Add SSL_CERT_DIR and SSL_CERT_FILE to the default for [subprocess-environment].env_vars
#14808
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…s-environment].env_vars`
stuhood
approved these changes
Mar 16, 2022
# Rust tests and lints will be skipped. Delete if not intended. [ci skip-rust] # Building wheels and fs_util will be skipped. Delete if not intended. [ci skip-build-wheels]
jsirois
approved these changes
Mar 16, 2022
stuhood
added a commit
to stuhood/pants
that referenced
this pull request
Jun 24, 2022
# Rust tests and lints will be skipped. Delete if not intended. [ci skip-rust]
stuhood
added a commit
to stuhood/pants
that referenced
this pull request
Jun 24, 2022
[ci skip-rust] [ci skip-build-wheels]
stuhood
added a commit
that referenced
this pull request
Jun 25, 2022
stuhood
added a commit
to stuhood/pants
that referenced
this pull request
Jun 28, 2022
…antsbuild#15943) See pantsbuild#14808. [ci skip-rust] [ci skip-build-wheels]
stuhood
added a commit
to stuhood/pants
that referenced
this pull request
Jun 28, 2022
…antsbuild#15943) See pantsbuild#14808. [ci skip-rust] [ci skip-build-wheels]
stuhood
added a commit
to stuhood/pants
that referenced
this pull request
Jun 28, 2022
…antsbuild#15943) See pantsbuild#14808. [ci skip-rust] [ci skip-build-wheels]
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As explained at pex-tool/pex#1674 and discussed in https://pantsbuild.slack.com/archives/C0D7TNJHL/p1647388552764289, Python's
sslstd-lib looks toSSL_CERT_FILEwhen it is not explicitly told what cert to load. Pex's lockfile consumption uses that code path, so by Pants strippingSSL_CERT_FILEfrom the environment by default, certs fail to work in certain environments.pex-tool/pex#1674 proposes instead teaching Pex to bundle fallback certs via
certifi. But we can't control other ecosystems as tightly as Pex like that, so we decided in Slack it makes more sense for us to by default propagateSSL_CERT_FILEso that by default things Just Work.As before, users can override
[GLOBAL].ca_certs_pathif they don't want to rely on theSSL_CERT_FILEfallback.Note that there is some remote caching downside to including
SSL_CERT_FILEin the default: if the value diverges between machines, then the cache cannot be used. Because this env var seems to be standard with OpenSSL, that's fine. Also, admins trying to optimize cross-machine cache hits can always remove this setting.