Allow setting ca certificates path via environment variable

[btkostner]

Right now you can set this path via the --ca-certificates cli argument which solves most problems. However when plk is integrated into other projects or used in some way were we can't pass in args, things start to get ugly.

I think a solid solution would be allowing PLK_CA_CERTIFICATES= environment variable. This would make it much easier to work in an enterprise environment where all traffic is with a self signed certificate.

[HT154]

The recommended way to configure CA certs globally is to place them in ~/.pkl/cacerts. Would doing this work in your situation?

There's some related discussion in #1039.

[btkostner]

It requires some extra work for all of our employees before using pkl or anything that uses pkl.

In this case we are using hk for setting up git hooks, and it's much easier for us to just set an environment variable in the project than requiring every developer to copy files on their setup.

[bioball]

In the future, we'd like for Pkl to look for CA certs installed at the OS level, which should make this much simpler for everybody.

In general, we try to avoid using env vars as a configuration source, because these names can possibly conflict with other env vars.

Have you considered having a shareable script that installs CA certs for Pkl? For example, for macOS:

mkdir -p ~/.pkl/cacerts
security export -t certs -f pemseq -k /System/Library/Keychains/SystemRootCertificates.keychain -o ~/.pkl/cacerts/systemrootscacerts.pem
security export -t certs -f pemseq -k /Library/Keychains/System.keychain -o ~/.pkl/cacerts/cacerts.pem

[btkostner]

This is what we're going to have to do for our team