exclude autogenerated ca-certificates.crt from overlay
In alpine 2.7 (possibly 2.6 too), the ca-certificiates.crt in /etc/ssl/certs/ is autogenerated by update-ca-certificates. It is a huge, autogenerated file, and should not go to overlay.
Suggestion, have ca-certificates package ship etc/apk/protected_paths.d/ca-certificates.list with:
or possibly even
(because also the symlinks there are autogenerated)
This will make apk exclude the related files from overlay.
main/ca-certificates: exclude autogenerated ca-certificates.crt from overlay