python-poetry / python-poetry/poetry

Add truststore support to use system certificate store

Open
#9,249 7 comments 7 reactions 1 assignee View on GitHub

@Secrus is already working on this.

Since Sep 26, 2024.

kind/feature status/triage
Dominant language
Python
Stars
34.3k
Forks
2.5k
Avg merge
2d 19h
Merged PRs (30d)
30

Description

Issue Kind

Brand new capability

Description

Poetry should have the option or default to pulling certificates from the system certificate store like pip now does with use-feature=truststore. Without this, Poetry is extremely difficult to use in corporate environments with IT systems where TLS inspection breaks the use of the default certificates.

This was already mentioned by @Secrus in https://github.com/orgs/python-poetry/discussions/8729 as in his plans, but I wanted to raise the idea’s profile by making a formal Feature Request after spending half a day struggling with the problem.

Impact

Adding this would make Poetry go from essentially broken behind corporate IT systems to just working for these users.

Workarounds

It is possible to deactivate certificate verification at the cost of extra project setup step, nasty warnings, and confused users. Also theoretically, a manual cert file file can be exported and referenced with the REQUESTS_CA_BUNDLE environment variable. Both solutions are costly and painful. Native Python ssl already defaults to using the system certificate store, and most users would benefit by having something that just works.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.