Pass global CA bundle to HTTPSFuture, T3668

Summary: Update and clarify precedence of CA bundles

Test Plan:
tested with "arc call-conduit user.whoami" from project root
Same from other subdirectory in project
Repeated tests with both https.cabundle and https.cacert settings, both in
.arcconfig and ~/.arcrc

Reviewers: epriestley

Reviewed By: epriestley

CC: aran, Korvin

Maniphest Tasks: T3668

Differential Revision: https://secure.phabricator.com/D6647

scripts/arcanist.php

@@ -201,6 +201,13 @@ try {
   }
   $workflow->setConduitURI($conduit_uri);
 
+  // Apply global CA bundle from configs.
+  if ($ca_bundle = $working_copy->getConfigFromAnySource('https.cabundle')) {
+    $ca_bundle = Filesystem::resolvePath(
+      $ca_bundle, $working_copy->getProjectRoot());
+    HTTPSFuture::setGlobalCABundleFromPath($ca_bundle);
+  }
+
   if ($need_conduit) {
     if (!$conduit_uri) {
 

src/configuration/ArcanistSettings.php

@@ -95,6 +95,14 @@ final class ArcanistSettings {
           "'vim'. This setting overrides the EDITOR environmental variable.",
         'example' => '"nano"',
       ),
+      'https.cabundle' => array(
+        'type' => 'string',
+        'help' =>
+          "Path to a custom CA bundle file to be used for arcanist's cURL ".
+          "calls. This is used primarily when your conduit endpoint is ".
+          "behind https signed by your organization's internal CA.",
+        'example' => 'support/yourca.pem'
+      ),
       'browser' => array(
         'type' => 'string',
         'help' =>