Since the issue is with the validity of the certifcate, you necessarily have the ability to connect to the repo, so you should go the following way :

• retrieve the self-signed certificate :

openssl s_client YOUR_REPO:443 < /dev/null | openssl x509 -outform PEM > YOUR_REPO.crt

• add it to your system's recognized CAs (command valid for current Archlinux) :

trust anchor YOUR_REPO.crt

And there shouldn't be any issue regarding certificate validation.

If the "self-signed" component is not the cert itself but one of the parent certificates, same process but changing the s_client to s_client -showcerts to get the full chain in the first command, including the problematic certificate.

This doesn't address the lack of option issue, but should solve the underlying error (and suggestion should be made to provide the offending cert / CA inside the company itself, to actually use "proper" TLS when distributing packages that can run privileged code on your machine by design).