Backport PR #6781 to fix crash on import (#2297632)

0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch

@@ -0,0 +1,36 @@
+From 08e863f94fe93b4b3bd2e8267234be7a23350b1d Mon Sep 17 00:00:00 2001
+From: Adam Williamson <awilliam@redhat.com>
+Date: Thu, 1 Aug 2024 12:58:38 -0700
+Subject: [PATCH] Don't create default SSLContext if CA bundle isn't present
+
+Similar to e18879932287c2bf4bcee4ddf6ccb8a69b6fc656 , this also
+skips creation of the default SSLContext on FileNotFoundError,
+which is raised if DEFAULT_CA_BUNDLE_PATH does not exist.
+
+See: https://bugzilla.redhat.com/show_bug.cgi?id=2297632
+
+Signed-off-by: Adam Williamson <awilliam@redhat.com>
+---
+ src/requests/adapters.py | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/requests/adapters.py b/src/requests/adapters.py
+index 9a58b160..fb151a95 100644
+--- a/src/requests/adapters.py
++++ b/src/requests/adapters.py
+@@ -81,9 +81,10 @@ try:
+     _preloaded_ssl_context.load_verify_locations(
+         extract_zipped_paths(DEFAULT_CA_BUNDLE_PATH)
+     )
+-except ImportError:
++except (ImportError, FileNotFoundError):
+     # Bypass default SSLContext creation when Python
+-    # interpreter isn't built with the ssl module.
++    # interpreter isn't built with the ssl module, or
++    # DEFAULT_CA_BUNDLE_PATH isn't present
+     _preloaded_ssl_context = None
+ 
+ 
+-- 
+2.45.2
+

python-requests.spec

@@ -6,7 +6,7 @@
 
 Name:           python-requests
 Version:        2.32.3
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        HTTP library, written in Python, for human beings
 
 License:        Apache-2.0
@@ -24,6 +24,11 @@ Patch:          system-certs.patch
 # This change is backported also into RHEL 9.4 (via CS)
 Patch:          support_IPv6_CIDR_in_no_proxy.patch
 
+# Fix crash on import if /etc/pki/tls/certs/ca-bundle.crt is missing
+# https://bugzilla.redhat.com/show_bug.cgi?id=2297632
+# https://github.com/psf/requests/pull/6781
+Patch:          0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch
+
 BuildArch:      noarch
 BuildRequires:  python%{python3_pkgversion}-devel
 %if %{with tests}
@@ -95,6 +100,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml
 
 
 %changelog
+* Thu Aug 01 2024 Adam Williamson <awilliam@redhat.com> - 2.32.3-3
+- Backport PR #6781 to fix crash on import if CA cert bundle is missing (#2297632)
+
 * Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.32.3-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild