try truststore

app/__init__.py

@@ -1,13 +1,17 @@
-import os
+import truststore
-import pathlib
-import re
-import secrets
-from functools import partial
-from time import monotonic
-from urllib.parse import unquote, urlparse, urlunparse
 
-import jinja2
+truststore.inject_into_ssl()
-from flask import (
+
+import os  # noqa
+import pathlib  # noqa
+import re  # noqa
+import secrets  # noqa
+from functools import partial  # noqa
+from time import monotonic  # noqa
+from urllib.parse import unquote, urlparse, urlunparse  # noqa
+
+import jinja2  # noqa
+from flask import (  # noqa
     current_app,
     flash,
     g,
@@ -18,21 +22,21 @@ from flask import (
     session,
     url_for,
 )
-from flask.globals import request_ctx
+from flask.globals import request_ctx  # noqa
-from flask_login import LoginManager, current_user
+from flask_login import LoginManager, current_user  # noqa
-from flask_talisman import Talisman
+from flask_talisman import Talisman  # noqa
-from flask_wtf import CSRFProtect
+from flask_wtf import CSRFProtect  # noqa
-from flask_wtf.csrf import CSRFError
+from flask_wtf.csrf import CSRFError  # noqa
-from itsdangerous import BadSignature
+from itsdangerous import BadSignature  # noqa
-from werkzeug.exceptions import HTTPException as WerkzeugHTTPException
+from werkzeug.exceptions import HTTPException as WerkzeugHTTPException  # noqa
-from werkzeug.exceptions import abort
+from werkzeug.exceptions import abort  # noqa
-from werkzeug.local import LocalProxy
+from werkzeug.local import LocalProxy  # noqa
 
-from app import proxy_fix
+from app import proxy_fix  # noqa
-from app.asset_fingerprinter import asset_fingerprinter
+from app.asset_fingerprinter import asset_fingerprinter  # noqa
-from app.config import configs
+from app.config import configs  # noqa
-from app.extensions import redis_client
+from app.extensions import redis_client  # noqa
-from app.formatters import (
+from app.formatters import (  # noqa
     convert_markdown_template,
     convert_time_unixtimestamp,
     convert_to_boolean,
@@ -77,48 +81,54 @@ from app.formatters import (
     square_metres_to_square_miles,
     valid_phone_number,
 )
-from app.models.organization import Organization
+from app.models.organization import Organization  # noqa
-from app.models.service import Service
+from app.models.service import Service  # noqa
-from app.models.user import AnonymousUser, User
+from app.models.user import AnonymousUser, User  # noqa
-from app.navigation import (
+from app.navigation import (  # noqa
     CaseworkNavigation,
     HeaderNavigation,
     MainNavigation,
     OrgNavigation,
     SecondaryNavigation,
 )
-from app.notify_client import InviteTokenError
+from app.notify_client import InviteTokenError  # noqa
-from app.notify_client.api_key_api_client import api_key_api_client
+from app.notify_client.api_key_api_client import api_key_api_client  # noqa
-from app.notify_client.billing_api_client import billing_api_client
+from app.notify_client.billing_api_client import billing_api_client  # noqa
-from app.notify_client.complaint_api_client import complaint_api_client
+from app.notify_client.complaint_api_client import complaint_api_client  # noqa
-from app.notify_client.events_api_client import events_api_client
+from app.notify_client.events_api_client import events_api_client  # noqa
-from app.notify_client.inbound_number_client import inbound_number_client
+from app.notify_client.inbound_number_client import inbound_number_client  # noqa
-from app.notify_client.invite_api_client import invite_api_client
+from app.notify_client.invite_api_client import invite_api_client  # noqa
-from app.notify_client.job_api_client import job_api_client
+from app.notify_client.job_api_client import job_api_client  # noqa
-from app.notify_client.notification_api_client import notification_api_client
+from app.notify_client.notification_api_client import notification_api_client  # noqa
-from app.notify_client.org_invite_api_client import org_invite_api_client
+from app.notify_client.org_invite_api_client import org_invite_api_client  # noqa
-from app.notify_client.organizations_api_client import organizations_client
+from app.notify_client.organizations_api_client import organizations_client  # noqa
-from app.notify_client.performance_dashboard_api_client import (
+from app.notify_client.performance_dashboard_api_client import (  # noqa
     performance_dashboard_api_client,
 )
-from app.notify_client.platform_stats_api_client import platform_stats_api_client
+from app.notify_client.platform_stats_api_client import (  # noqa
-from app.notify_client.service_api_client import service_api_client
+    platform_stats_api_client,
-from app.notify_client.status_api_client import status_api_client
+)
-from app.notify_client.template_folder_api_client import template_folder_api_client
+from app.notify_client.service_api_client import service_api_client  # noqa
-from app.notify_client.template_statistics_api_client import template_statistics_client
+from app.notify_client.status_api_client import status_api_client  # noqa
-from app.notify_client.upload_api_client import upload_api_client
+from app.notify_client.template_folder_api_client import (  # noqa
-from app.notify_client.user_api_client import user_api_client
+    template_folder_api_client,
-from app.url_converters import SimpleDateTypeConverter, TemplateTypeConverter
+)
-from app.utils.api_health import is_api_down
+from app.notify_client.template_statistics_api_client import (  # noqa
-from app.utils.govuk_frontend_jinja.flask_ext import init_govuk_frontend
+    template_statistics_client,
-from notifications_python_client.errors import HTTPError
+)
-from notifications_utils import logging, request_helper
+from app.notify_client.upload_api_client import upload_api_client  # noqa
-from notifications_utils.formatters import (
+from app.notify_client.user_api_client import user_api_client  # noqa
+from app.url_converters import SimpleDateTypeConverter, TemplateTypeConverter  # noqa
+from app.utils.api_health import is_api_down  # noqa
+from app.utils.govuk_frontend_jinja.flask_ext import init_govuk_frontend  # noqa
+from notifications_python_client.errors import HTTPError  # noqa
+from notifications_utils import logging, request_helper  # noqa
+from notifications_utils.formatters import (  # noqa
     formatted_list,
     get_lines_with_normalised_whitespace,
 )
-from notifications_utils.recipients import format_phone_number_human_readable
+from notifications_utils.recipients import format_phone_number_human_readable  # noqa
-from notifications_utils.url_safe_token import generate_token
+from notifications_utils.url_safe_token import generate_token  # noqa
 
