State changed as code fixing the issue is committed (7d7a8af7)

State changed as build #4114 is successful

@robin Hm maybe a better fix would be to have the folder trusted-cert outside of conf and then do not treat that trusted-cert folder as program files. Thus you would never touch it at all during upgrade. Reason is that certs could also be mounted read-only. Given that it is user provided data it might make sense to treat it similar as the sites folder containing all repositories.

For example with Docker Swarm someone might have their CA cert stored as a docker secret and wants to mount it. While you could customize the mount location, it will be a single read-only file mount and would break your fix I guess.

build #4121 is improved to copy file only if target file is writable.