diff --git a/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch b/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch new file mode 100644 index 0000000..14ca3a1 --- /dev/null +++ b/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch @@ -0,0 +1,36 @@ +From 08e863f94fe93b4b3bd2e8267234be7a23350b1d Mon Sep 17 00:00:00 2001 +From: Adam Williamson +Date: Thu, 1 Aug 2024 12:58:38 -0700 +Subject: [PATCH] Don't create default SSLContext if CA bundle isn't present + +Similar to e18879932287c2bf4bcee4ddf6ccb8a69b6fc656 , this also +skips creation of the default SSLContext on FileNotFoundError, +which is raised if DEFAULT_CA_BUNDLE_PATH does not exist. + +See: https://bugzilla.redhat.com/show_bug.cgi?id=2297632 + +Signed-off-by: Adam Williamson +--- + src/requests/adapters.py | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/requests/adapters.py b/src/requests/adapters.py +index 9a58b160..fb151a95 100644 +--- a/src/requests/adapters.py ++++ b/src/requests/adapters.py +@@ -81,9 +81,10 @@ try: + _preloaded_ssl_context.load_verify_locations( + extract_zipped_paths(DEFAULT_CA_BUNDLE_PATH) + ) +-except ImportError: ++except (ImportError, FileNotFoundError): + # Bypass default SSLContext creation when Python +- # interpreter isn't built with the ssl module. ++ # interpreter isn't built with the ssl module, or ++ # DEFAULT_CA_BUNDLE_PATH isn't present + _preloaded_ssl_context = None + + +-- +2.45.2 + diff --git a/python-requests.spec b/python-requests.spec index d2e69d7..ce41620 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.32.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -24,6 +24,11 @@ Patch: system-certs.patch # This change is backported also into RHEL 9.4 (via CS) Patch: support_IPv6_CIDR_in_no_proxy.patch +# Fix crash on import if /etc/pki/tls/certs/ca-bundle.crt is missing +# https://bugzilla.redhat.com/show_bug.cgi?id=2297632 +# https://github.com/psf/requests/pull/6781 +Patch: 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch + BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -95,6 +100,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Thu Aug 01 2024 Adam Williamson - 2.32.3-3 +- Backport PR #6781 to fix crash on import if CA cert bundle is missing (#2297632) + * Fri Jul 19 2024 Fedora Release Engineering - 2.32.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild