From a94d8f941ad8c1d96de03e3408d0259542c16bfc Mon Sep 17 00:00:00 2001
From: Matthew Oliver <mjo@google.com>
Date: Wed, 9 Apr 2025 06:01:06 -0700
Subject: [PATCH] pass in the ca_cert_file for unverified downloads to fix
 basedownloader for new python version.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

note: this is a workaround for Python 3.12.9 and we should move to using ssl.SSLContext.load_cert_chain() instead, or let ssl.create_default_context() select the system’s trusted CA certificates for us.
PiperOrigin-RevId: 745554361
---
 glazier/lib/download.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/glazier/lib/download.py b/glazier/lib/download.py
index 678d870f..7d26dfde 100644
--- a/glazier/lib/download.py
+++ b/glazier/lib/download.py
@@ -297,7 +297,9 @@ def _OpenFileStream(
             url, timeout=TIMEOUT, cafile=self._ca_cert_file
         )
       else:
-        file_stream = urllib.request.urlopen(url, timeout=TIMEOUT)
+        file_stream = urllib.request.urlopen(
+            url, timeout=TIMEOUT, cafile=self._ca_cert_file
+        )
 
     # First attempt failed with HTTPError. Reraise and trigger a retry.
     except urllib.error.HTTPError: