[gerardo-navarro]

Summary

In corporate networks a TLS-inspecting proxy re-signs HTTPS traffic with an internal root CA. Windows trusts that CA (distributed via GPO), so downloads work in the browser. aTrain's Python verifies against certifi, which does not know the CA. Every model download then fails with CERTIFICATE_VERIFY_FAILED, both for required models and on the models page.

This PR makes Python verify certificates against the OS trust store with truststore, the same approach pip has used since 24.2.

• pyproject.toml / uv.lock: add truststore==0.10.4 (pure Python, MIT, no dependencies).
• aTrain_core/globals.py: call truststore.inject_into_ssl() at import. Every process imports this module, including the spawned workers that run the downloads on Windows.
• tests/unit/test_globals.py: assert that ssl.SSLContext is replaced.
• .github/workflows/ci.yml: install truststore in the unit job, which installs its deps by hand.

Notes:

• Works for requests (current huggingface_hub 0.36) and for httpx (huggingface_hub 1.x, Upgrade to Transformers 5.17 and Hugging Face Hub 1.33 #286), since both build their contexts from ssl.SSLContext.
• No new network traffic; offline-by-design is unchanged.
• No heavy imports on the startup path.

References

Refs #318

Screenshots / Examples

Behind a TLS-inspecting proxy whose CA is only in the system store (Linux sandbox), with REQUESTS_CA_BUNDLE unset:

# before: requests.get("https://github.com")
SSLError ... CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain

# after: import aTrain_core.globals; requests.get("https://github.com")
TLS handshake succeeds

Verification Steps

• uv run --no-sync pytest tests/unit/test_globals.py: new test fails without the fix, passes with it.
• ruff check, ruff format --check, bandit clean.
• Windows 11 VM with mitmproxy as system proxy and its CA in the Windows trust store, REQUESTS_CA_BUNDLE unset:
  • models page → Download tiny → finishes (fails today with SSLCertVerificationError).
  • transcription with a model that needs a download → no SSL error.
• Flatpak: download still works (the sandbox has its own CA store).
• macOS: download still works (Keychain).