youknowone · Sep 4, 2026 · Sep 3, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/.cspell.json b/.cspell.json
@@ -71,8 +71,11 @@
   // words - list of words to be always considered correct
   // (compound words like pyarg, baseclass, microbenchmark are handled by allowCompoundWords)
   "words": [
+    "AESGCM",
     "aiterable",
     "alnum",
+    "COMPLEMENTOFALL",
+    "COMPLEMENTOFDEFAULT",
     "csock",
     "coro",
     "contig",
@@ -82,6 +85,7 @@
     "deduped",
     "deoptimized",
     "deoptimize",
+    "EECDH",
     "emscripten",
     "excs",
     "fdigits",
@@ -98,6 +102,7 @@
     "kwonly",
     "lossily",
     "mcache",
+    "MLKEM",
     "oparg",
     "opargs",
     "pointee",
@@ -109,6 +114,7 @@
     "reraises",
     "reraising",
     "significand",
+    "SUITEB",
     "summands",
     "TESTFN",
     "TZPATH",

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/crates/host_env/Cargo.toml b/crates/host_env/Cargo.toml
@@ -8,6 +8,9 @@ rust-version.workspace = true
 repository.workspace = true
 license.workspace = true
 
+[features]
+native-certs = ["dep:rustls-native-certs"]
+
 [dependencies]
 rustpython-wtf8 = { workspace = true }
 
@@ -35,6 +38,7 @@ mac_address = { workspace = true }
 dns-lookup = { workspace = true }
 gethostname = { workspace = true }
 rustyline = { workspace = true }
+rustls-native-certs = { workspace = true, optional = true }
 socket2 = { workspace = true, features = ["all"] }
 which = { workspace = true }
 

diff --git a/crates/host_env/src/fs.rs b/crates/host_env/src/fs.rs
@@ -36,6 +36,18 @@ pub fn metadata(path: impl AsRef<Path>) -> io::Result<Metadata> {
     fs::metadata(path)
 }
 
+pub fn exists(path: impl AsRef<Path>) -> bool {
+    metadata(path).is_ok()
+}
+
+pub fn is_file(path: impl AsRef<Path>) -> bool {
+    metadata(path).is_ok_and(|metadata| metadata.is_file())
+}
+
+pub fn is_dir(path: impl AsRef<Path>) -> bool {
+    metadata(path).is_ok_and(|metadata| metadata.is_dir())
+}
+
 pub fn symlink_metadata(path: impl AsRef<Path>) -> io::Result<Metadata> {
     fs::symlink_metadata(path)
 }

diff --git a/crates/host_env/src/lib.rs b/crates/host_env/src/lib.rs
@@ -30,6 +30,8 @@ pub mod fileutils;
 pub mod fs;
 #[cfg(any(unix, windows))]
 pub mod locale;
+#[cfg(all(feature = "native-certs", not(target_arch = "wasm32")))]
+pub mod native_certs;
 pub mod readline;
 
 #[cfg(windows)]

diff --git a/crates/host_env/src/native_certs.rs b/crates/host_env/src/native_certs.rs
@@ -0,0 +1,22 @@
+/// Certificates and errors returned by the platform's native trust-store
+/// loader. Certificate bytes stay independent of any TLS backend type.
+pub struct LoadResult {
+    pub certs: Vec<Vec<u8>>,
+    pub errors: Vec<String>,
+}
+
+pub fn load() -> LoadResult {
+    let result = rustls_native_certs::load_native_certs();
+    LoadResult {
+        certs: result
+            .certs
+            .into_iter()
+            .map(|cert| cert.as_ref().to_vec())
+            .collect(),
+        errors: result
+            .errors
+            .into_iter()
+            .map(|error| error.to_string())
+            .collect(),
+    }
+}
diff --git a/crates/stdlib/Cargo.toml b/crates/stdlib/Cargo.toml
@@ -24,7 +24,7 @@
 tkinter = ["dep:tk-sys", "dep:tcl-sys", "dep:widestring"]
 flame-it = ["flame"]
 
-__ssl-rustls = ["ssl", "rustls", "rustls-native-certs", "rustls-pemfile", "rustls-platform-verifier", "x509-cert", "x509-parser", "der", "pem-rfc7468", "webpki-roots", "oid-registry", "pkcs8"]
+__ssl-rustls = ["ssl", "rustpython-host_env/native-certs", "rustls", "rustls-pemfile", "rustls-platform-verifier", "x509-cert", "x509-parser", "der", "pem-rfc7468", "webpki-roots", "oid-registry", "pkcs8"]
 
 [dependencies]
 # rustpython crates
@@ -74,7 +74,7 @@
 # tkinter
 jiff = { workspace = true }
 tk-sys = { workspace = true, optional = true }
 tcl-sys = { workspace = true, optional = true }
 widestring = { workspace = true, optional = true }

 # uuid
@@ -92,10 +92,9 @@
 
 # Rustls dependencies (optional, for ssl-rustls feature)
 rustls = { workspace = true, default-features = false, features = ["std", "tls12"], optional = true }
-rustls-native-certs = { workspace = true, optional = true }
 rustls-pemfile = { workspace = true, optional = true }
 rustls-platform-verifier = { workspace = true, optional = true }
 x509-cert = { workspace = true, features = ["pem", "builder"], optional = true }
 x509-parser = { workspace = true, optional = true }
 der = { workspace = true, optional = true }
 pem-rfc7468 = { workspace = true, features = ["alloc"], optional = true }