does maturin build --target x86_64-pc-windows-msvc support custom CA ?

[Owen-CH-Leung]

Bug Description

I've been trying to use the official maturin docker image v1.3.0 to cross compile my projects into python wheels. We're required to use a custom CA so I've already copied my custom .crt file into /etc/pki/tls/certs and run update-ca-trust accordingly.

While maturin build --compatibility manylinux_2_28 works well, maturin build --target x86_64-pc-windows-msvc always return the following error :

Error:
Connection failed: tls connection init failed: invalid peer certificate: UnknownIssuer

I digged a bit deeper and notice that when building a x86_64-pc-windows-msvc target, it will reach out to the domain https://aka.ms to download the Microsoft CRT

https://github.com/Jake-Shadle/xwin/blob/main/src/manifest.rs#L119

And I'm sure that network wise, this site is always reachable (proven by the fact that curl -L --cacert to the website returns a valid content)

I've already set all the env variables that I can find online (namely: MATURIN_CA_BUNDLE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, CARGO_HTTP_CAINFO, SSL_CERT_FILE) to point to the custom cert but still no luck solving the unknownIssuer error.

How should I set the process maturin build --target x86_64-pc-windows-msvc to use a custom CA ? Or is it not supported yet due to downstream crates not supporting this ?

Your maturin version (maturin --version)

0.13.0

Your Python version (python -V)

3.7.17

Your pip version (pip -V)

22.3.1

What bindings you're using

pyo3

Does cargo build work?

• Yes, it works

If on windows, have you checked that you aren't accidentally using unix path (those with the forward slash /)?

• Yes

Steps to Reproduce

Unfortunately I'm not sure how to reproduce this exact same error since I'm getting this error in a private network with several proxy in place. But perhaps you can run the docker image inside an isolated network, create a custom CA cert and tune your network set up so that curl to the domain https://aka.ms will fail unless you supply this custom CA cert

[messense]

Does it work outside of docker container?

[Owen-CH-Leung]

Just tested. Also didn't work on a linux machine

[messense]

I'm afraid I won't be able to fix it if you can't provide a detailed steps to reproduce since it requires very specific environment to trigger the issue.

Pull requests are welcome if you can get it fixed, I think you'd have to fix it in xwin first then we can update the dependency version in maturin.

[messense]

cargo-xwin was updated to 0.15.0 in #1847, you can try the docker image using ghcr.io/pyo3/maturin:main.