Custom certs

[Ankur Goyal (ankrgyl)]

Respect SSL_CERT_FILE but allow users to pass in --ca-cert / BRAINTRUST_CA_CERT to override it.

[github-actions]

Latest downloadable build artifacts for this PR commit 87b70bee6e4a:

• Workflow run: https://github.com/braintrustdata/bt/actions/runs/24375971044
• Download all artifacts (GitHub CLI): gh run download 24375971044 --repo braintrustdata/bt
• Installers are published from main automatically. To publish one for a PR branch, run release-canary manually via workflow_dispatch.

Available artifact names

• ``artifacts-build-global
• ``artifacts-build-local-x86_64-apple-darwin
• ``artifacts-build-local-x86_64-pc-windows-msvc
• ``artifacts-build-local-aarch64-apple-darwin
• ``artifacts-build-local-x86_64-unknown-linux-musl
• ``artifacts-build-local-aarch64-unknown-linux-musl
• ``artifacts-build-local-aarch64-unknown-linux-gnu
• ``artifacts-build-local-x86_64-unknown-linux-gnu
• ``artifacts-plan-dist-manifest
• ``cargo-dist-cache

[Max Hansmire (hansmire)]

Tested the PR build on macOS (Apple Silicon) behind a corporate proxy with a custom CA cert (SSL_CERT_FILE pointing to an internal CA bundle).

Current release (v0.5.0) fails with:

error: network error: error sending request for url (https://www.braintrust.dev/api/apikey/login)

PR build — all scenarios pass:

Test	Result
SSL_CERT_FILE set (existing env)	works
--ca-cert flag	works
BRAINTRUST_CA_CERT env var	works
No cert env vars (native OS store)	works

Native cert store change + the explicit --ca-cert override both work as expected. This unblocks CLI usage behind corporate proxies.