diff --git a/conda_build/environ.py b/conda_build/environ.py index 4020721475..fdd9e4ed19 100644 --- a/conda_build/environ.py +++ b/conda_build/environ.py @@ -413,7 +413,6 @@ def conda_build_vars(prefix, config): "SRC_DIR": src_dir, "HTTPS_PROXY": os.getenv("HTTPS_PROXY", ""), "HTTP_PROXY": os.getenv("HTTP_PROXY", ""), - "REQUESTS_CA_BUNDLE": os.getenv("REQUESTS_CA_BUNDLE", ""), "DIRTY": "1" if config.dirty else "", "ROOT": context.root_prefix, } @@ -801,6 +800,7 @@ def os_vars(m, prefix): get_default("LANG") get_default("LC_ALL") get_default("MAKEFLAGS") + get_default("REQUESTS_CA_BUNDLE") d["SHLIB_EXT"] = get_shlib_ext(m.config.host_platform) d["PATH"] = os.environ.copy()["PATH"] diff --git a/docs/source/user-guide/environment-variables.rst b/docs/source/user-guide/environment-variables.rst index 849dba7f66..64c9d0d514 100644 --- a/docs/source/user-guide/environment-variables.rst +++ b/docs/source/user-guide/environment-variables.rst @@ -78,6 +78,9 @@ inherited from the shell environment in which you invoke - Inherited from your shell environment. * - HTTPS_PROXY - Inherited from your shell environment. + * - REQUESTS_CA_BUNDLE + - Inherited from your shell environment when set. + Omitted when unset so TLS clients do not see an empty CA path. * - LANG - Inherited from your shell environment. * - MAKEFLAGS diff --git a/news/6063-requests-ca-bundle.md b/news/6063-requests-ca-bundle.md new file mode 100644 index 0000000000..c8e4174c0f --- /dev/null +++ b/news/6063-requests-ca-bundle.md @@ -0,0 +1,19 @@ +### Enhancements + +* + +### Bug fixes + +* Only pass through ``REQUESTS_CA_BUNDLE`` when it is set in the environment, matching ``SSL_CERT_FILE``. Setting it to an empty string broke TLS clients such as botocore. (#6063 via #6083) + +### Deprecations + +* + +### Docs + +* Document ``REQUESTS_CA_BUNDLE`` as an inherited build environment variable. (#6063 via #6083) + +### Other + +*