feat: add GLEAM_CACERTS_PATH env variable

CHANGELOG.md

@@ -13,6 +13,10 @@
   making Gleam packages discoverable through global search of HexDocs.
   ([Diemo Gebhardt](https://github.com/diemogebhardt))
 
+- Allow users to set the `GLEAM_CACERTS_PATH` environment variable to specify a
+  path to a directory containing CA certificates to install Hex packages.
+  ([winstxnhdw](https://github.com/winstxnhdw))
+
 ### Language server
 
 ### Formatter

compiler-cli/src/http.rs

@@ -2,10 +2,17 @@ use std::convert::TryInto;
 use std::sync::OnceLock;
 
 use async_trait::async_trait;
-use gleam_core::{Error, Result};
+use camino::Utf8PathBuf;
+use gleam_core::{
+    error::{FileIoAction, FileKind},
+    Error, Result,
+};
 use http::{Request, Response};
+use reqwest::{Certificate, Client};
 
-static REQWEST_CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+use crate::fs;
+
+static REQWEST_CLIENT: OnceLock<Client> = OnceLock::new();
 
 #[derive(Debug)]
 pub struct HttpClient;
@@ -26,11 +33,8 @@ impl gleam_core::io::HttpClient for HttpClient {
         let request = request
             .try_into()
             .expect("Unable to convert HTTP request for use by reqwest library");
-        let mut response = REQWEST_CLIENT
-            .get_or_init(reqwest::Client::new)
-            .execute(request)
-            .await
-            .map_err(Error::http)?;
+        let client = init_client().map_err(Error::http)?;
+        let mut response = client.execute(request).await.map_err(Error::http)?;
         let mut builder = Response::builder()
             .status(response.status())
             .version(response.version());
@@ -42,3 +46,35 @@ impl gleam_core::io::HttpClient for HttpClient {
             .map_err(Error::http)
     }
 }
+
+fn init_client() -> Result<&'static Client, Error> {
+    if let Some(client) = REQWEST_CLIENT.get() {
+        return Ok(client);
+    }
+
+    let certificate_path = match std::env::var("GLEAM_CACERTS_PATH") {
+        Ok(path) => path,
+        Err(_) => {
+            return Ok(REQWEST_CLIENT.get_or_init(|| {
+                Client::builder()
+                    .build()
+                    .expect("Failed to create reqwest client")
+            }));
+        }
+    };
+
+    let certificate_bytes = fs::read_bytes(&certificate_path)?;
+    let certificate = Certificate::from_pem(&certificate_bytes).map_err(|error| Error::FileIo {
+        kind: FileKind::File,
+        action: FileIoAction::Parse,
+        path: Utf8PathBuf::from(&certificate_path),
+        err: Some(error.to_string()),
+    })?;
+
+    Ok(REQWEST_CLIENT.get_or_init(|| {
+        Client::builder()
+            .add_root_certificate(certificate)
+            .build()
+            .expect("Failed to create reqwest client")
+    }))
+}