travis: remove expired DST Root CA X3 cert on trusty #2192
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dgw
commented
Oct 6, 2021
half-duplex
approved these changes
Oct 6, 2021
Member
half-duplex
left a comment
half-duplex
left a comment
There was a problem hiding this comment.
Nits, these and REQUESTS_CA_BUNDLE= are cleaner (and severable) but should be functionally identical and this patch dies with 7.x so 🤷
Other thoughts:
- If anyone is actually using 3.3 in a venv they'll probably have this problem, if we care about fully supporting 3.3 (I don't) it should be documented.
- Why doesn't this affect newer python? My py3.9 also uses certifi's store in a venv, but works fine... openssl version?
- Nobody should be using python 3.3 anyway: I am not aware of any supported distro/release without 3.4+ available
Rebuild the system CA certificates bundle without this expired root, and tell `requests` to use that instead of `certifi`. Co-authored-by: mal <[email protected]>
dgw
force-pushed
the
trusty-expired-LE-root
branch
from
c74acc3 to
d075d51
Compare
Member
Author
|
I applied the suggestions locally to update the comments all in one step and minimize Travis build time.
Probably this, yes. |
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Forcibly remove the expired
mozilla/DST_Root_CA_X3.crtfile and update CA certificate bundle, only on Trusty distro (used for Python 3.3 tests). Also ignore certifi trust store on trusty+py3.3, since certifi maintainers are stubborn (see comments in diff).Thanks to @half-duplex for helping with the monkey-patch step!
Checklist
make qa(runsmake qualityandmake test)travis-prefixed test branch to see how they performed on the real thing.Notes
Blocks #2190, which can't pass its CI tests until this is fixed.
Considering an alternative approach that replaces the
cpwith an environment variable (REQUESTS_CA_BUNDLE).