Merge pull request #22897 from github/go/proxy-git-cainfo-env-pr2

Go: Pass proxy certificate to git via GIT_SSL_CAINFO

Author: jketema

go/extractor/registries/registryproxy.go

@@ -103,7 +103,13 @@ func getEnvVars() []string {
 			slog.Error("Failed to close the temporary certificate file", slog.String("error", err.Error()))
 		} else {
 			proxy_cert_file = f.Name()
-			result = append(result, fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file))
+			// `SSL_CERT_FILE` is used by Go itself; `GIT_SSL_CAINFO` is used by the `git`
+			// processes that `go` spawns to fetch `git_source` modules.
+			result = append(
+				result,
+				fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file),
+				fmt.Sprintf("GIT_SSL_CAINFO=%s", proxy_cert_file),
+			)
 		}
 	}
 
@@ -160,18 +166,6 @@ func getEnvVars() []string {
 
 			if len(git_sources) > 0 {
 				goprivate = append(goprivate, git_sources...)
-
-				if proxy_cert_file != "" {
-					slog.Info("Configuring `git` to use proxy certificate", slog.String("path", proxy_cert_file))
-					cmd := exec.Command("git", "config", "--global", "http.sslCAInfo", proxy_cert_file)
-
-					out, cmdErr := cmd.CombinedOutput()
-					slog.Info(string(out))
-
-					if cmdErr != nil {
-						slog.Error("Failed to configure `git` to accept the certificate file", slog.String("error", cmdErr.Error()))
-					}
-				}
 			}
 
 			result = append(result, fmt.Sprintf("GOPRIVATE=%s", strings.Join(goprivate, ",")))

go/extractor/registries/registryproxy_test.go

@@ -1,6 +1,8 @@
 package registries
 
 import (
+	"os"
+	"slices"
 	"testing"
 )
 
@@ -131,3 +133,23 @@ func TestParseRegistryConfigsMultipleGoProxyServers(t *testing.T) {
 		t.Fatalf("Expected `URL` to be `https://goproxy.io`, but got `%s`", second.URL)
 	}
 }
+
+func TestGetEnvVarsScopesCertificateToSubprocesses(t *testing.T) {
+	t.Setenv(PROXY_HOST, "")
+	t.Setenv(PROXY_PORT, "")
+	t.Setenv(PROXY_URLS, "")
+	t.Setenv(PROXY_CA_CERTIFICATE, "dummy certificate")
+
+	vars := getEnvVars()
+	defer os.Remove(proxy_cert_file)
+
+	if proxy_cert_file == "" {
+		t.Fatal("Expected a temporary certificate file to be created.")
+	}
+
+	for _, expected := range []string{"SSL_CERT_FILE=" + proxy_cert_file, "GIT_SSL_CAINFO=" + proxy_cert_file} {
+		if !slices.Contains(vars, expected) {
+			t.Errorf("Expected `getEnvVars` to return %q, but got %v.", expected, vars)
+		}
+	}
+}

go/ql/lib/change-notes/2026-10-26-registry-proxy-certificate.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* The Go extractor no longer modifies the global Git configuration when private `git_source` registries are configured. The registry proxy certificate is now passed to Git through the `GIT_SSL_CAINFO` environment variable instead, which only affects the Git processes spawned by `go`.