ${WRKSRC}/${name} \
 		${STAGEDIR}${PREFIX}/include/boinc
 .endfor
 
 post-install-MANAGER-on:
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/boinc
 .for size in 16 32 48
 	${INSTALL_DATA} ${WRKSRC}/packages/generic/sea/boincmgr.${size}x${size}.png \
 		${STAGEDIR}${PREFIX}/share/pixmaps
 .endfor
 .if ${PORT_OPTIONS:MSKINS}
 	(cd ${WRKSRC}/clientgui && \
 		${COPYTREE_SHARE} skins ${STAGEDIR}${PREFIX}/share/boinc/ \
 		)
 .else
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/boinc/skins
 	(cd ${WRKSRC}/clientgui/skins && \
 		${COPYTREE_SHARE} Default ${STAGEDIR}${PREFIX}/share/boinc/skins/ \
 		)
 .endif
 
 post-install-X11-on:
 .for name in api/boinc_gl.h api/graphics_api.h api/graphics_data.h api/ttfont.h
 	${INSTALL_DATA} ${WRKSRC}/${name} \
 		${STAGEDIR}${PREFIX}/include/boinc
 .endfor
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/boinc/ttf
 	cd ${WRKSRC}/api/ttf/liberation-fonts-ttf-2.00.0 && \
 		${COPYTREE_SHARE} \*.ttf ${STAGEDIR}${PREFIX}/share/boinc/ttf/
 
 .include <bsd.port.mk>
diff --git a/www/py-yt-dlp-ejs/Makefile b/www/py-yt-dlp-ejs/Makefile
index 75325b4efb45..777314d90101 100644
--- a/www/py-yt-dlp-ejs/Makefile
+++ b/www/py-yt-dlp-ejs/Makefile
@@ -1,95 +1,96 @@
 PORTNAME=	yt-dlp-ejs
 DISTVERSION=	0.5.0
 CATEGORIES=	www
 MASTER_SITES=	PYPI
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 DISTNAME=	${PORTNAME:S/-/_/g}-${DISTVERSION}
 DISTFILES=	${DISTNAME}${EXTRACT_SUFX} \
 		${PORTNAME}-node-modules-${DISTVERSION}${EXTRACT_SUFX}
 DIST_SUBDIR=	${PORTNAME}
 
 MAINTAINER=	yuri@FreeBSD.org
 COMMENT=	JavaScript challenge solver for yt-dlp
 WWW=		https://github.com/yt-dlp/yt-dlp-ejs
 
 LICENSE=	UNLICENSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
-FETCH_DEPENDS=	npm:www/npm
+FETCH_DEPENDS=	npm:www/npm \
+		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 BUILD_DEPENDS=	deno:www/deno \
 		npm:www/npm \
 		${PYTHON_PKGNAMEPREFIX}hatch-vcs>=0:devel/py-hatch-vcs@${PY_FLAVOR} \
 		${PYTHON_PKGNAMEPREFIX}hatchling>0:devel/py-hatchling@${PY_FLAVOR}
 RUN_DEPENDS=	deno:www/deno
 
