TLS inspection breaks the tool: where do I change it to fix?

[keithdouglas]

I realize that the TLS inspection is "my own concern". However, would it be possible to document where the Rust library from tree-sitter gets its source of root CAs from so we can work around this? The error is:

tree_sitter_language_pack.LanguageNotFoundError: Download error: Failed to fetch manifest from https://github.com/kreuzberg-dev/tree-sitter-language-pack/releases/download/v1.6.2/parsers.json: io: invalid peer certificate: UnknownIssuer

which I know from our experience with the inspection product is the fact that it effectively MITMs TLS.

[tob-scott-a]

I'm honestly not sure. That file downloads fine for me without any TLS warnings.

[tob-scott-a]

Claude determined the following:

Looked into it. The download is not coming from trailmark or from the tree-sitter Rust crate — it's from tree-sitter-language-pack 1.6+, which was rewritten as a Rust extension by kreuzberg-dev and now downloads grammar binaries on demand from GitHub Releases. The earlier Goldziher 0.x line shipped all grammars inside the wheel and made zero network calls at runtime.

The error message format (io: invalid peer certificate: UnknownIssuer) is from rustls / webpki. I confirmed by inspecting the strings inside _native.abi3.so (the package on disk):

• HTTP client: ureq 3.3.0
• TLS: rustls 0.23.38 with webpki-roots (Mozilla bundle)
• The binary does not include the platform-verifier feature, and there is no native-tls fallback compiled in
• There is no configure(...) knob for custom CAs — only cache_dir

That last point is the punchline: rustls + webpki-roots only trusts the hard-coded Mozilla CA list. Adding your corporate MITM CA to the OS trust store (Keychain / Windows cert store / /etc/ssl/...) is ignored. No SSL_CERT_FILE / REQUESTS_CA_BUNDLE knob will help here.

What does work, in order of effort:

1. Pre-populate the cache offline. From a machine that isn't behind TLS inspection, run python -c "import tree_sitter_language_pack as t; t.download_all()" — that pulls parsers.json and the per-platform .tar.zst archives into ~/Library/Caches/tree-sitter-language-pack/v<ver>/libs/ (Linux: ~/.cache/..., Windows: %LOCALAPPDATA%\...). Copy that whole directory onto the inspected box and trailmark will skip the download. This is the cleanest workaround for one developer.
2. HTTPS_PROXY to a non-inspecting egress. ureq does honor HTTP_PROXY/HTTPS_PROXY/NO_PROXY, so if your inspection product can be bypassed via an alternate proxy for github.com + objects.githubusercontent.com, that works without any code changes.
3. Allowlist github.com and objects.githubusercontent.com in the inspection appliance. This is the right answer if your security team will sign off — these are the only hosts the package talks to.

I hope that helps in the short-term, but I'm considering a long-term fix that doesn't fetch anything from GitHub (i.e., Trailmark should just work without Internet access or GitHub uptime).

[keithdouglas]

I'll have to investigate further, but thanks for your prompt answer. In our case, likely only the first option will be suitable. I'll return after my investigation.

[keithdouglas]

I have set up this in a way like in #1

Directory of C:\Users\usernamedeleted\AppData\Local\tree-sitter-language-pack\v1.6.2\libs

05/01/2026 05:13 PM

.
05/01/2026 05:13 PM ..
05/01/2026 05:02 PM 18,042,652 parsers-windows-x86_64.tar.zst
04/30/2026 11:10 AM 24,760 parsers.json

This doesn't seem to work; I was unsure on the v1.6.2 part - and it seems to also sort of correspond to what the https://github.com/kreuzberg-dev/tree-sitter-language-pack seems to say. I was trying to follow the code but it was fairly abstract in places (ironically having a tree would help :))

[adam-moss]

I hit this issue yesterday. It is tree-sitter-language-pack trying to do a download of the *.dylib files. They have changed it in the v1.9 release to use the platform trust store but that's still in rc (see xberg-io/tree-sitter-language-pack#125). v1.6.2 only uses the rust webpki store.

What you can do is download it manually and put in the cache dir, which for me on mac is

~/Library/Caches/tree-sitter-language-pack/v1.6.2

From https://github.com/kreuzberg-dev/tree-sitter-language-pack/releases/v1.6.2

download put the parsers.json into the <cache dir>
download and exract the parsers-<platform>-<arch>.tar.std into <cache dir>/libs

The other alternative is to modify the pyproject.toml to put tree-sitter-language-pack==1.9.0rc30 and reinstall

[tob-scott-a]

@adam-moss Good find. I'll update to v1.9.0 when a stable release is out. For the time being, we already bumped to 1.8 in dev-main and I plan to cut a minor release soon.

[adam-moss]

Looks like 1.9 is out... and several 1.10's too. I think there may be something weird happening over there