Update ca-certificates to 20161130

In most places we use the Alpine one, which is already here, but
make sure this is updated, as we may use it more (yes, we should be
consistent).

Change the hash to just use the ca-cert hash, not the apt hash.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>

alpine/base/ca-certificates/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:stable
+FROM debian:testing
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get -yq upgrade && apt-get install -yq ca-certificates

alpine/base/ca-certificates/Makefile

@@ -1,6 +1,6 @@
 .PHONY: tag push
 
-BASE=debian:stable
+BASE=debian:testing
 IMAGE=ca-certificates
 
 default: push
@@ -8,7 +8,7 @@ default: push
 hash: Dockerfile
 	DOCKER_CONTENT_TRUST=1 docker pull $(BASE)
 	tar cf - $^ | docker build --no-cache -t $(IMAGE):build -
-	docker run --rm $(IMAGE):build sh -c 'apt list --installed 2>/dev/null | sha1sum' | sed 's/ .*//' > hash
+	docker run --rm $(IMAGE):build sh -c 'cat /etc/ssl/certs/ca-certificates.crt | sha1sum' | sed 's/ .*//' > hash
 
 push: hash
 	docker pull mobylinux/$(IMAGE):$(shell cat hash) || \