FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
python/managed_python_sitecustomize.py at main · macadmins/python · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
macadmins
/
python
Public
Notifications
You must be signed in to change notification settings
Fork
30
Star
258
Code
Issues
2
Pull requests
4
Discussions
Actions
Projects
Wiki
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Wiki
Security and quality
Insights
Expand file tree
Breadcrumbs
python
/
managed_python_sitecustomize.py
Copy path
More file actions
More file actions
Latest commit
History
History
History
48 lines (39 loc) · 1.79 KB
Breadcrumbs
python
/
managed_python_sitecustomize.py
Copy path
File metadata and controls
48 lines (39 loc) · 1.79 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
"""
Site-customization for the macadmins Python framework.
Why this file exists:
The python.org Python.framework is built with OpenSSL's default CA-bundle
path hardcoded to /Library/Frameworks/Python.framework/Versions/<X.Y>/etc/
openssl/cert.pem. Our framework installs under /Library/ManagedFrameworks/
Python/Python3.framework/..., so that hardcoded path doesn't exist on
target machines. Stdlib SSL (urllib.request, http.client.HTTPSConnection,
ssl.SSLContext with default verify paths, etc.) then fails to find a CA
bundle and certificate validation errors out.
A regular python.org install ships /Applications/Python 3.X/Install
Certificates.command that fixes this by symlinking the expected path to
certifi's bundled cacert.pem. We can't do the equivalent because the
expected path is outside our framework — touching it would conflict with
a python.org install if the user has one.
What it does:
Sets SSL_CERT_FILE to certifi's bundled cert path during interpreter
startup. OpenSSL reads SSL_CERT_FILE ahead of its compiled-in path, so
stdlib SSL operations get a working CA bundle.
Falls back to certifi only when SSL_CERT_FILE is unset OR points at a
path that doesn't exist on disk. A valid user override (e.g. a corporate
CA bundle at `export SSL_CERT_FILE=/opt/corp/ca.pem`) is preserved;
a stale or typo'd path gets corrected to certifi.
References:
macadmins/python#38
gregneagle/relocatable-python#13
"""
import
os
import
os
.
path
def
_ssl_cert_file_is_valid
():
path
=
os
.
environ
.
get
(
"SSL_CERT_FILE"
)
return
bool
(
path
)
and
os
.
path
.
isfile
(
path
)
if
not
_ssl_cert_file_is_valid
():
try
:
import
certifi
except
ImportError
:
pass
else
:
os
.
environ
[
"SSL_CERT_FILE"
]
=
certifi
.
where
()
Back
|
FazBrowse Home
|
New Git URL