Merge pull request #306 from MerginMaps/fix-ssl-certificates

Fix issues with SSL certificates

Author: MarcelGeo

.github/workflows/autotests.yml

@@ -15,12 +15,12 @@ jobs:
 
       - uses: actions/setup-python@v2
         with:
-          python-version: "3.8"
+          python-version: "3.10"
 
       - name: Install python package dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install python-dateutil pytz pytest pytest-cov pygeodiff coveralls
+          pip install python-dateutil pytz pytest pytest-cov pygeodiff truststore coveralls
 
       - name: Run tests
         run: |

.github/workflows/security_check.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.9'
+          python-version: '3.10'
 
       - name: Install dependencies
         run: |

README.md

@@ -160,11 +160,11 @@ it is possible to run other commands without specifying username/password.
 
 ### Installing deps
 
-Python 3.7+ required. Create `mergin/deps` folder where [geodiff](https://github.com/MerginMaps/geodiff) lib is supposed to be and install dependencies:
+Python 3.10+ required. Create `mergin/deps` folder where [geodiff](https://github.com/MerginMaps/geodiff) lib is supposed to be and install dependencies:
 ```bash
     rm -r mergin/deps
     mkdir mergin/deps
-    pip install python-dateutil pytz
+    pip install python-dateutil pytz truststore
     pip install pygeodiff --target=mergin/deps
 ```
 

mergin/cert.pem

@@ -11,7 +11,7 @@
 import platform
 from datetime import datetime, timezone
 import dateutil.parser
-import ssl
+import truststore
 from enum import Enum, auto
 import re
 import typing
@@ -71,7 +71,8 @@
 )
 from .version import __version__
 
-this_dir = os.path.dirname(os.path.realpath(__file__))
+truststore.inject_into_ssl()
+
 json_headers = {"Content-Type": "application/json"}
 
 
@@ -180,21 +181,7 @@ def __init__(
             else:
                 handlers.append(urllib.request.ProxyHandler({"https": f"{proxy_url}:{proxy_config['port']}"}))
 
-        # fix for wrong macos installation of python certificates,
-        # see https://github.com/lutraconsulting/qgis-mergin-plugin/issues/70
-        # remove when https://github.com/qgis/QGIS-Mac-Packager/issues/32
-        # is fixed.
-        default_capath = ssl.get_default_verify_paths().openssl_capath
-        if os.path.exists(default_capath):
-            self.opener = urllib.request.build_opener(*handlers, urllib.request.HTTPSHandler())
-        else:
-            cafile = os.path.join(this_dir, "cert.pem")
-            if not os.path.exists(cafile):
-                raise Exception("missing " + cafile)
-            ctx = ssl.SSLContext()
-            ctx.load_verify_locations(cafile)
-            https_handler = urllib.request.HTTPSHandler(context=ctx)
-            self.opener = urllib.request.build_opener(*handlers, https_handler)
+        self.opener = urllib.request.build_opener(*handlers, urllib.request.HTTPSHandler())
         urllib.request.install_opener(self.opener)
 
         if login and not password:

mergin/client.py

@@ -114,20 +114,18 @@ class InvalidProject(Exception):
     pass
 
 
-try:
-    import dateutil.parser
-    from dateutil.tz import tzlocal
-except ImportError:
-    # this is to import all dependencies shipped with package (e.g. to use in qgis-plugin)
-    deps_dir = os.path.join(this_dir, "deps")
-    if os.path.exists(deps_dir):
-        import sys
-
-        for f in os.listdir(os.path.join(deps_dir)):
-            sys.path.append(os.path.join(deps_dir, f))
-
-        import dateutil.parser
-        from dateutil.tz import tzlocal
+# add dependencies shipped in deps/ on sys.path
+deps_dir = os.path.join(this_dir, "deps")
+if os.path.exists(deps_dir):
+    import sys
+
+    for f in os.listdir(deps_dir):
+        dep_path = os.path.join(deps_dir, f)
+        if dep_path not in sys.path:
+            sys.path.append(dep_path)
+
+import dateutil.parser
+from dateutil.tz import tzlocal
 
 
 class WorkspaceRole(Enum):

mergin/common.py

@@ -14,11 +14,13 @@
     long_description="Mergin Maps utils and client",
     packages=find_packages(),
     platforms="any",
+    python_requires=">=3.10",
     install_requires=[
         "python-dateutil==2.8.2",
         "pygeodiff==2.3.0",
         "pytz==2022.1",
         "click==8.1.3",
+        "truststore==0.10.4",
     ],
     entry_points={
         "console_scripts": ["mergin=mergin.cli:cli"],
@@ -30,5 +32,4 @@
         "Operating System :: OS Independent",
         "Programming Language :: Python :: 3",
     ],
-    package_data={"mergin": ["cert.pem"]},
 )