Add SSL args/config options

relrod · relrod · commit b3def14474eb · 2026-01-09T13:07:43.000+01:00
- Add --ssl-verify ("true", "false", or "/path/to.pem")
- Add --ssl-no-revoke (from micromamba)
- Add corresponding config fields for these

Signed-off-by: Rick Elrod &lt;rick.elrod@checkmk.com&gt;
diff --git a/README.md b/README.md
@@ -35,3 +35,38 @@ available:
   administrator), `csm.exe` will prompt for confirmation before continuing.
   Setting this configuration option to true, disables the check entirely. This
   option does nothing on non-Windows systems.
+
+* **`env_create` section** - for options affecting the `csm env create`
+  subcommand.
+
+  * `ssl_verify` - A boolean, which, if true (default) enables SSL/TLS
+    certificate verification. If false, verification is disabled when calling
+    `micromamba` and when using `pip`. Setting this to false has the effect of
+    setting the following environment variables when `csm` calls `micromamba`:
+
+    - `CURL_CA_BUNDLE=""`
+    - `PIP_CERT=""`
+    - `PIP_INDEX_URL="https://pypi.org/simple"`
+    - `PIP_TRUSTED_HOST="pypi.org files.pythonhosted.org pypi.pythonhosted.org"`
+    - `REQUESTS_CA_BUNDLE=""`
+
+    This setting (and `ssl_bundle` below) can be overridden with the
+    `--ssl-verify` command-line argument to `csm env create`.
+
+  * `ssl_bundle` - A string which configures the SSL/TLS certificate bundle to
+    use when verifying certificates. Only taken into account when `ssl_verify`
+    is true. Setting this has the effect of setting the following environment
+    variables when `csm` calls `micromamba`:
+
+    - `CURL_CA_BUNDLE="<value>"`
+    - `PIP_CERT="<value>"`
+    - `REQUESTS_CA_BUNDLE="<value>"`
+
+  * `ssl_no_revoke` - A boolean which instructs `micromamba` to not check
+    SSL/TLS certificate revokation. Setting this has the effect of setting the
+    following environment variable when `csm` calls `micromamba`:
+
+    - `MAMBA_SSL_NO_REVOKE="true"`
+
+    This setting can be overridden with the `--ssl-no-revoke` command-line
+    switch to `csm env create`.
diff --git a/src/csmrc.rs b/src/csmrc.rs
@@ -3,8 +3,36 @@
 use log::debug;
 use serde::Deserialize;
 use std::default::Default;
+use std::fs::File;
 use std::io::{Error, ErrorKind};
 
+#[derive(Debug, Deserialize)]
+#[serde(default)]
+pub struct EnvCreateConfig {
+    /// If true (default), verify SSL/TLS certificates. This is used for
+    /// configuring passthrough to micromamba (and indirectly, pip).
+    pub ssl_verify: bool,
+
+    /// The SSL/TLS certificate bundle to verify with. When None (default), uses
+    /// the default, which when calling out to micromamba, corresponds to the
+    /// system chain or "ca-certificates" from conda-forge if installed.
+    pub ssl_bundle: Option<String>,
+
+    /// Disable SSL/TLS revokation checking (affects passthrough to micromamba).
+    /// This is equivalent to passing --ssl-no-revoke to micromamba.
+    pub ssl_no_revoke: bool,
+}
+
+impl Default for EnvCreateConfig {
+    fn default() -> Self {
+        EnvCreateConfig {
+            ssl_verify: true,
+            ssl_bundle: None,
+            ssl_no_revoke: false,
+        }
+    }
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(default)]
 pub struct Config {
@@ -30,6 +58,9 @@ pub struct Config {
     /// If true, skip checking for LongPaths support on Windows, and never try
     /// to set it.
     pub skip_longpaths_check: bool,
+
+    /// Options for the 'env create' subcommand
+    pub env_create: EnvCreateConfig,
 }
 
