end might be pointing into an environment variable buffer, we should avoid modifying it.

Not quite true, LOCALBASE doesn't include DISTBASE. Not clear to me whether it should or not, bit of a weird interaction that doesn't really make sense to combine, so I don't really care which way it goes (I just happened to not include it for LOCALBASE in my original commit), but the comment should be consistent with the implementation.

read_cert also uses this for cert->path, is that a problem?

If the string doesn't have a trailing slash, won't this return an unterminated string?

You're right, thank you.

That path is never used.

Presumably we should check this?

Will happen automatically thanks to the loop condition. And makes a difference, because otherwise dst doesn't get incremented, and you'll truncate paths that end in a /. In practice you probably don't expect that case, and it still means the same thing, but still.

You sure about that? It looks a lot like list and untrusted at least will.

Did you bother to read the comment at the top of the function?

Ah, you're right, but they only print the basename, so it makes no difference.

On the contrary, DISTBASE _must_ begin with a slash.