[jwong-beep]

Adds a build.AdditionalCACerts config option: a list of PEM files containing CA certificates
to trust, in addition to the system trust store, for Please's own HTTPS downloads
(remote_file and self-update).

Restricted environments often route downloads through a caching proxy that terminates TLS so it
can cache HTTPS responses, or serve them from an internal mirror. Either way the certificates are
issued by a private CA, which Please can't currently verify. HTTPProxy handles plain forwarding
proxies but not this.

[build]
httpproxy = https://proxy.internal:3128
additionalcacerts = /etc/pki/internal-root.pem

Notes:

• Only affects Please's internal downloads. Tools invoked by build rules (e.g. go mod download)
  use their own trust settings.
• When HTTPProxy is set, fetchRemoteFile now modifies the default transport rather than
  replacing it with a bare http.Transport, so it keeps connection timeouts, connection pooling
  and HTTP/2.
• A missing or invalid cert file fails remote_file targets. Self-update only logs a warning and
  falls back to the system trust store, since it runs on every invocation.
• Tests: TestAdditionalCACerts runs a TLS server with a private cert and checks the download
  fails without the option and succeeds with it; TestTLSConfig covers the error cases.

[scyyx5]

Can you add more detail to the summary about why we want the additional CA?

[jwong-beep]

added

…

On Thu, 22 Oct 2026 at 16:02, Anya Xiao ***@***.***> wrote: *scyyx5* left a comment (thought-machine/please#3639) <#3639 (comment)> Can you add more detail to the summary about why we want the additional CA? — Reply to this email directly, view it on GitHub <#3639?email_source=notifications&email_token=BZEGGBHOGQ7MPAVY3WY5WOD5VIOPXA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZUGM4TKNBTHA22M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-6343954385>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BZEGGBAFKDKFC4TQAI4XESD5VIOPXAVCNFSNUABEKJSXA33TNF2G64TZHM2TAOJRGU4DMNZ3JFZXG5LFHM2TSOBRGUYDSOBXGSQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BZEGGBENBEON7MIGEVWCO3T5VIOPXA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZUGM4TKNBTHA22M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BZEGGBFBAPLDI2LWMZ3BHWD5VIOPXA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMZUGM4TKNBTHA22M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Thought Machine Group Limited, a company registered in England & Wales. Registered number: 11114277.  Registered Office: 5 New Street Square, London EC4A 3TW <https://maps.google.com/?q=5+New+Street+Square,+London+EC4A+3TW&entry=gmail&source=g>. The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.