GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix/external client CA bundle by cloutierMat · Pull Request #13451 · localstack/localstack

This repository was archived by the owner on Mar 23, 2026. It is now read-only.

Conversation

@cloutierMat

@cloutierMat cloutierMat commented Dec 2, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Motivation

This PR enforces custom CA Certificates to the ExternalBypassDnsClientFactory. This change will enable our users using proxy with ssl termination to register their own CA bundles.

Changes

The CA bundle provided with REQUESTS_CA_BUNDLE will now be used to configure the connections of the ExternalBypassDnsClientFactory

Tests

Related

fixes UNC-137
upstream test full-run: 19842076873

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@cloutierMat
use REQUESTS_CA_BUNDLE for external client
f8fbfb4
@github-actions

github-actions Bot commented Dec 2, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

S3 Image Test Results (AMD64 / ARM64)

    2 files  ±0    2 suites  ±0   7m 48s ⏱️ +2s
  544 tests ±0  492 ✅ ±0   52 💤 ±0  0 ❌ ±0 
1 088 runs  ±0  984 ✅ ±0  104 💤 ±0  0 ❌ ±0 

Results for commit 7675df2. ± Comparison against base commit c603057.

♻️ This comment has been updated with latest results.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cloutierMat
restrict the use of CA_BUNDLE to the ExternalBypassDnsClientFactory
cc7b958
@cloutierMat cloutierMat added semver: patch Non-breaking changes which can be included in patch releases area: replicator docs: skip Pull request does not require documentation changes notes: skip Pull request does not have to be mentioned in the release notes labels Dec 2, 2025
@github-actions

github-actions Bot commented Dec 2, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Test Results - Preflight, Unit

22 889 tests  ±0   21 075 ✅ ±0   6m 53s ⏱️ +26s
     1 suites ±0    1 814 💤 ±0 
     1 files   ±0        0 ❌ ±0 

Results for commit 7675df2. ± Comparison against base commit c603057.

♻️ This comment has been updated with latest results.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cloutierMat
revert changes to ExternalAwsClientFactory
0b19097
@github-actions

github-actions Bot commented Dec 2, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Test Results (amd64) - Acceptance

7 tests  ±0   5 ✅ ±0   3m 26s ⏱️ +7s
1 suites ±0   2 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 7675df2. ± Comparison against base commit c603057.

♻️ This comment has been updated with latest results.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions

github-actions Bot commented Dec 2, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Test Results (amd64) - Integration, Bootstrap

    5 files  ±0      5 suites  ±0   2h 39m 36s ⏱️ - 1m 9s
5 477 tests ±0  4 925 ✅ ±0  552 💤 ±0  0 ❌ ±0 
5 483 runs  ±0  4 925 ✅ ±0  558 💤 ±0  0 ❌ ±0 

Results for commit 7675df2. ± Comparison against base commit c603057.

♻️ This comment has been updated with latest results.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions

github-actions Bot commented Dec 2, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

LocalStack Community integration with Pro

    2 files  ±0      2 suites  ±0   2h 3m 48s ⏱️ -26s
5 103 tests ±0  4 711 ✅ ±0  392 💤 ±0  0 ❌ ±0 
5 105 runs  ±0  4 711 ✅ ±0  394 💤 ±0  0 ❌ ±0 

Results for commit 7675df2. ± Comparison against base commit c603057.

♻️ This comment has been updated with latest results.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cloutierMat
cloutierMat marked this pull request as ready for review December 2, 2025 02:33
@cloutierMat
cloutierMat requested a review from thrau as a code owner December 2, 2025 02:33
@cloutierMat
cloutierMat requested a review from simonrw December 2, 2025 02:34
@cloutierMat cloutierMat added the review: merge when ready Signals to the reviewer that a PR can be merged if accepted label Dec 2, 2025
simonrw
simonrw approved these changes Dec 2, 2025
View reviewed changes

@simonrw simonrw left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am ok with this change given the current api but this envar is not one of ours - it's from requests itself. It's a shame we are hard coding these variables rather than reading from the standard environment. Ho hum...

Let's just address my suggestion otherwise

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread localstack-core/localstack/aws/connect.py Outdated
if ca_cert := os.getenv("REQUESTS_CA_BUNDLE"):
LOG.debug("Creating External AWS Client with REQUESTS_CA_BUNDLE=%s", ca_cert)

super().__init__(use_ssl=True, verify=ca_cert or True, session=session, config=config)

@simonrw simonrw Dec 2, 2025

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we use USE_SSL here for the ssl flag?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@cloutierMat cloutierMat Dec 2, 2025

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a shame we are hard coding these variables rather than reading from the standard environment. Ho hum...

I agree this isn't the cleanest, but this is what is currently used and documented in LocalStack. I thought of using AWS_CA_BUNDLE instead, but it seemed quite repetitive with what is already implemented for ca bundles.

Should we use USE_SSL here for the ssl flag?

Good point. Is there any security concern for the user to do so? I guess they are in control of setting the env, so probably not.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@cloutierMat
pr comment
7675df2
@cloutierMat
cloutierMat merged commit 049201f into main Dec 2, 2025
49 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@cloutierMat
cloutierMat deleted the fix/external-client-ca-bundle branch December 2, 2025 20:25
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@thrau thrau Awaiting requested review from thrau
1 more reviewer
@simonrw simonrw simonrw approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

area: replicator docs: skip Pull request does not require documentation changes notes: skip Pull request does not have to be mentioned in the release notes review: merge when ready Signals to the reviewer that a PR can be merged if accepted semver: patch Non-breaking changes which can be included in patch releases

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@cloutierMat @simonrw
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.