Skip to content

v1.2.3 — fix CERTIFICATE_VERIFY_FAILED on first build

Choose a tag to compare

View all tags
@pacnpal pacnpal released this 10 May 20:34
· 33 commits to main since this release
v1.2.3
ddf0130

FloppyBootCD v1.2.3 — fix CERTIFICATE_VERIFY_FAILED on first build

If the first time you tried to build a CD on macOS you got:

Failed to download syslinux 6.03 from
https://mirrors.edge.kernel.org/...syslinux-6.03.tar.gz:
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)>

…that's this fix. Sorry.

What was wrong

The syslinux fetcher used urllib.request.urlretrieve(), which falls back to whatever CA certificate store Python finds at runtime. On macOS, the python.org installer and any PyInstaller-bundled Python don't ship CA certs by default — Apple's stance is that apps should call Security.framework for trust, not read a CA bundle file. Linux/Windows usually have a usable bundle in a known path, but macOS Python is a coin flip.

The result: every first build on macOS hit CERTIFICATE_VERIFY_FAILED against mirrors.edge.kernel.org and the build aborted before it ever ran xorriso.

Fix

  • Add certifi as a hard dependency (it's tiny — a single cacert.pem plus a where() lookup).
  • Build an explicit ssl.create_default_context(cafile=certifi.where()) once at module load, and route the syslinux download through urllib.request.urlopen(req, context=...) so it always uses certifi's portable CA bundle.
  • Replace urlretrieve (which can't take a custom SSL context) with a small _download_to() helper that streams the response with progress callbacks — same UX, robust trust store.
  • --collect-all certifi added to the PyInstaller invocation so the bundled app ships the cacert.pem data file alongside the Python module.

The same fix protects Linux/Windows users too in the rare cases they hit a cert path issue (e.g., pip install into a fresh virtualenv that didn't inherit the system store).

Tests in tests/core/test_syslinux_fetcher.py updated to monkeypatch the new _download_to helper instead of urlretrieve. All 14 fetcher tests pass.

Everything else

No app behavior changes. Same 12-artifact lineup as v1.2.2.

See v1.2.0 for the WinImage .imz support, CD-R capacity meter, and Linux packaging; v1.2.1 and v1.2.2 for bundle slimming and PyInstaller warning silencing.

Or upgrade in place: uv tool upgrade floppybootcd.

Full Changelog: v1.2.2...v1.2.3

Assets 14
Loading