From 01e50388f0cc1bcf78e8eef41af08e50b2c94e81 Mon Sep 17 00:00:00 2001 From: Ryan Keith Date: Fri, 7 Aug 2026 11:43:38 -0700 Subject: [PATCH 1/2] omit unset REQUESTS_CA_BUNDLE from build env Pass it through via get_default like SSL_CERT_FILE so an empty value is not injected into subprocess environments (botocore). Co-authored-by: Cursor --- conda_build/environ.py | 2 +- .../user-guide/environment-variables.rst | 3 +++ news/6063-requests-ca-bundle.md | 19 +++++++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 news/6063-requests-ca-bundle.md diff --git a/conda_build/environ.py b/conda_build/environ.py index 4020721475..fdd9e4ed19 100644 --- a/conda_build/environ.py +++ b/conda_build/environ.py @@ -413,7 +413,6 @@ def conda_build_vars(prefix, config): "SRC_DIR": src_dir, "HTTPS_PROXY": os.getenv("HTTPS_PROXY", ""), "HTTP_PROXY": os.getenv("HTTP_PROXY", ""), - "REQUESTS_CA_BUNDLE": os.getenv("REQUESTS_CA_BUNDLE", ""), "DIRTY": "1" if config.dirty else "", "ROOT": context.root_prefix, } @@ -801,6 +800,7 @@ def os_vars(m, prefix): get_default("LANG") get_default("LC_ALL") get_default("MAKEFLAGS") + get_default("REQUESTS_CA_BUNDLE") d["SHLIB_EXT"] = get_shlib_ext(m.config.host_platform) d["PATH"] = os.environ.copy()["PATH"] diff --git a/docs/source/user-guide/environment-variables.rst b/docs/source/user-guide/environment-variables.rst index 849dba7f66..64c9d0d514 100644 --- a/docs/source/user-guide/environment-variables.rst +++ b/docs/source/user-guide/environment-variables.rst @@ -78,6 +78,9 @@ inherited from the shell environment in which you invoke - Inherited from your shell environment. * - HTTPS_PROXY - Inherited from your shell environment. + * - REQUESTS_CA_BUNDLE + - Inherited from your shell environment when set. + Omitted when unset so TLS clients do not see an empty CA path. * - LANG - Inherited from your shell environment. * - MAKEFLAGS diff --git a/news/6063-requests-ca-bundle.md b/news/6063-requests-ca-bundle.md new file mode 100644 index 0000000000..e8e543c1bd --- /dev/null +++ b/news/6063-requests-ca-bundle.md @@ -0,0 +1,19 @@ +### Enhancements + +* + +### Bug fixes + +* Only pass through ``REQUESTS_CA_BUNDLE`` when it is set in the environment, matching ``SSL_CERT_FILE``. Setting it to an empty string broke TLS clients such as botocore. (#6063) + +### Deprecations + +* + +### Docs + +* Document ``REQUESTS_CA_BUNDLE`` as an inherited build environment variable. (#6063) + +### Other + +* From 5a082be4f314fee0b9d9a6711709efbb8c42d28d Mon Sep 17 00:00:00 2001 From: Ryan Keith Date: Fri, 7 Aug 2026 13:44:00 -0700 Subject: [PATCH 2/2] Update 6063-requests-ca-bundle.md --- news/6063-requests-ca-bundle.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/news/6063-requests-ca-bundle.md b/news/6063-requests-ca-bundle.md index e8e543c1bd..c8e4174c0f 100644 --- a/news/6063-requests-ca-bundle.md +++ b/news/6063-requests-ca-bundle.md @@ -4,7 +4,7 @@ ### Bug fixes -* Only pass through ``REQUESTS_CA_BUNDLE`` when it is set in the environment, matching ``SSL_CERT_FILE``. Setting it to an empty string broke TLS clients such as botocore. (#6063) +* Only pass through ``REQUESTS_CA_BUNDLE`` when it is set in the environment, matching ``SSL_CERT_FILE``. Setting it to an empty string broke TLS clients such as botocore. (#6063 via #6083) ### Deprecations @@ -12,7 +12,7 @@ ### Docs -* Document ``REQUESTS_CA_BUNDLE`` as an inherited build environment variable. (#6063) +* Document ``REQUESTS_CA_BUNDLE`` as an inherited build environment variable. (#6063 via #6083) ### Other