 #[allow(clippy::derivable_impls)]
@@ -42,32 +73,53 @@ impl Default for Config {
             download_micromamba: true,
             verbose: false,
             skip_longpaths_check: false,
+            env_create: EnvCreateConfig::default(),
         }
     }
 }
 
 impl Config {
+    /// Validate the configuration to check for common errors.
+    fn validate(self) -> Result<Self, std::io::Error> {
+        // Specifying a bundle when ssl_verify is false makes no sense.
+        // Do the safe thing and bail out - they might have meant to use the
+        // bundle and we should not just disable verification in this case.
+        if !self.env_create.ssl_verify && self.env_create.ssl_bundle.is_some() {
+            return Err(Error::new(
+                ErrorKind::InvalidData,
+                "SSL/TLS verification was disabled, but a bundle was still specified",
+            ));
+        }
+        Ok(self)
+    }
+
     /// Read the user's ~/.csmrc if it exists, merging with the Default instance for
     /// Config. Return Err if a config file was found but failed to parse, otherwise
     /// Ok with the result of merging the config file values with the Default (and
     /// simply the Default if no config file exists).
     pub fn from_csmrc() -> Result<Self, std::io::Error> {
+        fn parse_or_io_error(f: File) -> Result<Config, std::io::Error> {
+            match serde_yaml_ng::from_reader::<File, Config>(f) {
+                Ok(cfg) => cfg.validate(),
+                Err(e) => Err(Error::new(ErrorKind::InvalidData, e)),
+            }
+        }
+
         let Some(home) = std::env::home_dir() else {
+            debug!("Could not determine home directory to read .csmrc, using defaults");
             return Ok(Self::default());
         };
+
         let csmrc_path = home.join(".csmrc");
-        match std::fs::read_to_string(csmrc_path) {
-            Err(e) if e.kind() == ErrorKind::NotFound => {
-                debug!("No .csmrc found, using defaults");
-                Ok(Config::default())
-            }
-            Err(e) => Err(e),
-            Ok(csmrc_data) => {
-                let config = serde_yaml_ng::from_str(&csmrc_data)
-                    .map_err(|e| Error::new(ErrorKind::InvalidData, e));
-                debug!("config: {:?}", config);
-                config
-            }
-        }
+        File::open(csmrc_path)
+            .and_then(parse_or_io_error)
+            .or_else(|e| {
+                if e.kind() == ErrorKind::NotFound {
+                    debug!("No .csmrc found, using defaults");
+                    Ok(Config::default())
+                } else {
+                    Err(e)
+                }
+            })
     }
 }
diff --git a/src/env/create.rs b/src/env/create.rs
@@ -1,3 +1,4 @@
+use crate::csmrc::Config;
 use crate::env::parsing::setup_file::RobotmkSetup;
 use crate::env::{CommonArgs, dump_micromamba_captured_output_on_error, env_name};
 use crate::micromamba::Micromamba;
@@ -15,30 +16,70 @@ pub struct Args {
     /// If specified, overrides the post-creation setup file [default: robotmk-setup.yaml]
     #[arg(long = "setup-file", value_name = "PATH")]
     pub setup_file: Option<PathBuf>,
+
+    /// Verify SSL/TLS certificates when communicating with external services.
+    /// Can be "true" to use the system chain, "false" to disable verification,
+    /// or a path to a custom chain (PEM file).
+    #[arg(long = "ssl-verify")]
+    ssl_verify: Option<String>,
+
+    /// Disable SSL/TLS revokation checking in micromamba
+    #[arg(long = "ssl-no-revoke")]
+    ssl_no_revoke: bool,
 }
 
-pub fn run(micromamba: Micromamba, args: Args) -> Result<(), ExitCode> {
+pub fn run(mut micromamba: Micromamba, args: Args, config: &Config) -> Result<(), ExitCode> {
     if let Some(path) = &args.setup_file
         && !path.exists()
     {
         error!("Explicit --setup-file was given, but the path does not exist.");
         return Err(ExitCode::FAILURE);
     }
 
