Hardcoded certificate path in tls module causing connection errors.

[JasonGowthorpe]

Even when specifying the ssl_context to the HTTP20Connection instance, the tls module tries to create the global _context. If there isn't a file at the hardcoded cert_loc path then all requests fail with an IO error before they are even made.

File "hyper\http20\connection.pyo", line 262, in request
File "hyper\http20\connection.pyo", line 525, in endheaders
File "hyper\http20\connection.pyo", line 349, in connect
File "hyper\tls.pyo", line 36, in wrap_socket
File "hyper\tls.pyo", line 99, in init_context
IOError: [Errno 2] No such file or directory

[Lukasa]

Out of interest, why would there be no file there? The cert file is distributed with the code, so it seems extremely unlikely that the file would end up not there.

[JasonGowthorpe]

Right that makes a little more sense, I'm building to an exe using Py2Exe but I would need to manually include that certificate chain for it to work.

[Lukasa]

Hrm. Does py2exe not read MANIFEST.in to work out what data it needs to include from a distribution?

[JasonGowthorpe]

I can't even find a MANIFEST.in file in my python install folder. Py2Exe doesn't appear to have made any attempt to copy the cert file to the target directory.
I'm using Python 2.7.11, Py2Exe 0.6.9, and installed Hyper using pip (upgraded from 0.5).

[Lukasa]

Oh, I see. Argh Py2exe. This would actually be worse, because even if it included the binary data it wouldn't be in the right place.

You can avoid the call to init_context by manually assigning a SSLContext object to hyper.tls._context. That will allow you to ensure that the SSLContext is configured in a way that your application can use.

[JasonGowthorpe]

Thanks, I'll put that in to cover me in the event of a future upgrade.

Not sure if its a better solution or if I'm overlooking some other case but I have changed wrap_socket to only try to initialize the default context if a manual one isn't specified. That way different certificates could be used on separate connections if required.

    if ssl_context:
        # if an SSLContext is provided then use it instead of default context
        _ssl_context = ssl_context
    else:
        global _context

        # create the singleton SSLContext we use
        if _context is None:  # pragma: no cover
            _context = init_context()

        _ssl_context = _context

Either way I'm guessing the cert file existence really wants checking before the default cert is used as the IO error isn't particularly informative without digging through all the source.

[Lukasa]

I'd accept a patch to make that change. =)

[JasonGowthorpe]

Ok, I'll figure out how to use github for contributions and get a pull request issued. Thanks.

[toffer]

This should be closed. Was fixed in #255.

[Lukasa]

Thanks @toffer!