Accessing external https repo during install

Hello all.

I'm trying to pre-install salt from https://repo.saltproject.io .
I:
- assigned "SALT" class to the host
- created hooks/repository.SALT that copies the salt.list, 
salt-archive-keyring.gpg and /etc/salt/minion.d/master.conf to $target
- created package_config/SALT that includes both ca-certificates and 
salt-minion

The problem is that when 'apt update' runs, it doesn't recognize the 
certificate for the external repo => error gets logged and the 
salt-minion provided by the distro is installed instead of the one from 
that external repo. Obvious, since ca-certificates have not yet been 
installed.

How can I have ca-certificates installed when the repository gets added?

-- 
Diego Zuccato
DIFA - Dip. di Fisica e Astronomia
Servizi Informatici
Alma Mater Studiorum - Università di Bologna
V.le Berti-Pichat 6/2 - 40127 Bologna - Italy
tel.: +39 051 20 95786