diff --git a/news/13343.bugfix.rst b/news/13343.bugfix.rst new file mode 100644 index 00000000000..5462b1b3fb8 --- /dev/null +++ b/news/13343.bugfix.rst @@ -0,0 +1 @@ +Ensure truststore feature remains active even when a proxy is also in use. diff --git a/src/pip/_internal/network/session.py b/src/pip/_internal/network/session.py index 5e10f8f5615..d38b5067fba 100644 --- a/src/pip/_internal/network/session.py +++ b/src/pip/_internal/network/session.py @@ -54,6 +54,7 @@ from ssl import SSLContext from pip._vendor.urllib3.poolmanager import PoolManager + from pip._vendor.urllib3.proxymanager import ProxyManager logger = logging.getLogger(__name__) @@ -286,6 +287,13 @@ def init_poolmanager( **pool_kwargs, ) + def proxy_manager_for(self, proxy: str, **proxy_kwargs: Any) -> "ProxyManager": + # Proxy manager replaces the pool manager, so inject our SSL + # context here too. https://github.com/pypa/pip/issues/13288 + if self._ssl_context is not None: + proxy_kwargs.setdefault("ssl_context", self._ssl_context) + return super().proxy_manager_for(proxy, **proxy_kwargs) # type: ignore[misc] + class HTTPAdapter(_SSLContextAdapterMixin, _BaseHTTPAdapter): pass