+    let (ssl_verify, ssl_bundle) = match &args.ssl_verify {
+        Some(b) if b == "false" => (false, None),
+        Some(b) if b == "true" => (true, None),
+        Some(bundle) => (true, Some(bundle.clone())),
+        None => (
+            config.env_create.ssl_verify,
+            config.env_create.ssl_bundle.clone(),
+        ),
+    };
+
+    if ssl_verify && let Some(ssl_bundle) = ssl_bundle {
+        micromamba.set_env_var("PIP_CERT", &ssl_bundle);
+        micromamba.set_env_var("REQUESTS_CA_BUNDLE", &ssl_bundle);
+        micromamba.set_env_var("CURL_CA_BUNDLE", &ssl_bundle);
+    } else if !ssl_verify {
+        micromamba.set_env_var("PIP_CERT", "");
+        micromamba.set_env_var("REQUESTS_CA_BUNDLE", "");
+        micromamba.set_env_var("CURL_CA_BUNDLE", "");
+        micromamba.set_env_var(
+            "PIP_TRUSTED_HOST",
+            "pypi.org files.pythonhosted.org pypi.pythonhosted.org",
+        );
+        micromamba.set_env_var("PIP_INDEX_URL", "https://pypi.org/simple");
+    }
+
+    let ssl_no_revoke = args.ssl_no_revoke || config.env_create.ssl_no_revoke;
+    if ssl_no_revoke {
+        micromamba.set_env_var("MAMBA_SSL_NO_REVOKE", "true");
+    }
+
     let env_name = env_name(args.common.name, &args.common.env_file)?;
     info!(
         "Creating environment '{}' - this may take some time...",
         env_name
     );
-    let result = micromamba.stream_if_verbose(vec![
-        "env",
-        "create",
-        "--file",
-        &args.common.env_file.to_string_lossy(),
-        "--name",
-        &env_name,
-        "--yes",
-    ]);
+
+    let env_file = args.common.env_file.to_string_lossy();
+    let mut mm_args = vec![
+        "env", "create", "--file", &env_file, "--name", &env_name, "--yes",
+    ];
+    if !ssl_verify {
+        mm_args.push("--ssl-verify=<false>");
+    }
+    let result = micromamba.stream_if_verbose(mm_args);
     let rc = result.exit_code();
     dump_micromamba_captured_output_on_error(&result, rc);
     if rc == ExitCode::SUCCESS {
diff --git a/src/env/mod.rs b/src/env/mod.rs
@@ -123,7 +123,7 @@ pub fn run(config: Config, subcommand: Subcommand) -> Result<(), ExitCode> {
     let micromamba = Micromamba::new(&config);
 
     match subcommand {
-        Subcommand::Create(args) => create::run(micromamba, args),
+        Subcommand::Create(args) => create::run(micromamba, args, &config),
         Subcommand::Delete(args) => delete::run(micromamba, args, &config),
         Subcommand::List => micromamba.stream(vec!["env", "list"]).into(),
         Subcommand::Info => micromamba.stream(vec!["info"]).into(),
diff --git a/src/micromamba/mod.rs b/src/micromamba/mod.rs
@@ -22,6 +22,7 @@ pub struct MicromambaInfo {
 
 pub struct Micromamba<'a> {
     config: &'a Config,
+    env_vars: HashMap<String, String>,
 }
 
 fn block_on_child_exit(child: &mut std::process::Child) -> MicromambaResult {
@@ -85,21 +86,34 @@ fn exec_micromamba(cmd: &mut Command, stream_output: bool) -> MicromambaResult {
 
 impl<'a> Micromamba<'a> {
     pub fn new(config: &'a Config) -> Self {
-        Self { config }
+        let mut micromamba = Self {
+            config,
+            env_vars: HashMap::new(),
+        };
+        if let Some(mamba_root_prefix) = &config.mamba_root_prefix {
+            micromamba.set_env_var("MAMBA_ROOT_PREFIX", mamba_root_prefix);
+        }
+        micromamba
+    }
+
+    /// Helper method to insert environment variables with &str for convenience
+    pub fn set_env_var(&mut self, key: &str, value: &str) {
+        self.env_vars.insert(key.to_string(), value.to_string());
     }
 
     /// Return a [`Command`] ready to shell out to `micromamba` with the appropriate
     /// environment variables set based on configuration.
     fn micromamba_at(&self, path: &str, args: &Vec<&str>) -> Command {
-        let mut env_vars: HashMap<&str, String> = HashMap::new();
-
-        if let Some(mamba_root_prefix) = &self.config.mamba_root_prefix {
-            env_vars.insert("MAMBA_ROOT_PREFIX", mamba_root_prefix.to_string());
-        }
+        // On Windows, the env vars don't get shown by the Debug instance for
+        // Command, so print them ourselves (always, to make testing easier).
+        debug!(
+            "Running command with these environment variables: {:?}",
+            self.env_vars
+        );
 
         let mut cmd = Command::new(path);
         cmd.args(args);
-        cmd.envs(env_vars);
+        cmd.envs(&self.env_vars);
         if self.config.noop_mode {
             info!("Would run: {:?}", cmd);
         } else {
diff --git a/templates/mambarc b/templates/mambarc
@@ -1,11 +1,3 @@
-# Show the active environment in the shell prompt
-changeps1: True
-
 # proxy_servers:
 #   http: http://user:pass@corp.com:8080
-#   https: https://user:pass@corp.com:8080
-
-# Use this only if you are behind a proxy that does SSL inspection
-# ssl_verify: false
-# ssl_verify: mycorpcert.crt
-# ssl_no_revoke: true
+#   https: https://user:pass@corp.com:8080
diff --git a/tests/ssl.rs b/tests/ssl.rs
