use certifi root certificates rather than openssl

qgis · Oct 2, 2020 · d06bc3a · d06bc3a
1 parent f3811b2
commit d06bc3a
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/qgis_bundle/recipes/openssl/recipe.sh b/qgis_bundle/recipes/openssl/recipe.sh
@@ -12,8 +12,8 @@ function bundle_openssl() {
 
   # https://github.com/qgis/QGIS-Mac-Packager/issues/32
   try mkdir -p $BUNDLE_RESOURCES_DIR/certs
-  try cp -av $DEPS_ROOT_DIR/certs/* $BUNDLE_RESOURCES_DIR/certs/
-  mk_sym_link $BUNDLE_RESOURCES_DIR/certs rootcerts.pem certs.pem
+  try cp -av $DEPS_ROOT_DIR/certs/rootcerts.pem $BUNDLE_RESOURCES_DIR/certs/
+  # see python_packages/recipe.sh for default root cersts
 }
 
 function fix_binaries_openssl() {

diff --git a/qgis_bundle/recipes/python_packages/recipe.sh b/qgis_bundle/recipes/python_packages/recipe.sh
@@ -25,6 +25,14 @@ function bundle_python_packages() {
   # see QGIS-Mac-Packager#87, *-info is sometimes required,
   # so we shouldn't delete it!
 
+  ###############
+  # CERTIFICATES
+  # see https://github.com/qgis/QGIS/issues/37107
+  # use certifi root certificates rather than openssl
+  try mkdir -p $BUNDLE_RESOURCES_DIR/certs
+  mk_sym_link $BUNDLE_RESOURCES_DIR/certs ../python/site-packages/certifi/cacert.pem certifi.pem
+  mk_sym_link $BUNDLE_RESOURCES_DIR/certs certifi.pem certs.pem
+
   # issue #32
   # _ssl is already taken in lib-dynload
   try mv $BUNDLE_PYTHON_PACKAGES_DIR/ssl.py $BUNDLE_PYTHON_PACKAGES_DIR/_ssl2.py