Merge #205191: python3Packages.certifi: Update and use system ca-bundle

...into staging-22.11

pkgs/development/python-modules/certifi/default.nix

@@ -1,5 +1,6 @@
 { lib
 , buildPythonPackage
+, cacert
 , pythonOlder
 , fetchFromGitHub
 , pytestCheckHook
@@ -7,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "certifi";
-  version = "2022.09.24";
+  version = "2022.12.07";
 
   disabled = pythonOlder "3.6";
 
@@ -15,9 +16,25 @@ buildPythonPackage rec {
     owner = pname;
     repo = "python-certifi";
     rev = version;
-    hash = "sha256-B6LO6AfG9cfpyNI7hj3VjmGTFsrrIkDYO4gPMkZY74w=";
+    hash = "sha256-r6TJ6YGL0cygz+F6g6wiqBfBa/QKhynZ92C6lHTZ2rI=";
   };
 
+  patches = [
+    # Add support for NIX_SSL_CERT_FILE
+    ./env.patch
+  ];
+
+  postPatch = ''
+    # Use our system-wide ca-bundle instead of the bundled one
+    rm -v "certifi/cacert.pem"
+    ln -snvf "${cacert}/etc/ssl/certs/ca-bundle.crt" "certifi/cacert.pem"
+  '';
+
+  propagatedNativeBuildInputs = [
+    # propagate cacerts setup-hook to set up `NIX_SSL_CERT_FILE`
+    cacert
+  ];
+
   checkInputs = [
     pytestCheckHook
   ];

pkgs/development/python-modules/certifi/env.patch

@@ -0,0 +1,86 @@
+diff --git a/certifi/core.py b/certifi/core.py
+index de02898..c033d20 100644
+--- a/certifi/core.py
++++ b/certifi/core.py
+@@ -4,15 +4,25 @@ certifi.py
+ 
+ This module returns the installation location of cacert.pem or its contents.
+ """
++import os
+ import sys
+ 
+ 
++def get_cacert_path_from_environ():
++    path = os.environ.get("NIX_SSL_CERT_FILE", None)
++
++    if path == "/no-cert-file.crt":
++        return None
++
++    return path
++
++
+ if sys.version_info >= (3, 11):
+ 
+     from importlib.resources import as_file, files
+ 
+     _CACERT_CTX = None
+-    _CACERT_PATH = None
++    _CACERT_PATH = get_cacert_path_from_environ()
+ 
+     def where() -> str:
+         # This is slightly terrible, but we want to delay extracting the file
+@@ -39,14 +49,16 @@ if sys.version_info >= (3, 11):
+         return _CACERT_PATH
+ 
+     def contents() -> str:
+-        return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
++        if _CACERT_PATH is not None:
++            return open(_CACERT_PATH, encoding="utf-8").read()
++        return files("certifi").joinpath("cacert.pem").read_text(encoding="utf-8")
+ 
+ elif sys.version_info >= (3, 7):
+ 
+     from importlib.resources import path as get_path, read_text
+ 
+     _CACERT_CTX = None
+-    _CACERT_PATH = None
++    _CACERT_PATH = get_cacert_path_from_environ()
+ 
+     def where() -> str:
+         # This is slightly terrible, but we want to delay extracting the
+@@ -74,7 +86,9 @@ elif sys.version_info >= (3, 7):
+         return _CACERT_PATH
+ 
+     def contents() -> str:
+-        return read_text("certifi", "cacert.pem", encoding="ascii")
++        if _CACERT_PATH is not None:
++            return open(_CACERT_PATH, encoding="utf-8").read()
++        return read_text("certifi", "cacert.pem", encoding="utf-8")
+ 
+ else:
+     import os
+@@ -84,6 +98,8 @@ else:
+     Package = Union[types.ModuleType, str]
+     Resource = Union[str, "os.PathLike"]
+ 
++    _CACERT_PATH = get_cacert_path_from_environ()
++
+     # This fallback will work for Python versions prior to 3.7 that lack the
+     # importlib.resources module but relies on the existing `where` function
+     # so won't address issues with environments like PyOxidizer that don't set
+@@ -102,7 +118,14 @@ else:
+     def where() -> str:
+         f = os.path.dirname(__file__)
+ 
++        if _CACERT_PATH is not None:
++            return _CACERT_PATH
++
+         return os.path.join(f, "cacert.pem")
+ 
+     def contents() -> str:
+-        return read_text("certifi", "cacert.pem", encoding="ascii")
++        if _CACERT_PATH is not None:
++            with open(_CACERT_PATH, encoding="utf-8") as data:
++                return data.read()
++
++        return read_text("certifi", "cacert.pem", encoding="utf-8")

pkgs/development/python-modules/requests/0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch

@@ -1,60 +0,0 @@
-From b36083efafec5a3c1c5864cd0b62367ddf3856ae Mon Sep 17 00:00:00 2001
-From: Keshav Kini <keshav.kini@gmail.com>
-Date: Sun, 16 May 2021 20:35:24 -0700
-Subject: [PATCH] Prefer NixOS/Nix default CA bundles over certifi
-
-Normally, requests gets its default CA bundle from the certifi
-package.  On NixOS and when using Nix on non-NixOS platforms, we would
-rather default to using our own certificate bundles controlled by the
-Nix/NixOS user.
-
-This commit overrides requests.certs.where(), which previously was
-just aliased to certifi.where(), so that now it does the following:
-
-- When run by Nix on non-NixOS, the environment variable
-  $NIX_SSL_CERT_FILE will point to the CA bundle we're using, so we
-  use that.
-
-- When running on NixOS, the CA bundle we're using has the static path
-  /etc/ssl/certs/ca-certificates.crt , so we use that.
-
-- Otherwise, we fall back to the original behavior of using certifi's
-  CA bundle.  Higher in the call stack, users of requests can also
-  explicitly specify a CA bundle to use, which overrides all this
-  logic.
----
- requests/certs.py | 18 +++++++++++++++++-
- 1 file changed, 17 insertions(+), 1 deletion(-)
-
-diff --git a/requests/certs.py b/requests/certs.py
-index d1a378d7..faf462b7 100644
---- a/requests/certs.py
-+++ b/requests/certs.py
-@@ -12,7 +12,23 @@ If you are packaging Requests, e.g., for a Linux distribution or a managed
- environment, you can change the definition of where() to return a separately
- packaged CA bundle.
- """
--from certifi import where
-+
-+import os
-+
-+import certifi
-+
-+
-+def where():
-+    nix_ssl_cert_file = os.getenv("NIX_SSL_CERT_FILE")
-+    if nix_ssl_cert_file and os.path.exists(nix_ssl_cert_file):
-+        return nix_ssl_cert_file
-+
-+    nixos_ca_bundle = "/etc/ssl/certs/ca-certificates.crt"
-+    if os.path.exists(nixos_ca_bundle):
-+        return nixos_ca_bundle
-+
-+    return certifi.where()
-+
- 
- if __name__ == '__main__':
-     print(where())
--- 
-2.31.1
-

pkgs/development/python-modules/requests/default.nix

@@ -27,11 +27,6 @@ buildPythonPackage rec {
     hash = "sha256-fFWZsQL+3apmHIJsVqtP7ii/0X9avKHrvj5/GdfJeYM=";
   };
 
-  patches = [
-    # Use the default NixOS CA bundle from the certifi package
-    ./0001-Prefer-NixOS-Nix-default-CA-bundles-over-certifi.patch
-  ];
-
   propagatedBuildInputs = [
     brotlicffi
     certifi