What

Adds opt-in HTTP proxy support to datadog-sync-cli. A new boolean flag --http-client-trust-env (env var DD_HTTP_CLIENT_TRUST_ENV, default false) enables aiohttp's trust_env on every ClientSession the tool creates, so it honors the standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY environment variables (and .netrc).

Why

Jira: HAMR-393 · Zendesk 2933103 (Hitachi, Premier).

aiohttp defaults to trust_env=False and, unlike requests, ignores proxy environment variables. There was previously no way to run the tool through a proxy, blocking a customer from backing up Datadog resources from a restricted corporate-proxy network. Enabling trust_env is the fix the PSE investigation identified.

Changes

• constants.py — new DD_HTTP_CLIENT_TRUST_ENV.
• options.py — new --http-client-trust-env option, modeled on --verify-ssl-certificates.
• configuration.py — reads the option and threads trust_env into all three CustomClient constructions (source, destination, and the reset path).
• custom_client.py — trust_env plumbed through _init_session (both SSL branches) and post_unauthenticated. verify_ssl/trust_env are now keyword-only to prevent positional-argument mix-ups.
• synthetics_tests.py / synthetics_mobile_applications_versions.py — forward trust_env on the presigned-URL download sessions, so proxy support is complete for synthetics blob transfers too.
• README — new "Running behind an HTTP proxy" section documenting the flag and its security blast radius (the proxy sees API/APP-key/JWT headers if it terminates TLS; .netrc creds may be attached).
• tests — new tests/unit/test_custom_client_trust_env.py: unit coverage that trust_env reaches every session constructor, plus CLI/env-var tests proving Click coerces DD_HTTP_CLIENT_TRUST_ENV string values to a real bool (network-safe via mocked dispatch).

Usage

export DD_HTTP_CLIENT_TRUST_ENV=true
export HTTPS_PROXY=http://proxy.corp:3128
datadog-sync <command> ...

Test plan

• python -m pytest tests/unit/ → 814 passed, 8 skipped (skips pre-existing/unrelated).
• black + ruff (versions pinned in tox.ini) clean.
• Ran through a multi-specialist code review (reliability, maintainability, security, python) + a verification pass; all blocking findings resolved.

Follow-up (out of scope)

The four session-construction sites now duplicate the ssl_context / TCPConnector / trust_env wiring. A shared session factory would collapse this to one place — deliberately deferred to keep this deadline-bound change small.

🤖 Generated with Claude Code