Re: [core-updates] Setting SSL_CERT_FILE in the build environment

[Ricardo Wurmus <rekado@elephly.net>]

Zheng Junjie <zhengjunjie@iscas.ac.cn> writes:

> Zheng Junjie <zhengjunjie@iscas.ac.cn> writes:
>
>> Ricardo Wurmus <rekado@elephly.net> writes:
>>
>>> Zheng Junjie <zhengjunjie@iscas.ac.cn> writes:
>>>
>>>> This patch should fix it.
>>>
>>> Thank you for the patch!
>>>
>>>> From f41bf905cfb1395a53cfc0d79315148ac9ba0a79 Mon Sep 17 00:00:00 2001
>>>> Message-ID: <f41bf905cfb1395a53cfc0d79315148ac9ba0a79.1721059686.git.zhengjunjie@iscas.ac.cn>
>>>> From: Zheng Junjie <zhengjunjie@iscas.ac.cn>
>>>> Date: Tue, 16 Jul 2024 00:06:39 +0800
>>>> Subject: [PATCH] gnu: python-requests-next: Fix build.
>>>>
>>>> * gnu/packages/python-web.scm (python-requests-next): Fix build.
>>>> [native-inputs]: Add nss-certs.
>>>> [arguments]: Add set-SSL_CERT_FILE phase.
>>>> <#:modules>: Adjust it.
>>>
>>> This seems rather complicated for something that may have to be added to
>>> a number of packages.  Would it make sense to create a package
>>> containing this bundle file, set a search path specification, and add
>>> that to the packages needing it?
>
> I checked it out and thought this patch might be a better way.
>
> From 8d7466eadcb543d538b1f40c4ec06a953c4aa45d Mon Sep 17 00:00:00 2001
> Message-ID: <8d7466eadcb543d538b1f40c4ec06a953c4aa45d.1721115252.git.zhengjunjie@iscas.ac.cn>
> From: Zheng Junjie <zhengjunjie@iscas.ac.cn>
> Date: Tue, 16 Jul 2024 00:06:39 +0800
> Subject: [PATCH] gnu: python-requests-next: Fix build.
>
> * gnu/packages/python-web.scm (python-requests-next): Fix build.
> [arguments]<#:phases>: Add add-check-DEFAULT_CA_BUNDLE_PATH-exists phase.
>
> Change-Id: I1592ef3329fdcd681df618bb12fbc205aa028be3
> ---
>  gnu/packages/python-web.scm | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/gnu/packages/python-web.scm b/gnu/packages/python-web.scm
> index bca7da9139..2926d24b40 100644
> --- a/gnu/packages/python-web.scm
> +++ b/gnu/packages/python-web.scm
> @@ -65,6 +65,7 @@
>  ;;; Copyright © 2024 Sharlatan Hellseher <sharlatanus@gmail.com>
>  ;;; Copyright © 2024 normally_js <normally_js@posteo.net>
>  ;;; Copyright © 2024 Markku Korkeala <markku.korkeala@iki.fi>
> +;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -3621,7 +3622,17 @@ (define-public python-requests-next
>             python-urllib3))
>      (arguments
>       ;; FIXME: Some tests require network access.
> -     '(#:tests? #f))
> +     (list #:tests? #f
> +           #:phases
> +           #~(modify-phases %standard-phases
> +               (add-after 'unpack 'add-check-DEFAULT_CA_BUNDLE_PATH-exists
> +                 (lambda _
> +                   (substitute* "src/requests/adapters.py"
> +                     (("    _preloaded_ssl_context = create_urllib3_context\\(\\)")
> +                      "    if os.path.exists(DEFAULT_CA_BUNDLE_PATH):
> +      _preloaded_ssl_context = create_urllib3_context()")
> +                     (("_preloaded_ssl_context\\.load_verify_locations\\(")
> +                      "  _preloaded_ssl_context.load_verify_locations(")))))))

What happens when DEFAULT_CA_BUNDLE_PATH does not exist?

Wouldn't it silently skip initializing the SSL context?  I would not be
comfortable with this.  I think we should just satisfy the test.  It is
hard to see the full consequences of patching things here.

DEFAULT_CA_BUNDLE_PATH is the result of using the tools provided by
certifi, which has been patched to give us control over the location of
the bundle.  I think that's what we should use.

-- 
Ricardo