Plumb ca_certs_path to the plugin resolver.

[jsirois]

This should be the last place ca_certs_path needs plumbing.

[ci skip-rust]
[ci skip-build-wheels]

[Eric-Arellano]

Thanks for following up on this.

[jsirois]

Tested ad-hoc with:

$ git diff
diff --git a/pants.toml b/pants.toml
index f014b0c47..65225ff22 100644
--- a/pants.toml
+++ b/pants.toml
@@ -1,4 +1,10 @@
 [GLOBAL]
+# ca_certs_path = "/etc/hosts"
+ca_certs_path = "/etc/ca-certificates/extracted/ca-bundle.trust.crt"
+plugins = [
+  "setuptools>=41.0",
+]
+
 print_exception_stacktrace = true
 
 pants_distdir_legacy_paths = false

Works as shown, fails with /etc/hosts toggled in for ca_certs_path.

[jsirois]

Reviewers - its probably good to vet the second commit (5355712) too. I reverted @thamenato's change in #10909 since that just bandaided over this problem.

[thamenato]

I was wondering about adding that env var in the sense of what if I need any other env var to be passed to the subprocesses? I understand why lock it but shouldn't that be a bit more dynamic?

[coveralls]

Coverage remained the same at 0.0% when pulling 5355712 on jsirois:ca_cert/fix_plugins into ec9f266 on pantsbuild:master.

[jsirois]

Ok - @thamenato provided more detailed Pants log output offline. That shows his issue is not the guessed plugins issue, but a resolve of black + setuptools for the black rule. I'm going to revert the second commit here. The 1st commit fixes a looming problem though with plugins so stands on its own.

[benjyw]

So still a mystery as to why --certs isn't sufficient...

[jsirois]

So still a mystery as to why --certs isn't sufficient...

Correct.

[jsirois]

Narrowing down the mystery over here: pex-tool/pex#1058
Its only getting more mysterious though.