QwenPaw Version
1.1.11
Description
QwenPaw Desktop 无法打开，卡在 "Waiting for HTTP ready..."，后端服务器启动失败。
根本原因： QwenPaw 捆绑的 Python 3.10 使用 OpenSSL 3.5.7，该版本存在回归 bug，ssl.SSLContext.load_verify_locations(cadata=der_bytes) 对 DER 格式证书数据失败，抛出 ssl.SSLError: [ASN1: NOT_ENOUGH_DATA]。Python 的 _load_windows_store_certs 恰好用 cadata 参数加载 Windows 系统证书，导致 aiohttp 导入失败，整个 FastAPI 服务器无法启动。
报错堆栈：
ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4040) File "ssl.py", line 584, in _load_windows_store_certs self.load_verify_locations(cadata=certs) File "aiohttp/connector.py", line 918, in _SSL_CONTEXT_VERIFIED = _make_ssl_context(True)
临时修复： 在 sitecustomize.py 中 patch，当 cadata 加载失败时将 DER 转为 PEM 写入临时文件，再通过 cafile 参数加载：
import ssl, base64, os, tempfile
from _ssl import enum_certificates
_orig_lv = ssl.SSLContext.load_verify_locations
def _patched(self, *args, **kwargs):
try:
return _orig_lv(self, *args, **kwargs)
except ssl.SSLError:
cadata = kwargs.get("cadata") or (args[2] if len(args) > 2 else None)
if isinstance(cadata, (bytes, bytearray)):
purpose = ssl.Purpose.SERVER_AUTH
pem_certs = []
for storename in getattr(self, "_windows_cert_stores", ["ROOT", "CA"]):
try:
for cert, encoding, trust in enum_certificates(storename):
if encoding == "x509_asn" and (trust is True or purpose.oid in trust):
pem_certs.append(b"-----BEGIN CERTIFICATE-----\n" + base64.encodebytes(cert) + b"-----END CERTIFICATE-----\n")
except PermissionError:
pass
if pem_certs:
fd, path = tempfile.mkstemp(suffix=".pem")
try:
os.write(fd, b"".join(pem_certs))
os.close(fd)
return _orig_lv(self, cafile=path)
finally:
os.unlink(path)
raise
ssl.SSLContext.load_verify_locations = _patched
Environment
OS: Windows 10
Python: 3.10.20
OpenSSL: 3.5.7
Component(s) Affected
Core / Backend
QwenPaw Version
1.1.11
Description
QwenPaw Desktop 无法打开，卡在 "Waiting for HTTP ready..."，后端服务器启动失败。
根本原因： QwenPaw 捆绑的 Python 3.10 使用 OpenSSL 3.5.7，该版本存在回归 bug，
ssl.SSLContext.load_verify_locations(cadata=der_bytes)对 DER 格式证书数据失败，抛出ssl.SSLError: [ASN1: NOT_ENOUGH_DATA]。Python 的_load_windows_store_certs恰好用cadata参数加载 Windows 系统证书，导致aiohttp导入失败，整个 FastAPI 服务器无法启动。报错堆栈：
ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4040) File "ssl.py", line 584, in _load_windows_store_certs self.load_verify_locations(cadata=certs) File "aiohttp/connector.py", line 918, in _SSL_CONTEXT_VERIFIED = _make_ssl_context(True)
临时修复： 在
sitecustomize.py中 patch，当cadata加载失败时将 DER 转为 PEM 写入临时文件，再通过cafile参数加载：