From 2e691d4e94686ed35611398961645406f198e062 Mon Sep 17 00:00:00 2001
From: mayeut <mayeut@users.noreply.github.com>
Date: Sat, 1 Oct 2022 11:11:36 +0200
Subject: [PATCH] fix: setup OpenSSL certificates in
 `macos-pkg-setup-template.sh`

The macOS pkg installer does not setup default certificates for OpenSSL.
A script is provided by the macOS pkg installer to setup those using the certifi PyPI package.
Let's run this script as part of the setup template in order to be able to do HTTPS downloads out of the box.
---
 installers/macos-pkg-setup-template.sh |  4 ++++
 tests/python-tests.ps1                 |  4 ++++
 tests/sources/python-urlopen-https.py  | 10 ++++++++++
 3 files changed, 18 insertions(+)
 create mode 100644 tests/sources/python-urlopen-https.py

diff --git a/installers/macos-pkg-setup-template.sh b/installers/macos-pkg-setup-template.sh
index 67c57c860..555fd9dd0 100644
--- a/installers/macos-pkg-setup-template.sh
+++ b/installers/macos-pkg-setup-template.sh
@@ -20,6 +20,7 @@ PYTHON_TOOLCACHE_PATH=$TOOLCACHE_ROOT/Python
 PYTHON_TOOLCACHE_VERSION_PATH=$PYTHON_TOOLCACHE_PATH/$PYTHON_FULL_VERSION
 PYTHON_TOOLCACHE_VERSION_ARCH_PATH=$PYTHON_TOOLCACHE_VERSION_PATH/x64
 PYTHON_FRAMEWORK_PATH="/Library/Frameworks/Python.framework/Versions/${MAJOR_VERSION}.${MINOR_VERSION}"
+PYTHON_APPLICATION_PATH="/Applications/Python ${MAJOR_VERSION}.${MINOR_VERSION}"
 
 echo "Check if Python hostedtoolcache folder exist..."
 if [ ! -d $PYTHON_TOOLCACHE_PATH ]; then
@@ -64,5 +65,8 @@ echo "Upgrading pip..."
 ./python -m ensurepip
 ./python -m pip install --ignore-installed pip --disable-pip-version-check --no-warn-script-location
 
+echo "Install OpenSSL certificates"
+sh -e "${PYTHON_APPLICATION_PATH}/Install Certificates.command"
+
 echo "Create complete file"
 touch $PYTHON_TOOLCACHE_VERSION_PATH/x64.complete
diff --git a/tests/python-tests.ps1 b/tests/python-tests.ps1
index 6d9f1e675..7f4850c91 100644
--- a/tests/python-tests.ps1
+++ b/tests/python-tests.ps1
@@ -96,4 +96,8 @@ Describe "Tests" {
             "./dist/simple-test" | Should -ReturnZeroExitCode
         }
     }
+
+    It "Check urlopen with HTTPS works" {
+        "python ./sources/python-urlopen-https.py" | Should -ReturnZeroExitCode
+    }
 }
diff --git a/tests/sources/python-urlopen-https.py b/tests/sources/python-urlopen-https.py
new file mode 100644
index 000000000..14fd81f3d
--- /dev/null
+++ b/tests/sources/python-urlopen-https.py
@@ -0,0 +1,10 @@
+import sys
+
+if sys.version_info[0] == 2:
+    from urllib2 import urlopen
+else:
+    from urllib.request import urlopen
+
+response = urlopen("https://raw.githubusercontent.com/actions/python-versions/c641695f6a07526c18f10e374e503e649fef9427/.gitignore")
+data = response.read()
+assert len(data) == 140, len(data)