From c04452a240a13dbd0ede548fd1842d433d18419e Mon Sep 17 00:00:00 2001
From: viyatb-oai <viyatb@openai.com>
Date: Tue, 21 Jul 2026 07:05:39 +0000
Subject: [PATCH] Honor `CARGO_HTTP_CAINFO` in managed proxy environments
 (#34478)

## What changed

Add `CARGO_HTTP_CAINFO` to the curated custom CA environment variables so
Cargo inherits the managed MITM trust bundle. Preserve any startup Cargo CA
bundle in the generated trust bundle alongside the other supported overrides.

GitOrigin-RevId: 207847aa556d3a4f667ddb9e52d99e87ef984cae
---
 codex-rs/network-proxy/src/certs.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/codex-rs/network-proxy/src/certs.rs b/codex-rs/network-proxy/src/certs.rs
index 442211f60b..9e6578e52c 100644
--- a/codex-rs/network-proxy/src/certs.rs
+++ b/codex-rs/network-proxy/src/certs.rs
@@ -154,13 +154,14 @@ pub(crate) const SSL_CERT_DIR_ENV_KEY: &str = "SSL_CERT_DIR";
 
 // Best-effort compatibility set for common child toolchains that accept a CA bundle path.
 // This is intentionally curated rather than pretending to cover every TLS client.
-pub const CUSTOM_CA_ENV_KEYS: [&str; 10] = [
+pub const CUSTOM_CA_ENV_KEYS: [&str; 11] = [
     "CODEX_CA_CERTIFICATE",
     "SSL_CERT_FILE",
     "REQUESTS_CA_BUNDLE",
     "CURL_CA_BUNDLE",
     "NODE_EXTRA_CA_CERTS",
     "GIT_SSL_CAINFO",
+    "CARGO_HTTP_CAINFO",
     "PIP_CERT",
     "BUNDLE_SSL_CA_CERT",
     "npm_config_cafile",