-USES=		certs:fetch python
+USES=		python
 USE_PYTHON=	pep517 autoplist pytest
 
 SHEBANG_GLOB=	*.py
 
 NO_ARCH=	yes
 
 DD=		${DISTDIR}/${DIST_SUBDIR}
 
 do-fetch: # this target (1) downloads the source tarball, (2) extracts it to a temporary location, (3) runs npm ci to fetch and install node_modules, and (4) packages the node_modules directory into a separate tarball for later extraction during the build phase. This allows us to avoid running npm ci during the build phase which will require network access
 	@if ! [ -f ${DD}/${DISTNAME}${EXTRACT_SUFX} ] || \
 	    ! [ -f ${DD}/${PORTNAME}-node-modules-${DISTVERSION}${EXTRACT_SUFX} ]; then \
 		${MKDIR} ${DD} && ${MKDIR} ${WRKDIR} && \
 		${ECHO_MSG} "====> (1) Fetching ${DISTNAME}${EXTRACT_SUFX}" && \
 		cd ${DD} && ${FETCH_CMD} https://files.pythonhosted.org/packages/source/y/yt-dlp-ejs/${DISTNAME}${EXTRACT_SUFX} && \
 		${ECHO_MSG} "====> (2) Extracting the tarball" && \
 		${TAR} -xf ${DD}/${DISTNAME}${EXTRACT_SUFX} -C ${WRKDIR} && \
 		${ECHO_MSG} "====> (3) Fetching and packaging node_modules using package-lock.json" && \
 		if [ -f ${FILESDIR}/package-lock.json ]; then \
 			${ECHO_MSG} "====> Using existing package-lock.json"; \
 			${CP} ${FILESDIR}/package-lock.json ${WRKDIR}/${DISTNAME}/; \
 		else \
 			${ECHO_MSG} "====> Generating package-lock.json (it will be saved to ${FILESDIR})"; \
 		fi && \
 		cd ${WRKDIR}/${DISTNAME} && \
 			${SETENV} NODE_EXTRA_CA_CERTS=${LOCALBASE}/share/certs/ca-root-nss.crt HOME=${WRKDIR} npm ci && \
 		if ! [ -f ${FILESDIR}/package-lock.json ]; then \
 			${ECHO_MSG} "====> Saving generated package-lock.json to ${FILESDIR}"; \
 			${CP} ${WRKDIR}/${DISTNAME}/package-lock.json ${FILESDIR}/; \
 		fi && \
 		${FIND} node_modules -name '.package-lock.json' -delete && \
 		${FIND} node_modules -type d -name '@*' -empty -delete && \
 		${FIND} node_modules -exec ${TOUCH} -h -d 1970-01-01T00:00:00Z {} \; && \
 		${ECHO_MSG} "====> (4) Packaging original tarball + NodeJS dependencies into a final tarball" && \
 		${FIND} node_modules -print0 | ${SORT} -z | \
 			${TAR} czf ${DD}/${PORTNAME}-node-modules-${DISTVERSION}${EXTRACT_SUFX} \
 				--format=bsdtar --no-read-sparse --gid 0 --uid 0 \
 				--options gzip:!timestamp --no-recursion --null -T - && \
 		${RM} -rf ${WRKDIR}; \
 	fi
 
 post-extract:
 	# Extract pre-downloaded node_modules
 	@${TAR} -xf ${DD}/${PORTNAME}-node-modules-${DISTVERSION}${EXTRACT_SUFX} -C ${WRKSRC}
 
 do-build:
 	# Build JavaScript bundles
 	@${ECHO_MSG} "====> Building JavaScript bundles with rollup..."
 	@cd ${WRKSRC} && \
 		${SETENV} HOME=${WRKDIR} npm run bundle
 	# Verify bundles were created
 	@if ! [ -f ${WRKSRC}/dist/yt.solver.core.min.js ] || \
 	    ! [ -f ${WRKSRC}/dist/yt.solver.lib.min.js ]; then \
 		${ECHO_MSG} "ERROR: JavaScript bundles were not created properly"; \
 		exit 1; \
 	fi
 	# Build Python wheel
 	@cd ${WRKSRC} && \
 		${SETENV} ${MAKE_ENV} ${PYTHON_CMD} -m build --no-isolation --wheel --outdir ${WRKSRC}/dist
 
 pre-test:
 	# Copy built JavaScript files to test location
 	@${MKDIR} ${WRKSRC}/yt_dlp_ejs/yt/solver
 	@${CP} ${WRKSRC}/dist/yt.solver.core.min.js ${WRKSRC}/yt_dlp_ejs/yt/solver/core.min.js
 	@${CP} ${WRKSRC}/dist/yt.solver.lib.min.js ${WRKSRC}/yt_dlp_ejs/yt/solver/lib.min.js
 
 # tests as of 0.5.0:
 # Results (0.15s):
 #          3 passed
 
 .include <bsd.port.mk>