From 1e1d9f903254a883981896677d6123ab040a47e6 Mon Sep 17 00:00:00 2001
From: Matthieu Darbois <mayeut@users.noreply.github.com>
Date: Mon, 3 Oct 2022 10:13:05 +0200
Subject: [PATCH] fix: setup OpenSSL certificates in
 `macos-pkg-setup-template.sh` (#189)

The macOS pkg installer does not setup default certificates for OpenSSL.
A script is provided by the macOS pkg installer to setup those using the certifi PyPI package.
Let's run this script as part of the setup template in order to be able to do HTTPS downloads out of the box.
---
 installers/macos-pkg-setup-template.sh |  4 ++++
 tests/python-tests.ps1                 |  4 ++++
 tests/sources/python-urlopen-https.py  | 10 ++++++++++
 3 files changed, 18 insertions(+)
 create mode 100644 tests/sources/python-urlopen-https.py

diff --git a/installers/macos-pkg-setup-template.sh b/installers/macos-pkg-setup-template.sh
index 67c57c8..555fd9d 100644
--- a/installers/macos-pkg-setup-template.sh
+++ b/installers/macos-pkg-setup-template.sh
@@ -20,6 +20,7 @@ PYTHON_TOOLCACHE_PATH=$TOOLCACHE_ROOT/Python
 PYTHON_TOOLCACHE_VERSION_PATH=$PYTHON_TOOLCACHE_PATH/$PYTHON_FULL_VERSION
 PYTHON_TOOLCACHE_VERSION_ARCH_PATH=$PYTHON_TOOLCACHE_VERSION_PATH/x64
 PYTHON_FRAMEWORK_PATH="/Library/Frameworks/Python.framework/Versions/${MAJOR_VERSION}.${MINOR_VERSION}"
+PYTHON_APPLICATION_PATH="/Applications/Python ${MAJOR_VERSION}.${MINOR_VERSION}"
 
 echo "Check if Python hostedtoolcache folder exist..."
 if [ ! -d $PYTHON_TOOLCACHE_PATH ]; then
@@ -64,5 +65,8 @@ echo "Upgrading pip..."
 ./python -m ensurepip
 ./python -m pip install --ignore-installed pip --disable-pip-version-check --no-warn-script-location
 
+echo "Install OpenSSL certificates"
+sh -e "${PYTHON_APPLICATION_PATH}/Install Certificates.command"
+
 echo "Create complete file"
 touch $PYTHON_TOOLCACHE_VERSION_PATH/x64.complete
diff --git a/tests/python-tests.ps1 b/tests/python-tests.ps1
index 6d9f1e6..7f4850c 100644
--- a/tests/python-tests.ps1
+++ b/tests/python-tests.ps1
@@ -96,4 +96,8 @@ Describe "Tests" {
             "./dist/simple-test" | Should -ReturnZeroExitCode
         }
     }
+
+    It "Check urlopen with HTTPS works" {
+        "python ./sources/python-urlopen-https.py" | Should -ReturnZeroExitCode
+    }
 }
diff --git a/tests/sources/python-urlopen-https.py b/tests/sources/python-urlopen-https.py
new file mode 100644
index 0000000..14fd81f
--- /dev/null
+++ b/tests/sources/python-urlopen-https.py
@@ -0,0 +1,10 @@
+import sys
+
+if sys.version_info[0] == 2:
+    from urllib2 import urlopen
+else:
+    from urllib.request import urlopen
+
+response = urlopen("https://raw.githubusercontent.com/actions/python-versions/c641695f6a07526c18f10e374e503e649fef9427/.gitignore")
+data = response.read()
+assert len(data) == 140, len(data)