Pysonar should depend on truststore

SonarQube Server / Community Build
1

Hello,

I’m really interested in using pysonar, but it depends on requests, which itself relies on certifi as a root certificate store.

This causes issues in corporate environments (such as mine) where self-signed system certificates must be used to secure connections to self-hosted services such as SonarQube Server.

truststore seems like a good candidate as it is already widely used within the Python community:

It is maintained by Seth Larson, Python core developer and Security Developer at the Python Software Foundation.

truststore depends on Python 3.10 and so does pysonar.

Instead of using requests.get, pysonar would have to use a requests.Session instance, create an HTTP adapter using SSL context from truststore, and mount it using requests.Session.mount (see pip/src/pip/_internal/network/session.py for reference).

I would really enjoy using pysonar and I hope that you will be interested in this suggestion!

2

Hi @leodevian,

Thanks for the detailed write-up, helpful feedback for our teams.

The underlying pain point you’ve identified is already tracked internally. The two-store problem (Python requests/certifi for the bootstrapping layer + Java truststore for the analysis engine itself) is a known friction point for corporate environments. I don’t have a timeline for its implementation, but here’s the public ticket: Jira.

For now, the workaround is to set the REQUESTS_CA_BUNDLE or SSL_CERT_FILE environment variable to a certificate bundle that includes your corporate CA:

export REQUESTS_CA_BUNDLE=/path/to/your/ca-bundle.crt
pysonar-scanner ...

This covers the Python requests side. For the Java analysis engine side, you’ll also need to provide a PKCS#12 truststore, see TLS certificates on client side for details.

I’ll flag your truststore suggestion to the team as a concrete implementation path worth considering, the pip reference implementation you linked is a good precedent.

Cheers,

Stevan

4

Hello Stevan,

Thank you for your answer. While REQUESTS_CA_BUNDLE and SSL_CERT_FILE work nicely on Linux (where system certs are stored at known locations), it can be tricker to set these variables on Windows (where system certs are stored in the system store).

Personnaly I did install truststore alongside pysonar and added _truststore.pth in the site-packages directory:

import truststore; truststore.inject_into_ssl()

It works but it is a hack that relies on the site module…

Cheers,

Léo