UV --native-tls not respecting system certs on RHEL8

[TheFriendlyCoder]

Summary

In a clean base image / docker image running RHEL8 (ubi in my case), some tools don't seem to "play nice" with the system certs when run under uv. One being the mkdocstrings plugin for mkdocs. When it tries to reach out to a public repo to gather Python doc inv files (ie: https://docs.python.org/3/objects.inv) it fails with an SSL certificate failure. Setting the SSL_CERT_FILE env var to the default path of the system cert bundle (ie: /etc/pki/tls/certs/ca-bundle.crt) works as expected, but passing the --native-tls flag to uv does not.

I'm not sure if you have access to "ubi" base images or not, but the steps to reproduce look something like this:

1. Run docker run -it icr.io/appcafe/ibm-semeru-runtimes:open-17-jdk-ubi /bin/bash (mounting a sample workspace into the container if needed)
2. Run uv run mkdocs build --strict - build fails
3. Run uv run --native-tls mkdocs build --strict - build fails
4. Run SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt uv run mkdocs build --strict - build succeeds

The sample project I'm working on has some dependencies like this:

dev = [
    "mkdocs",
    "mkdocs-material",
    "mkdocstrings[python]"
]

and an mkdocs.yml file that looks something like this:

site_name: "fubar"

theme:
  name: material

plugins:
- mkdocstrings:
    default_handler: python
    handlers:
      python:
        import:
          - https://docs.python.org/3/objects.inv

The exact error produced is:

ERROR   -  mkdocstrings: Couldn't load inventory https://docs.python.org/3/objects.inv through handler 'python': <urlopen error [SSL:
           CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1129)>

Platform

RHEL8

Version

uv 0.6.14

Python version

Python 3.10.16, Python 3.9.18

[TheFriendlyCoder]

In case it helps, I just reproduced the bug with the publicly available centos7 version of the same container.

[TheFriendlyCoder]

This being said, it's not all together clear to me how/why the built in SSL certs in uv would have a problem with a publicly accessible host like python.org.

[konstin]

The error is occurring in Python code, while --native-tls only affects uv. I assume that SSL_CERT_FILE helps because environment variables also affect subprocesses, in this case the Python process and its http library. You can confirm this by running with uv sync && python ... instead of uv run.

[TheFriendlyCoder]

So, the one discrepancy here is that when installing a Python version managed by the OS distribution, and attempting the exact same operation, there is no need to set the SSL_CERT_FILE env var. So the issue I am describing here is either an issue with UV itself, or the Python runtime version installed and managed by UV.

If the suggestion here is that the --native-tls flag only impacts the behavior of UV itself and not the tools that UV installs and manages / makes use of under the hood, then perhaps this distinction should be made clear in the documentation. Further, it stands to reason that a solution for this problem should still be investigated on some level - if not as a bug within UV itself, then perhaps as a bug with the pre-built Python runtime that it deploys behind the scenes.

With this in mind, I would be happy to create a duplicate bug report elsewhere if there is a more appropriate place for it to be reported (ie: if there is a separate issue track for reporting bugs in the underlying Python runtimes managed by UV, and if you feel this is a more appropriate location for reporting this bug). Just let me know how/where to transfer the information.

Thanks for your help on this, and keep up the good work! Despite a few small hiccups like this, we've found UV to still be the most stable package management system for Python since the creation of the core setuptools / pip toolchain. I appreciate all of your efforts and continue to look forward to seeing what great work you have coming on the horizon.

[konstin]

Can you share a complete reproducible example that reproduces the difference between system Python and uv managed Python? I can't reproduce this locally and the docker container has user permissions due to which I can't follow along with the problem description.

[TheFriendlyCoder]

@konstin Sorry for the delay - been busy lately.

I've put together a sample project here to demonstrate the problem. Just checkout the sample repo and run ./run.sh. You should see an error similar to:

ERROR   -  mkdocstrings: Couldn't load inventory {'url': 'https://docs.python.org/3/objects.inv'} through PythonHandler.load_inventory: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1149)>

[konstin]

Thank you for the self-contained Docker MRE!

If i change the last line to

.venv/bin/mkdocs build

I get the same error, so the error happens when running Python, not through uv. I tried to check whether the difference was Astral's Python distribution vs. the system Python, but yum update -y fails.