langgenius/dify-plugin-daemon
1
0
Fork 0
mirror of https://github.com/langgenius/dify-plugin-daemon.git synced 2026-07-21 17:25:23 -04:00
Code Issues 111 Packages Projects Releases 10 Wiki Activity

[local] uv in virtual environment ignores UV_NATIVE_TLS, causing SSL certificate issues behind corporate proxy #50

New Issue
Closed
opened 2026-02-16 00:19:24 -05:00 by yindo · 1 comment
yindo commented 2026-02-16 00:19:24 -05:00
Owner
Copy Link
Copy Source

Originally created by @zolgear on GitHub (Mar 19, 2025).

We are self-hosting inside a corporate proxy where SSL inspection rewrites certificates.
To accommodate this, we mounted our custom root certificate and configured SSL_CERT_FILE accordingly.

Here’s an excerpt from our docker-compose.override.yaml:

  plugin_daemon:
    restart: unless-stopped
    environment:
      SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
      REQUESTS_CA_BUNDLE: /usr/local/share/ca-certificates/extra/ex_ca.pem
      UV_NATIVE_TLS: true
      UV_INSECURE_HOST: "*"
    volumes:
      - ../certs/ex_ca.pem:/usr/local/share/ca-certificates/ex_ca.crt
      - ../certs/ex_ca.pem:/usr/local/share/ca-certificates/extra/ex_ca.pem
    ports: !override []
    entrypoint: /bin/bash
    command:
      - "-c"
      - |
        update-ca-certificates && exec /app/entrypoint.sh

We have added our corporate root certificate to ex_ca.pem, ensuring that system-wide and Python SSL inspection configurations are correctly handled.

However, the following error occurs when running this code in internal/core/plugin_manager/local_runtime/environment_python.go:

Error in InitPythonEnvironment()

2025/03/19 01:41:12 runtime_lifetime.go:70: [INFO]init environment for plugin langgenius/ollama:0.0.3
2025/03/19 01:41:16 runtime_lifetime.go:76: [ERROR]init environment failed: failed to install dependencies: exit status 1, output:   × Failed to fetch: `https://pypi.org/simple/dify-plugin/`
  ├─▶ Request failed after 3 retries
  ├─▶ error sending request for url (https://pypi.org/simple/dify-plugin/)
  ├─▶ client error (Connect)
  ╰─▶ invalid peer certificate: UnknownIssuer
  help: Consider enabling use of system TLS certificates with the
        `--native-tls` command-line flag
, retry in 30s

The error occurs when installing plugin dependencies using uv.
According to the uv documentation, we added UV_NATIVE_TLS: true and UV_INSECURE_HOST: "*".

Running uv inside the Docker container shell works fine.
However, when uv is executed within the virtual environment created by the following code, it does not respect the environment variables and instead uses the virtual environment's certificate settings:

[Relevant code in dify-plugin-daemon](https://github.com/langgenius/dify-plugin-daemon/blob/84edb2682d569dca2011564d4d1c13f0a42fdc9f/internal/core/plugin_manager/local_runtime/environment_python.go#L121-L126)

As a workaround, adding --native-tls to the arguments allows successful installation:

	args = append([]string{"pip"}, args...)

	// Add --native-tls to the args
	args = append(args, "--native-tls")

	virtualEnvPath := path.Join(p.State.WorkingPath, ".venv")
	cmd = exec.CommandContext(ctx, uvPath, args...)
	cmd.Env = append(cmd.Env, "VIRTUAL_ENV="+virtualEnvPath, "PATH="+os.Getenv("PATH"))
	cmd.Dir = p.State.WorkingPath

Question:

Are environment variables restricted when executing commands in Go for security reasons?
If so, would it be possible to add support for UV_NATIVE_TLS to address this issue?

