pgrx init doesn't work with self-signed certificate

[tumluliu]

Hi there, thanks for making this amazing framework. I however has hit the wall behind a coporation proxy as we are using our own certificate:

❯ cargo pgrx init
Error:
   0: unable to retrieve https://www.postgresql.org/versions.rss
   1: https://www.postgresql.org/versions.rss: Connection Failed: tls connection init failed: invalid peer certificate: UnknownIssuer
   2: invalid peer certificate: UnknownIssuer

Location:
   /home/xx/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cargo-pgrx-0.11.2/src/command/version.rs:42

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ SPANTRACE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

   0: cargo_pgrx::command::init::execute
      at /home/xx/.cargo/registry/src/index.crates.io-6f17d22bba15001f/cargo-pgrx-0.11.2/src/command/init.rs:83

I took a very quick look at the code from version.rs here and it seems it caused by the ureq Agent you created is using the default webpki-roots instead of the OS' trust store (refs: 1, 2 ). So I guess it's not very easy to change this behaviour without modifying the mod.rs codes? But I'm not sure since I'm neither an expert in security nor in rust. I'm wondering if there is a quick way to bypass this cert complaint when running init. Could you provide some hints? Thanks again!

p.s. my env: Ubuntu 22.04 Linux

[workingjubilee]

If setting HTTPS_PROXY doesn't fix it, then there is no quick way and it does require modifying the code using rustls-native-certs.

[tumluliu]

If setting HTTPS_PROXY doesn't fix it, then there is no quick way and it does require modifying the code using rustls-native-certs.

Thanks @workingjubilee . I do have HTTP_PROXY, HTTPS_PROXY and NO_RPOXY settings from my internal env all the time, together with a self-signed certificate. This is how my apt, pip, npm, cargo etc. works. If possible, please include the support for rustls-native-certs in the upcoming releases as I am internally testing the feasibility of pgrx. Thanks very very much

[workingjubilee]

With #1448 and #1449 this should be solved for either the rustls or native-tls builds of cargo-pgrx.

@tumluliu Please test this using cargo install --path cargo-pgrx --no-default-features --features rustls after cloning the repository and pulling the latest develop. You may also want to try using --no-default-features --features native-tls. One of them should work for you. Please let us know which ones you tested, and which ones work. And please feel free to reopen this issue if neither do.

[tumluliu]

@workingjubilee sorry for the late reply and thanks a lot for the fix! We have tried cargo install --path cargo-pgrx --no-default-features --features rustls and it worked well with the self-signed certificate. So it can be confirmed as fixed from my end