 login_manager = LoginManager()
 csrf = CSRFProtect()
@@ -362,6 +372,7 @@ def init_app(application):
     @application.context_processor
     def _attach_enums():
         from app.enums import ServicePermission
+
         return {"ServicePermission": ServicePermission}
 
     @application.context_processor

notifications_python_client/__init__.py

@@ -8,6 +8,9 @@
 # -- http://semver.org/
 
 __version__ = "10.0.1"
+import truststore
+
+truststore.inject_into_ssl()
 
 from notifications_python_client.errors import (  # noqa
     REQUEST_ERROR_MESSAGE,

notifications_utils/__init__.py

@@ -1,4 +1,8 @@
-import re
+import truststore
+
+truststore.inject_into_ssl()
+
+import re  # noqa
 
 SMS_CHAR_COUNT_LIMIT = 918  # 153 * 6, no network issues but check with providers before upping this further
 LETTER_MAX_PAGE_COUNT = 10

poetry.lock

@@ -3774,6 +3774,18 @@ files = [
     {file = "trove_classifiers-2025.5.9.12.tar.gz", hash = "sha256:7ca7c8a7a76e2cd314468c677c69d12cc2357711fcab4a60f87994c1589e5cb5"},
 ]
 
+[[package]]
+name = "truststore"
+version = "0.10.1"
+description = "Verify certificates using native system trust stores"
+optional = false
+python-versions = ">=3.10"
+groups = ["main"]
+files = [
+    {file = "truststore-0.10.1-py3-none-any.whl", hash = "sha256:b64e6025a409a43ebdd2807b0c41c8bff49ea7ae6550b5087ac6df6619352d4c"},
+    {file = "truststore-0.10.1.tar.gz", hash = "sha256:eda021616b59021812e800fa0a071e51b266721bef3ce092db8a699e21c63539"},
+]
+
 [[package]]
 name = "typing-extensions"
 version = "4.14.0"
@@ -4129,4 +4141,4 @@ cffi = ["cffi (>=1.11)"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.12.9"
-content-hash = "3b1e525166fe084650e33258a33d9e3d0fccfccb096ccdc10ea596d08a8af43c"
+content-hash = "f332dabb4fe02ac6e6225a4f09ae19c7e0343818eb574b507b4c7ccbd9a05f47"

pyproject.toml

@@ -68,6 +68,7 @@ python-dateutil = "^2.9.0.post0"
 pyyaml = "^6.0.1"
 requests = "^2.32.4"
 six = "^1.16.0"
+truststore = "^0.10.1"
 urllib3 = "^2.5.0"
 webencodings = "^0.5.1"
 virtualenv = "<20.33"

tests/app/__init__.py

@@ -0,0 +1,3 @@
+import truststore
+
+truststore.inject_into_ssl()