launch --fetch-baseline silently unsets the proxy and CA environment variables for the whole process: update.NewReleaseAssets reaches newUpdater, whose scrubEnv calls os.Unsetenv on HTTPS_PROXY, SSL_CERT_FILE and their kin, and the loud fetcher prints fetches only, while abcd update records the ignored names in its receipt. An operator behind a mandatory proxy sees a dial timeout with no hint, and a preview verb mutates its own process environment.

launch --fetch-baseline silently unsets the proxy and CA environment variables for the whole process: update.NewReleaseAssets reaches newUpdater, whose scrubEnv calls os.Unsetenv on HTTPS_PROXY, SSL_CERT_FILE and their kin, and the loud fetcher prints fetches only, while abcd update records the ignored names in its receipt. An operator behind a mandatory proxy sees a dial timeout with no hint, and a preview verb mutates its own process environment.

Grounds

• pursued: with HTTPS_PROXY and SSL_CERT_FILE set, launch --dry-run --fetch-baseline leaves both set, connects directly and names both; a variable unset after the fetcher is built, or a preview that fetched without naming them, would show it wrong