Insert CA cert bundle during build to deal with transparent proxy

[morrone]

I am having pretty much the same issue as #2193. However the solution listed there is having no improvement. It seems like my ca cert bundle just isn't getting into the build environment for use by Paketo Buildpack.

I start with:

$ func create -l python -t http foo
$ cd foo

Then the build:

$ func build -v --builder pack --registry whatever.com/foo
<skip>
Preparing paths
Running build command

Paketo Buildpack for CA Certificates 3.12.2
  https://github.com/paketo-buildpacks/ca-certificates
  Build Configuration:
    $BP_EMBED_CERTS                    false  Embed certificates into the image
    $BP_ENABLE_RUNTIME_CERT_BINDING    true   Deprecated: Enable/disable certificate helper layer to add certs at runtime
    $BP_RUNTIME_CERT_BINDING_DISABLED  false  Disable certificate helper layer to add certs at runtime
  Launch Helper: Contributing to layer
    Creating /layers/paketo-buildpacks_ca-certificates/helper/exec.d/ca-certificates-helper
Processing layers
Updating environment
Reading output files
Updating buildpack processes
Updating process list
Finished running build for buildpack paketo-buildpacks/ca-certificates@3.12.2
Running build for buildpack paketo-buildpacks/cpython@1.18.25
Looking up buildpack
Finding plan
Creating plan directory
Preparing paths
Running build command
Paketo Buildpack for CPython 1.18.25
  Resolving CPython version
    Candidate version sources (in priority order):
      pyproject.toml -> ">=3.10"
                     -> ""
      <unknown>      -> ""

    Selected CPython version (using pyproject.toml): 3.14.4

  Executing build process
    Installing CPython 3.14.4
failed to fetch dependency: failed to make request: Get "https://artifacts.paketo.io/python/python_3.14.4_linux_amd64_jammy_010bec17.tgz": tls: failed to verify certificate: x509: certificate signed by unknown authority
Timer: Builder ran for 157.483792ms and ended at 2026-05-13T23:36:20Z
ERROR: failed to build: exit status 1


Error: failed to build the function: executing lifecycle: failed with status code: 51

I am confident that my issue is the lack of my employer's CA cert bundle, because I am able to reproduce the issue using a containerize curl of the same paketo URL:

$ podman run --rm curlimages/curl -L -v https://artifacts.paketo.io/python/python_3.14.4_linux_amd64_jammy_010bec17.tgz --output /dev/null
<skip>
curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain (19)
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the webpage mentioned above.

I also know that I have a good CA bundle, because I can map the bundle into the curl container as a volume file, and tell curl to us it with "--cafile /ca-certificates.crt", and curl is then indeed able to download the file.

Putting the ca-certificates.crt file in the top level of my func-created project directory, and adding the following to the func.yaml file did not help the problem. It does not seem to me that the file is being used.

build:
  buildEnvs:
    - name: SSL_CERT_DIR
      value: /workspace

[Itx-Psycho0]

Hi @monroef,

I'd like to work on this issue. I have experience with the func codebase .

This looks like a valuable feature for users behind corporate proxies. Before I start, I have a few questions to ensure I understand the requirements correctly:

Should the CA cert bundle be configurable via:
Environment variable (e.g., FUNC_CA_BUNDLE)?
CLI flag (e.g., --ca-bundle)?
func.yaml configuration?
All of the above?

Should this apply to:
Only the build process (pack/s2i)?
Also the deploy process?
Runtime function execution?

For the implementation, I'm thinking:
Add CA bundle path configuration option
Inject the CA certs into the build environment
Update pack/s2i builders to use the custom CA bundle
Add tests to verify CA bundle injection works

Does this approach sound good? If you can assign this issue to me, I'll start working on it.

Thanks!

[morrone]

@Itx-Psycho0 thanks, that you be great!

I am pretty new to func, so I'm not entirely sure the most consistent way to implement this support. Any or all of those ways (env variable, CLI flag, func.yaml) sound reasonable to me.

The build process for --build=pack is of most concern right now. For whatever reason, the s2i builder works fine (but produces giant 300MB+ container images for just the simple http template function).

I do not know about deploy. I do know that I was able to do "func build --push", and have it push the container image to an internal corporate container registry. That registry almost certainly has an http cert sign by our corporate CA. So I do not know for certain about deploy, but at moment I only have an issue down inside Paketo Buildpack's containerized environment.

[morrone]

/assign Itx-Psycho0

[Itx-Psycho0]

Hi @monroef,

I've implemented the CA bundle support we discussed. The PR adds a --ca-bundle flag, environment variable support, and a caCertBundle field in func.yaml. It works with both pack and s2i builders by mounting the certificate file and setting the appropriate environment variables for different runtimes.

PR: #3751

Let me know if you have any feedback.

[morrone]

Thanks, @Itx-Psycho0, but that does not appear to fix the issue for us. I wonder if we need to do more than just setting environment variables. See this paketo documetation about CA certs:

https://paketo.io/docs/howto/configuration/#ca-certificates