Custom CA Certs

[cdhunt]

Can you provide an argument and/or path to load custom CA certs similar to pkl for the formae cli?

[discount-elf]

Can you check and see if cert loading works from ~/.pkl/cacerts ? We will review adding a CLI flag or other method directly.

[cdhunt]

That is what I'm doing for pkl project resolve, but I get the SSL handshake error with formae eval main.pkl. I've even tried update-ca-certificates to update the system ca store and formae doesn't seem to use them. I'm using the formae docker image.

[discount-elf]

That's strange, we will investigate.

[cdhunt]

I used pkl download-package projectpackage://hub.platform.engineering/plugins/pkl/schema/pkl/formae/formae@0.82.0 --cache-dir vendor

And put this in PklProject:

evaluatorSettings {
  moduleCacheDir = "vendor"
}

This was enough for me to get pkl eval working, but formae eval doesn't appear to use the moduleCacheDir setting.

[discount-elf]

We need to update our Pkl stack to 3.1 I will take a look at this while doing that work, shortly.

[discount-elf]

That error would seem to imply however that the system cert chains aren't loaded, only the certs in the cacerts dir.

[cdhunt]

Sorry, to add some context, our corporate security implementation breaks TLS with an intentional man-in-the-middle attack to ensure we're not doing something nefarious on the internet. This breaks nearly every tool that tries to actually prevent this very behavior. I constantly play whack-a-mole with trying to get our CA cert in the correct place. I've tried updating the system cacerts, and for whatever reason, Pkl still choked on the self-signed cert, and I had to use the .pkl/cacerts. So, yes, I think you are correct about the system certs, but I'll take any functional approach so I can test out the tool.