Use rustls-tls with manual SSL_CERT_FILE implementation

Cargo.toml

@@ -76,7 +76,7 @@ rand = { version = "0.8.5" }
 rayon = { version = "1.8.0" }
 reflink-copy = { version = "0.1.14" }
 regex = { version = "1.10.2" }
-reqwest = { version = "0.11.23", default-features = false, features = ["json", "gzip", "brotli", "stream", "rustls-tls-native-roots"] }
+reqwest = { version = "0.11.23", default-features = false, features = ["json", "gzip", "brotli", "stream", "rustls-tls"] }
 reqwest-middleware = { version = "0.2.4" }
 reqwest-retry = { version = "0.3.0" }
 rkyv = { version = "0.7.43", features = ["strict", "validation"] }

crates/uv-client/src/middleware.rs

@@ -1,8 +1,10 @@
+use std::ffi::OsStr;
 use std::fmt::Debug;
+use std::io::Read;
 
 use http::HeaderValue;
-use netrc::{Netrc, Result};
-use reqwest::{Request, Response};
+use netrc::Netrc;
+use reqwest::{Certificate, Request, Response};
 use reqwest_middleware::{Middleware, Next};
 use task_local_extensions::Extensions;
 use url::Url;
@@ -56,7 +58,7 @@ pub(crate) struct NetrcMiddleware {
 }
 
 impl NetrcMiddleware {
-    pub(crate) fn new() -> Result<Self> {
+    pub(crate) fn new() -> netrc::Result<Self> {
         Netrc::new().map(|nrc| NetrcMiddleware { nrc })
     }
 }
@@ -121,3 +123,18 @@ where
     header.set_sensitive(true);
     header
 }
+
+#[derive(thiserror::Error, Debug)]
+pub(crate) enum CertificateError {
+    #[error(transparent)]
+    Io(#[from] std::io::Error),
+    #[error(transparent)]
+    Reqwest(#[from] reqwest::Error),
+}
+
+/// Return the `Certificate` from the provided file.
+pub(crate) fn read_certificate(ssl_cert_file: &OsStr) -> Result<Certificate, CertificateError> {
+    let mut buf = Vec::new();
+    fs_err::File::open(ssl_cert_file)?.read_to_end(&mut buf)?;
+    Ok(Certificate::from_pem(&buf)?)
+}

crates/uv-client/src/registry_client.rs

@@ -29,7 +29,7 @@ use uv_warnings::warn_user_once;
 
 use crate::cached_client::CacheControl;
 use crate::html::SimpleHtml;
-use crate::middleware::{NetrcMiddleware, OfflineMiddleware};
+use crate::middleware::{read_certificate, NetrcMiddleware, OfflineMiddleware};
 use crate::remote_metadata::wheel_metadata_from_remote_zip;
 use crate::rkyvutil::OwnedArchive;
 use crate::{CachedClient, CachedClientError, Error, ErrorKind};
@@ -111,12 +111,25 @@ impl RegistryClientBuilder {
         // Initialize the base client.
         let client = self.client.unwrap_or_else(|| {
             // Disallow any connections.
-            let client_core = ClientBuilder::new()
+            let builder = ClientBuilder::new()
                 .user_agent(user_agent_string)
                 .pool_max_idle_per_host(20)
                 .timeout(std::time::Duration::from_secs(timeout));
 
-            client_core.build().expect("Failed to build HTTP client.")
+            // Add the `SSL_CERT_FILE`, if set.
+            let builder = if let Some(ssl_cert_file) = env::var_os("SSL_CERT_FILE") {
+                match read_certificate(&ssl_cert_file) {
+                    Ok(certificate) => builder.add_root_certificate(certificate),
+                    Err(err) => {
+                        warn!("Failed to read SSL certificate file: {err}");
+                        builder
+                    }
+                }
+            } else {
+                builder
+            };
+
+            builder.build().expect("Failed to build HTTP client.")
         });
 
         // Wrap in any relevant middleware.