Add preload --add-certificate option

Change-type: minor

lib/actions/preload.coffee

@@ -183,6 +183,16 @@ module.exports =
 			description: 'Pin the preloaded device (not application) to the preloaded release on provision'
 			alias: 'p'
 		}
+		{
+			signature: 'add-certificate'
+			parameter: 'certificate.crt'
+			description: '''
+				Add the given certificate (in PEM format) to /etc/ssl/certs in the preloading container.
+				The file name must end with '.crt' and must not be already contained in the preloader's
+				/etc/ssl/certs folder.
+				Can be repeated to add multiple certificates.
+			'''
+		}
 	]
 	action: (params, options, done) ->
 		_ = require('lodash')
@@ -229,6 +239,16 @@ module.exports =
 		options.pinDevice = options['pin-device-to-release'] || false
 		delete options['pin-device-to-release']
 
+		if _.isArray(options['add-certificate'])
+			certificates = options['add-certificate']
+		else if options['add-certificate'] == undefined
+			certificates = []
+		else
+			certificates = [ options['add-certificate'] ]
+		for certificate in certificates
+			if not certificate.endsWith('.crt')
+				exitWithExpectedError('Certificate file name must end with ".crt"')
+
 		# Get a configured dockerode instance
 		dockerUtils.getDocker(options)
 		.then (docker) ->
@@ -243,6 +263,7 @@ module.exports =
 				options.proxy
 				options.dontCheckArch
 				options.pinDevice
+				certificates
 			)
 
 			gotSignal = false

package.json

@@ -112,7 +112,7 @@
     "balena-config-json": "^2.0.0",
     "balena-device-init": "^5.0.0",
     "balena-image-manager": "^6.0.0",
-    "balena-preload": "^8.1.4",
+    "balena-preload": "^8.2.0",
     "balena-sdk": "^11.17.0",
     "balena-settings-client": "^4.0.0",
     "balena-sync": "^10.0.3",