--no-verify CLI flag is a no-op: SSL verification is not disabled

[korewayume]

The --no-verify CLI flag is a no-op: running httpx --no-verify <url> still validates certificates,
so requests to hosts with expired or invalid certificates keep failing.

$ httpx --no-verify https://expired.badssl.com/
ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1010)

Cause

In httpx/_main.py the option is declared without an explicit flag_value:

@click.option(
    "--no-verify",
    "verify",
    is_flag=True,
    default=True,
    help="Disable SSL verification.",
)

Recent versions of click no longer infer flag_value from default for boolean flags:
Option.flag_value stays UNSET, and Option.flag_activation_value resolves a missing
flag_value to True:

if self.flag_value is UNSET:
    return True if self.is_flag else None

Activating the flag therefore stores True — the same value as the default — and verify
is always True.

Suggested fix

Pass flag_value=False so that activating --no-verify sets verify=False, while omitting
it keeps the default=True behaviour:

 @click.option(
     "--no-verify",
     "verify",
     is_flag=True,
     default=True,
+    flag_value=False,
     help="Disable SSL verification.",
 )

Commit with this change (fork): korewayume@caa9f5b
Branch (1 commit ahead of master): https://github.com/korewayume/httpx/tree/no-verify-patch

The one-line patch above is ready to be applied if maintainers agree with the diagnosis.

Environment

• httpx 0.28.1
• click 8.5.0 (click==8.* per pyproject.toml)

[Muguett-DBY]

I checked this against current master (b5addb6) with the CLI's Client replaced by a recorder:

Click version	No flag	--no-verify
8.1.8	True	False
8.2.2, 8.3.3, 8.4.2, 8.5.0	True	True

With the proposed flag_value=False, the values were True and False respectively on all five versions. It may be worth testing both paths so the default continues to verify certificates as well.

This was a Codex-generated harness checking the arguments passed to Client; it did not perform an HTTPS handshake. For a related test pattern, httpx2 #1186 checks the parsed values for both flags.

[0xamlab]

Confirmed end to end with a real handshake: on httpx 0.28.1 + click 8.5.0, httpx --no-verify https://expired.badssl.com/ fails with CERTIFICATE_VERIFY_FAILED; with flag_value=False added to the option declaration at httpx/_main.py:417, the same command returns the page. Matches the args-level matrix above and fills in the missing user-visible path.