python-poetry / python-poetry/poetry
Add truststore support to use system certificate store
@Secrus is already working on this.
Since Sep 26, 2024.
- Dominant language
- Python
- Stars
- 34.3k
- Forks
- 2.5k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 30
Description
Issue Kind
Brand new capability
Description
Poetry should have the option or default to pulling certificates from the system certificate store like pip now does with use-feature=truststore. Without this, Poetry is extremely difficult to use in corporate environments with IT systems where TLS inspection breaks the use of the default certificates.
This was already mentioned by @Secrus in https://github.com/orgs/python-poetry/discussions/8729 as in his plans, but I wanted to raise the idea’s profile by making a formal Feature Request after spending half a day struggling with the problem.
Impact
Adding this would make Poetry go from essentially broken behind corporate IT systems to just working for these users.
Workarounds
It is possible to deactivate certificate verification at the cost of extra project setup step, nasty warnings, and confused users. Also theoretically, a manual cert file file can be exported and referenced with the REQUESTS_CA_BUNDLE environment variable. Both solutions are costly and painful. Native Python ssl already defaults to using the system certificate store, and most users would benefit by having something that just works.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.