From d52033fc7705c8cf20c524dd5589272143419b6a Mon Sep 17 00:00:00 2001
From: Tom Hubrecht <github@mail.hubrecht.ovh>
Date: Fri, 30 Jan 2026 13:51:51 +0100
Subject: [PATCH] nix/develop: Don't ignore SSL_CERT_FILE when its value is
 meaningful

Change-Id: I31e85a5995edc40ed2e687077ffdf563e717abb4
---
 doc/manual/rl-next/develop-ssl_cert_file.md |  8 ++++++++
 lix/nix/develop.cc                          | 15 +++++++++++++--
 tests/functional/nix-shell/basic.sh         |  4 ++++
 tests/functional/nix-shell/shell.nix        | 12 ++++++++++++
 4 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 doc/manual/rl-next/develop-ssl_cert_file.md

diff --git a/doc/manual/rl-next/develop-ssl_cert_file.md b/doc/manual/rl-next/develop-ssl_cert_file.md
new file mode 100644
index 000000000..229eb38da
--- /dev/null
+++ b/doc/manual/rl-next/develop-ssl_cert_file.md
@@ -0,0 +1,8 @@
+---
+synopsis: "`nix develop` no longer ignores the env variable `SSL_CERT_FILE`"
+cls: [5042]
+category: "Improvements"
+credits: [thubrecht]
+---
+
+Running `nix develop` and `nix print-dev-env` on shells that define the environment variable `SSL_CERT_FILE` now works correctly by exporting that variable inside the built shell.
diff --git a/lix/nix/develop.cc b/lix/nix/develop.cc
index 1675ca869..698b285f3 100644
--- a/lix/nix/develop.cc
+++ b/lix/nix/develop.cc
@@ -140,7 +140,19 @@ struct BuildEnvironment
     void toBash(std::ostream & out, const std::set<std::string> & ignoreVars) const
     {
         for (auto & [name, value] : vars) {
-            if (!ignoreVars.count(name)) {
+            // NOTE: Nixpkgs sets SSL_CERT_FILE to `/no-cert-file.crt` by default
+            //       which we want to filter out as it leads to broken shells
+            //       However, outright ignoring it means that it is impossible to
+            //       set a custom cert file using the env variable definition of a shell
+            //       which is stupid.
+            if (name == "SSL_CERT_FILE") {
+                if (auto str = std::get_if<String>(&value); str->value != "/no-cert-file.crt") {
+                    out << fmt("%s=%s\n", name, bashEscape(str->value));
+                    if (str->exported) {
+                        out << fmt("export %s\n", name);
+                    }
+                }
+            } else if (!ignoreVars.count(name)) {
                 if (auto str = std::get_if<String>(&value)) {
                     out << fmt("%s=%s\n", name, bashEscape(str->value));
                     if (str->exported)
@@ -305,7 +317,6 @@ struct Common : InstallableCommand, MixProfile
         "NIX_REMOTE",
         "PPID",
         "SHELLOPTS",
-        "SSL_CERT_FILE", // FIXME: only want to ignore /no-cert-file.crt
         "TEMP",
         "TEMPDIR",
         "TERM",
diff --git a/tests/functional/nix-shell/basic.sh b/tests/functional/nix-shell/basic.sh
index ef27abe15..490ab99ce 100644
--- a/tests/functional/nix-shell/basic.sh
+++ b/tests/functional/nix-shell/basic.sh
@@ -221,3 +221,7 @@ assert (!(args ? inNixShell));
 (import $shellDotNix { }).shellDrv
 EOF
 nix-shell $TEST_ROOT/shell-ellipsis.nix --run "true"
+
+# Test correct handling of SSL_CERT_FILE
+nix print-dev-env -f $shellDotNix shellWithCerts | grepQuiet "SSL_CERT_FILE='/path/to/a/real/cert.crt'"
+nix print-dev-env -f $shellDotNix shellWithNoCerts | grepInverse "SSL_CERT_FILE"
diff --git a/tests/functional/nix-shell/shell.nix b/tests/functional/nix-shell/shell.nix
index dc756d0f5..6fbb9c0fd 100644
--- a/tests/functional/nix-shell/shell.nix
+++ b/tests/functional/nix-shell/shell.nix
@@ -56,6 +56,18 @@ let pkgs = rec {
     outputs = ["dev" "out"];
   };
 
+  shellWithCerts = mkDerivation {
+    name = "shell-with-certs";
+    inherit stdenv;
+    SSL_CERT_FILE = "/path/to/a/real/cert.crt";
+  };
+
+  shellWithNoCerts = mkDerivation {
+    name = "shell-with-certs";
+    inherit stdenv;
+    SSL_CERT_FILE = "/no-cert-file.crt";
+  };
+
   # Used by nix-shell -p
   runCommand = name: args: buildCommand: mkDerivation (args // {
     inherit name buildCommand stdenv;