Keep TLS verify settings ahead of REQUESTS_CA_BUNDLE

docker/api/client.py

@@ -237,6 +237,15 @@ def _set_request_timeout(self, kwargs):
         kwargs.setdefault('timeout', self.timeout)
         return kwargs
 
+    def merge_environment_settings(self, url, proxies, stream, verify, cert):
+        """Keep the TLS verification configured on the client instead of
+        letting ``REQUESTS_CA_BUNDLE`` or ``CURL_CA_BUNDLE`` replace it."""
+        if verify is None:
+            verify = self.verify
+        return super().merge_environment_settings(
+            url, proxies, stream, verify, cert
+        )
+
     @update_headers
     def _post(self, url, **kwargs):
         return self.post(url, **self._set_request_timeout(kwargs))

tests/unit/api_test.py

@@ -620,6 +620,44 @@ def test_custom_user_agent(self):
         assert headers['User-Agent'] == 'foo/bar'
 
 
+class TLSVerifyTest(unittest.TestCase):
+    cert_dir = os.path.join(os.path.dirname(__file__), 'testdata/certs')
+
+    def setUp(self):
+        self.patcher = mock.patch.object(
+            APIClient, 'send', return_value=response()
+        )
+        self.mock_send = self.patcher.start()
+        self.env_patcher = mock.patch.dict(
+            os.environ,
+            {'REQUESTS_CA_BUNDLE': os.path.join(self.cert_dir, 'cert.pem')},
+        )
+        self.env_patcher.start()
+
+    def tearDown(self):
+        self.env_patcher.stop()
+        self.patcher.stop()
+
+    def _sent_verify(self, tls_config):
+        client = APIClient(
+            base_url='https://127.0.0.1:2376',
+            tls=tls_config,
+            version=DEFAULT_DOCKER_API_VERSION,
+        )
+        client.version()
+        assert self.mock_send.call_count == 1
+        return self.mock_send.call_args[1]['verify']
+
+    def test_ca_cert_overrides_requests_ca_bundle(self):
+        ca_cert = os.path.join(self.cert_dir, 'ca.pem')
+        tls_config = docker.tls.TLSConfig(ca_cert=ca_cert, verify=True)
+        assert self._sent_verify(tls_config) == ca_cert
+
+    def test_verify_false_overrides_requests_ca_bundle(self):
+        tls_config = docker.tls.TLSConfig(verify=False)
+        assert self._sent_verify(tls_config) is False
+
+
 class DisableSocketTest(unittest.TestCase):
     class DummySocket:
         def __init__(self, timeout=60):