Add support for system truststore

Author: Secrus

poetry.lock

@@ -24,6 +24,7 @@ dependencies = [
     "tomlkit (>=0.11.4,<1.0.0)",
     # trove-classifiers uses calver, so version is unclamped
     "trove-classifiers (>=2022.5.19)",
+    "truststore (>=0.10.0,<1.0.0)",
     "virtualenv (>=20.26.6)",
     "xattr (>=1.0.0,<2.0.0) ; sys_platform == 'darwin'",
     "findpython (>=0.6.2,<0.8.0)",

pyproject.toml

@@ -179,6 +179,8 @@ class Config:
         "keyring": {
             "enabled": True,
         },
+        # TODO: Flip to default True on the next release after dropping Python 3.9
+        "system-truststore": False,
     }
 
     def __init__(self, use_environment: bool = True) -> None:
@@ -389,6 +391,7 @@ def _get_normalizer(name: str) -> Callable[[str], Any]:
             "solver.lazy-wheel",
             "system-git-client",
             "keyring.enabled",
+            "system-truststore",
         }:
             return boolean_normalizer
 

src/poetry/config/config.py

@@ -250,6 +250,7 @@ def _run(self, io: IO) -> int:
         # the options --directory or --project, configuring the options here allow cleo to trap and
         # display the error cleanly unless the user uses verbose or debug
         self._configure_global_options(io)
+        self._load_system_truststore()
 
         with directory(self._working_directory):
             self._load_plugins(io)
@@ -637,6 +638,15 @@ def _load_plugins(self, io: IO) -> None:
 
         self._plugins_loaded = True
 
+    @staticmethod
+    def _load_system_truststore() -> None:
+        from poetry.utils.ssl_truststore import is_truststore_enabled
+
+        if is_truststore_enabled():
+            import truststore
+
+            truststore.inject_into_ssl()
+
 
 def main() -> int:
     exit_code: int = Application().run()

src/poetry/console/application.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import logging
+import sys
+
+from poetry.config.config import Config
+
+
+logger = logging.getLogger(__name__)
+
+
+def _is_truststore_available() -> bool:
+    if sys.version_info < (3, 10):
+        logger.debug("Disabling truststore because Python version isn't 3.10+")
+        return False
+
+    try:
+        import ssl  # noqa: F401
+    except ImportError:
+        logger.warning("Disabling truststore since ssl support is missing")
+        return False
+
+    try:
+        import truststore  # noqa: F401
+    except ImportError:
+        logger.warning("Disabling truststore because `truststore` package is missing`")
+        return False
+    return True
+
+
+def is_truststore_enabled() -> bool:
+    return Config.create().get("system-truststore") and _is_truststore_available()

src/poetry/utils/ssl_truststore.py

@@ -76,6 +76,7 @@ def test_list_displays_default_value_if_not_set(
 requests.max-retries = 0
 solver.lazy-wheel = true
 system-git-client = false
+system-truststore = false
 virtualenvs.create = true
 virtualenvs.in-project = null
 virtualenvs.options.always-copy = false
@@ -111,6 +112,7 @@ def test_list_displays_set_get_setting(
 requests.max-retries = 0
 solver.lazy-wheel = true
 system-git-client = false
+system-truststore = false
 virtualenvs.create = false
 virtualenvs.in-project = null
 virtualenvs.options.always-copy = false
@@ -167,6 +169,7 @@ def test_unset_setting(
 requests.max-retries = 0
 solver.lazy-wheel = true
 system-git-client = false
+system-truststore = false
 virtualenvs.create = true
 virtualenvs.in-project = null
 virtualenvs.options.always-copy = false
@@ -201,6 +204,7 @@ def test_unset_repo_setting(
 requests.max-retries = 0
 solver.lazy-wheel = true
 system-git-client = false
+system-truststore = false
 virtualenvs.create = true
 virtualenvs.in-project = null
 virtualenvs.options.always-copy = false
@@ -336,6 +340,7 @@ def test_list_displays_set_get_local_setting(
 requests.max-retries = 0
 solver.lazy-wheel = true
 system-git-client = false
+system-truststore = false
 virtualenvs.create = false
 virtualenvs.in-project = null
 virtualenvs.options.always-copy = false
@@ -380,6 +385,7 @@ def test_list_must_not_display_sources_from_pyproject_toml(
 requests.max-retries = 0
 solver.lazy-wheel = true
 system-git-client = false
+system-truststore = false
 virtualenvs.create = true
 virtualenvs.in-project = null
 virtualenvs.options.always-copy = false