fix backend system trust store

backend/main.py

@@ -41,6 +41,22 @@
 logging.getLogger("httpx").setLevel(logging.WARNING)
 logging.getLogger("httpcore").setLevel(logging.WARNING)
 
+
+def _enable_system_trust_store() -> None:
+    try:
+        import truststore
+
+        truststore.inject_into_ssl()
+        logging.getLogger("main").info("System trust store enabled")
+    except Exception:
+        logging.getLogger("main").warning(
+            "Failed to enable system trust store; falling back to default CA bundle",
+            exc_info=True,
+        )
+
+
+_enable_system_trust_store()
+
 from app import api
 from app.component.environment import env
 from app.router import register_routers

backend/pyproject.toml

@@ -24,6 +24,7 @@ dependencies = [
     "opentelemetry-api>=1.34.1",
     "opentelemetry-sdk>=1.34.1",
     "opentelemetry-exporter-otlp-proto-http>=1.34.1",
+    "truststore>=0.10.0",
 ]
 
 

backend/tests/app/test_main_truststore.py

@@ -0,0 +1,50 @@
+import os
+import subprocess
+import sys
+import textwrap
+from pathlib import Path
+
+import pytest
+
+
+@pytest.mark.unit
+def test_main_import_enables_system_trust_store_for_httpx(tmp_path):
+    """Guard the backend entrypoint's early truststore injection."""
+    backend_dir = Path(__file__).resolve().parents[2]
+    script = textwrap.dedent(
+        """
+        import ssl
+
+        import httpx
+        import httpx._config
+        import truststore
+
+        import main
+
+        if ssl.SSLContext is not truststore.SSLContext:
+            raise SystemExit(
+                f"ssl.SSLContext was not patched: {ssl.SSLContext!r}"
+            )
+
+        ctx = httpx._config.create_ssl_context()
+        if not isinstance(ctx, truststore.SSLContext):
+            raise SystemExit(
+                "httpx did not use truststore after backend startup: "
+                f"{type(ctx)!r}"
+            )
+        """
+    )
+    env = os.environ.copy()
+    env["HOME"] = str(tmp_path)
+    env["USERPROFILE"] = str(tmp_path)
+
+    result = subprocess.run(
+        [sys.executable, "-c", script],
+        cwd=backend_dir,
+        env=env,
+        text=True,
+        capture_output=True,
+        timeout=30,
+    )
+
+    assert result.returncode == 0, result.stdout + result.stderr