Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

reference/ca-certificates: Update Nextclade section with its new configurability #236

Merged
merged 1 commit into from
Oct 22, 2024
Merged

reference/ca-certificates: Update Nextclade section with its new configurability #236

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 20 additions & 8 deletions src/reference/ca-certificates.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,23 +157,35 @@ Set the |REQUESTS_CA_BUNDLE|_ environment variable to override.
Nextclade CLI
-------------

*Applies to Nextclade v3.*
*Applies to Nextclade v3.9.0 and onwards.*

Uses its own bundled snapshot of `Mozilla's CA trust store`_ via the
|webpki-roots|_ Rust crate (by way of the ``reqwest`` crate's
|rustls-tls-webpki-roots feature|_).
Uses CA certificates extracted from the OS-level trust store via the
|rustls-native-certs|_ Rust crate plus its own bundled snapshot of `Mozilla's
CA trust store`_ via the |webpki-roots|_ Rust crate (by way of the ``reqwest``
crate's |rustls-tls-webpki-roots feature|_).

There is currently no way to configure or modify the trust store without
modifying the Nextclade source code.
Set the OpenSSL-style ``SSL_CERT_FILE`` or ``SSL_CERT_DIR`` environment
variables to override the OS-level trust store (on all platforms, not just
those using :ref:`OpenSSL <openssl>`). The bundled trust store is always
included and cannot be overridden or disabled.

.. I have a fix in-flight for ↑ that. —trs, 10 Oct 2024
Set the |NEXTCLADE_EXTRA_CA_CERTS|_ environment variable to add CA
certificates to the default trust store.

.. note:: Nextclade v3.8.2 and earlier provides no way to configure or modify
the trust store.

.. |rustls-native-certs| replace:: ``rustls-native-certs``
.. _rustls-native-certs: https://docs.rs/crate/rustls-native-certs/0.8.0

.. |webpki-roots| replace:: ``webpki-roots``
.. _webpki-roots: https://docs.rs/webpki-roots/0.26.6/webpki_roots/
.. _webpki-roots: https://docs.rs/crate/webpki-roots/0.26.6

.. |rustls-tls-webpki-roots feature| replace:: ``rustls-tls-webpki-roots`` feature
.. _rustls-tls-webpki-roots feature: https://docs.rs/reqwest/0.12.8/reqwest/#optional-features

.. |NEXTCLADE_EXTRA_CA_CERTS| replace:: ``NEXTCLADE_EXTRA_CA_CERTS``
.. _NEXTCLADE_EXTRA_CA_CERTS: https://docs.nextstrain.org/projects/nextclade/en/3.9.0/user/nextclade-cli/reference.html#nextclade-dataset-get


.. _aws-cli:
Expand Down
Loading