cargo-pgrx: use system certificate store for HTTPS validation

cargo-pgrx/Cargo.toml

@@ -55,7 +55,7 @@ env_proxy = "0.4.1"
 serde.workspace = true
 serde-xml-rs = "0.6.0"
 tar = "0.4.44"
-ureq = { version = "3.0.10", default-features = false, features = ["gzip"] }
+ureq = { version = "3.0.10", default-features = false, features = ["gzip", "platform-verifier", "rustls"] }
 url.workspace = true
 which = "7.0.3"
 zip-extract = "0.2.2"
@@ -74,10 +74,11 @@ features = [
 
 [features]
 default = ["rustls"]
-native-tls = ["ureq/native-tls"]
+native-tls = ["ureq/native-tls", "ureq/platform-verifier"]
 rustls = [
     "ureq/rustls",
-    "ureq/native-tls" # induces rustls to use the OS-level root of trust
+    "ureq/native-tls", # induces rustls to use the OS-level root of trust
+    "ureq/platform-verifier" # use platform certificate store for validation
 ]
 
 [lints.clippy]

cargo-pgrx/src/command/mod.rs

@@ -8,6 +8,7 @@
 //LICENSE
 //LICENSE Use of this source code is governed by the MIT license that can be found in the LICENSE file.
 use env_proxy::for_url_str;
+use ureq::tls::{RootCerts, TlsConfig};
 use ureq::{Agent, Proxy};
 
 pub(crate) mod connect;
@@ -31,13 +32,22 @@ pub(crate) mod upgrade;
 pub(crate) mod version;
 
 // Build a ureq::Agent by the given url. Requests from this agent are proxied if we have
-// set the HTTPS_PROXY/HTTP_PROXY environment variables.
+// set the HTTPS_PROXY/HTTP_PROXY environment variables. This agent uses the platform's
+// certificate store to validate HTTPS connections, which works better with corporate proxies
+// that may use custom certificate authorities for SSL inspection.
 fn build_agent_for_url(url: &str) -> eyre::Result<Agent> {
+    // Create a TLS config that uses the platform's certificate store
+    let tls_config = TlsConfig::builder().root_certs(RootCerts::PlatformVerifier).build();
+
     if let Some(proxy_url) = for_url_str(url).to_string() {
-        let config = Agent::config_builder().proxy(Some(Proxy::new(&proxy_url)?)).build();
+        let config = Agent::config_builder()
+            .proxy(Some(Proxy::new(&proxy_url)?))
+            .tls_config(tls_config)
+            .build();
         Ok(Agent::new_with_config(config))
     } else {
-        Ok(Agent::new_with_defaults())
+        let config = Agent::config_builder().tls_config(tls_config).build();
+        Ok(Agent::new_with_config(config))
     }
 }