Originally created by @zolgear on GitHub (Mar 19, 2025). We are self-hosting inside a corporate proxy where SSL inspection rewrites certificates. To accommodate this, we mounted our custom root certificate and configured `SSL_CERT_FILE` accordingly. Here’s an excerpt from our `docker-compose.override.yaml`: ```yaml plugin_daemon: restart: unless-stopped environment: SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt REQUESTS_CA_BUNDLE: /usr/local/share/ca-certificates/extra/ex_ca.pem UV_NATIVE_TLS: true UV_INSECURE_HOST: "*" volumes: - ../certs/ex_ca.pem:/usr/local/share/ca-certificates/ex_ca.crt - ../certs/ex_ca.pem:/usr/local/share/ca-certificates/extra/ex_ca.pem ports: !override [] entrypoint: /bin/bash command: - "-c" - | update-ca-certificates && exec /app/entrypoint.sh ``` We have added our corporate root certificate to `ex_ca.pem`, ensuring that system-wide and Python SSL inspection configurations are correctly handled. However, the following error occurs when running this code in `internal/core/plugin_manager/local_runtime/environment_python.go`: ### Error in `InitPythonEnvironment()` ```log 2025/03/19 01:41:12 runtime_lifetime.go:70: [INFO]init environment for plugin langgenius/ollama:0.0.3 2025/03/19 01:41:16 runtime_lifetime.go:76: [ERROR]init environment failed: failed to install dependencies: exit status 1, output: × Failed to fetch: `https://pypi.org/simple/dify-plugin/` ├─▶ Request failed after 3 retries ├─▶ error sending request for url (https://pypi.org/simple/dify-plugin/) ├─▶ client error (Connect) ╰─▶ invalid peer certificate: UnknownIssuer help: Consider enabling use of system TLS certificates with the `--native-tls` command-line flag , retry in 30s ``` The error occurs when installing plugin dependencies using `uv`. According to the `uv` documentation, we added `UV_NATIVE_TLS: true` and `UV_INSECURE_HOST: "*"`. Running `uv` inside the Docker container shell works fine. However, when `uv` is executed within the virtual environment created by the following code, it does not respect the environment variables and instead uses the virtual environment's certificate settings: [[Relevant code in dify-plugin-daemon](https://github.com/langgenius/dify-plugin-daemon/blob/84edb2682d569dca2011564d4d1c13f0a42fdc9f/internal/core/plugin_manager/local_runtime/environment_python.go#L121-L126)](https://github.com/langgenius/dify-plugin-daemon/blob/84edb2682d569dca2011564d4d1c13f0a42fdc9f/internal/core/plugin_manager/local_runtime/environment_python.go#L121-L126) As a workaround, adding `--native-tls` to the arguments allows successful installation: ```go args = append([]string{"pip"}, args...) // Add --native-tls to the args args = append(args, "--native-tls") virtualEnvPath := path.Join(p.State.WorkingPath, ".venv") cmd = exec.CommandContext(ctx, uvPath, args...) cmd.Env = append(cmd.Env, "VIRTUAL_ENV="+virtualEnvPath, "PATH="+os.Getenv("PATH")) cmd.Dir = p.State.WorkingPath ``` ### Question: Are environment variables restricted when executing commands in Go for security reasons? If so, would it be possible to add support for `UV_NATIVE_TLS` to address this issue?
yindo closed this issue 2026-02-16 00:19:24 -05:00
yindo commented 2026-02-16 00:19:25 -05:00
Author
Owner
Copy Link
Copy Source

@zolgear commented on GitHub (Mar 19, 2025):

I found PIP_EXTRA_ARGS.

By adding PIP_EXTRA_ARGS="--native-tls" to the environment variables, the issue was resolved.

@zolgear commented on GitHub (Mar 19, 2025): I found `PIP_EXTRA_ARGS`. By adding `PIP_EXTRA_ARGS="--native-tls"` to the environment variables, the issue was resolved.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Windows
bug
cmd
documentation
enhancement
go
good first issue
plugin-daemon
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify-plugin-daemon#50
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?