reference Environment variables

HTTPS_PROXY

Also spelled
https_proxy
Value
a proxy URL with a scheme, such as http://proxy.example.com:3128
See also
HTTP_PROXY, ALL_PROXY, NO_PROXY, OPENGREP_URL

The proxy for downloads over https. Opengrep downloads rules when a --config is a URL or a registry entry such as p/python. Opengrep sends an https download through this proxy, which it asks to open a tunnel to the server. The registry, https://semgrep.dev by default, is reached over https.

The value must include the scheme: http://127.0.0.1:3128, not 127.0.0.1:3128. The variable applies to https URLs only; plain http downloads use HTTP_PROXY, and ALL_PROXY covers both. Hosts listed in NO_PROXY are reached directly.

The lowercase https_proxy is also read; when both are set, HTTPS_PROXY takes precedence. Rules from a git+ repository are fetched by git, which uses its own proxy settings. The variable has no OPENGREP_ form.

Examples

A download sent to the proxy

The host proxy.invalid does not exist, so a download through the proxy fails when Opengrep resolves the proxy.

app.py
eval(1)
Command and result
$ opengrep scan --config https://example.invalid/rules.yaml app.py 2>&1 | grep 'Failed to download'
error    Failed to download config from https://example.invalid/rules.yaml: Failure: TLS to non-TCP currently unsupported: host=example.invalid endp=(Unknown "name resolution failed")
$ HTTPS_PROXY=http://proxy.invalid:3128 opengrep scan --config https://example.invalid/rules.yaml app.py 2>&1 | grep 'Failed to download'
error    Failed to download config from https://example.invalid/rules.yaml: Failure: resolution failed: name resolution failed
$ https_proxy=http://proxy.invalid:3128 opengrep scan --config https://example.invalid/rules.yaml app.py 2>&1 | grep 'Failed to download'
error    Failed to download config from https://example.invalid/rules.yaml: Failure: resolution failed: name resolution failed

The first download goes straight to example.invalid, and fails there. The other two go to the proxy.