Option to disable SSL verification

[simonvdk]

• I have searched the issues of this repo and believe that this is not a duplicate.
• I have searched the documentation and believe that my question is not covered.

Feature Request

This is mainly a revival of #1556, following 1.2.0 release.

Why reopen this feature request:

• when using poetry in a corporate environment, it can make sense to trust the host and deactivate SSL verification; above old issue received quite a few upvotes
• to do so, the popular workaround was setting CURL_CA_BUNDLE="" so that requests does not verify SSL
• poetry 1.2.0 is based on a recent version of requests, which removed this workaround recently and refuse to have a way to set this using environment variables (even a very specific one). Their (valid) argument is that it should be the responsibility of tools/applications using requests (e.g. poetry) to expose a way to deactivate it, then internally using the verify requests argument (CURL_CA_BUNDLE= disables certificate verification psf/requests#6071 (comment))
• this feature is preventing people to switch from pipenv (or other dependency management tools that have that option) to the awesome poetry

Being able to set this from the CLI and pyproject.toml would help people transition to poetry

[dimbleby]

https://python-poetry.org/docs/repositories/#certificates

The value of certificates..cert can be set to false if certificate verification is required to be skipped.

?

[simonvdk]

Thanks a lot, missed that from the documentation !

[radiophysicist]

Hello,

I have not effect with this setting -- poetry (version 1.4.1) still throws a certificate validation error:

SSLError(SSLError(1, '[SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] unsafe legacy renegotiation disabled (_ssl.c:997)')))

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.