Use the system level root certificate instead of the one bundled in certifi

https://bugzilla.redhat.com/show_bug.cgi?id=1655253

python-pip.spec

@@ -23,7 +23,7 @@ Name:           python-%{srcname}
 # When updating, update the bundled libraries versions bellow!
 # You can use vendor_meta.sh in the dist git repo
 Version:        18.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -95,6 +95,10 @@ Patch2:         html_theme_path.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1550368#c24
 Patch3:         remove-existing-dist-only-if-path-conflicts.patch
 
+# Use the system level root certificate instead of the one bundled in certifi
+# https://bugzilla.redhat.com/show_bug.cgi?id=1655253
+Patch4:         dummy-certifi.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older versions.
@@ -168,6 +172,8 @@ BuildRequires:  python2-pyyaml
 BuildRequires:  python2-pip
 BuildRequires:  python2-wheel
 %endif
+BuildRequires:  ca-certificates
+Requires:       ca-certificates
 Requires:       python2-setuptools
 
 # Virtual provides for the packages bundled by pip:
@@ -203,6 +209,8 @@ BuildRequires:  python%{python3_pkgversion}-pyyaml
 BuildRequires:  python%{python3_pkgversion}-pip
 BuildRequires:  python%{python3_pkgversion}-wheel
 %endif
+BuildRequires:  ca-certificates
+Requires:       ca-certificates
 Requires:  python%{python3_pkgversion}-setuptools
 
 # Virtual provides for the packages bundled by pip:
@@ -230,6 +238,7 @@ A documentation for a tool for installing and managing Python packages
 %if %{without bootstrap}
 %package wheel
 Summary:        The pip wheel
+Requires:       ca-certificates
 
 # Virtual provides for the packages bundled by pip:
 %{bundled 2}
@@ -257,6 +266,11 @@ popd
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
+%patch4 -p1
+
+# this goes together with patch4
+rm src/pip/_vendor/certifi/*.pem
+sed -i '/\.pem$/d' src/pip.egg-info/SOURCES.txt
 
 
 %build
@@ -464,6 +478,9 @@ ln -sf %{buildroot}%{_bindir}/pip3 _bin/pip
 %endif
 
 %changelog
+* Mon Dec 03 2018 Miro Hrončok <mhroncok@redhat.com> - 18.1-2
+- Use the system level root certificate instead of the one bundled in certifi
+
 * Thu Nov 22 2018 Miro Hrončok <mhroncok@redhat.com> - 18.1-1
 - Update to 18.1 (#1652089)