From 3ab1b19d910f6481c65d00e760da1076eecbacd9 Mon Sep 17 00:00:00 2001 From: Erik Gomez Date: Tue, 12 May 2026 14:35:01 -0500 Subject: [PATCH] also look for path --- managed_python_sitecustomize.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/managed_python_sitecustomize.py b/managed_python_sitecustomize.py index 18385c3..74f30b5 100644 --- a/managed_python_sitecustomize.py +++ b/managed_python_sitecustomize.py @@ -21,16 +21,25 @@ What it does: startup. OpenSSL reads SSL_CERT_FILE ahead of its compiled-in path, so stdlib SSL operations get a working CA bundle. - Only sets the variable when it isn't already set, so an explicit user - override (e.g. `export SSL_CERT_FILE=/path/to/ca.pem`) still wins. + Falls back to certifi only when SSL_CERT_FILE is unset OR points at a + path that doesn't exist on disk. A valid user override (e.g. a corporate + CA bundle at `export SSL_CERT_FILE=/opt/corp/ca.pem`) is preserved; + a stale or typo'd path gets corrected to certifi. References: macadmins/python#38 gregneagle/relocatable-python#13 """ import os +import os.path -if "SSL_CERT_FILE" not in os.environ: + +def _ssl_cert_file_is_valid(): + path = os.environ.get("SSL_CERT_FILE") + return bool(path) and os.path.isfile(path) + + +if not _ssl_cert_file_is_valid(): try: import certifi except ImportError: