Daniel Goldman

there's also the option of listing all packages that provide it. We do that already for the help-all determinism.

Almalinux is in the Fedora family, and stores its ca certs in `/etc/pki/tls`. The distro python is patched/configured for this: ``` >>> ssl.get_default_verify_paths() DefaultVerifyPaths(cafile='/etc/pki/tls/cert.pem', capath='/etc/pki/tls/certs', openssl_cafile_env='SSL_CERT_FILE', openssl_cafile='/etc/pki/tls/cert.pem', openssl_capath_env='SSL_CERT_DIR', openssl_capath='/etc/pki/tls/certs') ```...

manually setting the cafile for python looks to work, either with an envvar (`SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt ~/.local/bin/pants`) or with the ssl context. I'm not sure where/when we would detect that this needs...

Hey, maybe a silly question, but were you intending that users would set the envvar to literally 'AnsibleUndefined'? Or that they'd be able to get an actual instance of `AnsibleUndefined`...

I don't think I know what it means to do that. But it sounds like that's not what those test cases test for. Can you describe how I would do...

Ahok, gotcha. I think I was confused by the `'AnsibleUndefined'` on line 497. All that means is that, if the value happens to be AnsibleUndefined, we consider that a failure...

I think I found a failing test case: config values requesting Booleans will cast the emptystring to False, which will be accepted as a valid boolean. This will therefore not...

Oh, gotcha, so we should expect the boolean thing to fail. So the recommended usage to force the default is to set the envvar to AnsibleUndefined. Setting the envvar to...

> I like the idea and in general, the implementation looks good to me. But it looks like that when the `publish_dependencies` field is used, then the inferred dependencies are...

> I would like to see a behavior more akin to the dependencies field. Meaning that when dependencies are explicitly provided, these are added to the set of inferred ones....