From 156f67dee2365fd584c653f34e9b65a6b6eece49 Mon Sep 17 00:00:00 2001 From: memsharded Date: Mon, 28 Sep 2026 18:59:04 +0200 Subject: [PATCH 1/2] wip --- reference/config_files/global_conf.rst | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/reference/config_files/global_conf.rst b/reference/config_files/global_conf.rst index 257ed41fa68..4105bd64b4b 100644 --- a/reference/config_files/global_conf.rst +++ b/reference/config_files/global_conf.rst @@ -386,7 +386,24 @@ certificate (and the key) using the following configuration variables: The ``cacert_path`` Conan configuration is forwarded to the ``python-requests`` ``verify`` argument, see `Python-requests SSL certificates `_. That means that if the ``REQUESTS_CA_BUNDLE`` environment variable is defined, it might be taken into account too. - + +* ``core.net.http:trust_store``: (Experimental) If ``True``, additionally verify HTTPS certificates against + the OS-native trust store (the certificate store managed by your operating system) using the + `truststore `_ package. It is used *together with*, not instead of, + the ``certifi`` CA bundle that Conan uses by default, so a certificate is accepted if it validates against + either one. + + .. code-block:: text + :caption: **[CONAN_HOME]/global.conf** + + core.net.http:trust_store=True + + This requires Python >= 3.10, and it is not compatible with ``core.net.http:cacert_path``: Conan raises an + error if both are enabled at the same time, or if this conf is enabled with an older Python version. The + ``truststore`` package itself is installed automatically as a Conan dependency when installing Conan with + ``pip`` on Python >= 3.10; if it is missing (for example, when using other installation methods), Conan + raises an error indicating to run ``pip install truststore``. + * ``core.net.http:client_cert``: Path or tuple of files containing a client certificate (and the key). See more details in `Python requests and Client Side Certificates `_ From 23d5cebe5b863ae9c92b53d18680e353719b8fe0 Mon Sep 17 00:00:00 2001 From: memsharded Date: Mon, 28 Sep 2026 19:00:03 +0200 Subject: [PATCH 2/2] wip --- reference/config_files/global_conf.rst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/reference/config_files/global_conf.rst b/reference/config_files/global_conf.rst index 4105bd64b4b..abae5a45e80 100644 --- a/reference/config_files/global_conf.rst +++ b/reference/config_files/global_conf.rst @@ -401,8 +401,7 @@ certificate (and the key) using the following configuration variables: This requires Python >= 3.10, and it is not compatible with ``core.net.http:cacert_path``: Conan raises an error if both are enabled at the same time, or if this conf is enabled with an older Python version. The ``truststore`` package itself is installed automatically as a Conan dependency when installing Conan with - ``pip`` on Python >= 3.10; if it is missing (for example, when using other installation methods), Conan - raises an error indicating to run ``pip install truststore``. + ``pip`` on Python >= 3.10; if it is missing, Conan raises an error. * ``core.net.http:client_cert``: Path or tuple of files containing a client certificate (and the key). See more details in `Python requests and Client Side Certificates `_