meson: Improve certifi documentation on macOS

First, just installing certifi doesn't install the ca-cert in the
right location. The `Install Certificates.command` script also
symlinks the openssl cert.pem to the certifi ca cert file

Second, we can make it more likely that users will notice this if we
make it a warning. If we ever get a bug report about this despite
these measures, we can try to make this an error.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/2707>
This commit is contained in:
Nirbheek Chauhan 2022-07-02 05:33:40 +05:30 committed by GStreamer Marge Bot
parent 35994eb5c9
commit 7a163dae4d
2 changed files with 18 additions and 4 deletions

View file

@ -54,14 +54,14 @@ binary in your PATH.
You can find [instructions for Windows below](#windows-prerequisites-setup). You can find [instructions for Windows below](#windows-prerequisites-setup).
On macOS, you might need to execute "Install Certificates.command" from On macOS, you might need to execute "Install Certificates.command" from the
the Python folder in the user Applications folder or install it manually: Python folder in the user Applications folder:
``` ```
$ pip3 install certifi $ /Applications/Python\ 3.*/Install\ Certificates.command
``` ```
It will solve this issue: Otherwise you will get this error when downloading meson wraps:
``` ```
urllib.error.URLError: urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed urllib.error.URLError: urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed

View file

@ -48,6 +48,20 @@ if build_system == 'windows' and meson.version().version_compare('<0.60.0')
endif endif
endif endif
# On macOS, you have to run "Install Certificates.command" otherwise Python
# doesn't have access to the latest SSL CA Certificates, and Meson will fail to
# download wrap files from websites that use, for example, Let's Encrypt.
# We already recommend this in the README, but add a warning here as well.
# Can't make this an error because the user might be using XCode's Python
# 3 which doesn't have this script.
if build_system == 'darwin'
python3_cacert_file = python3.get_path('data') / 'etc/openssl/cert.pem'
install_cert_cmd = '/Applications/Python @0@/Install Certificates.command'.format(python3.language_version())
if not fs.is_symlink(python3_cacert_file) and fs.is_file(install_cert_cmd)
warning('Please run "@0@" so that Python has access to the latest SSL certificates. Meson might fail to download some wraps without it.'.format(install_cert_cmd))
endif
endif
documented_projects = '' documented_projects = ''
# Make it possible to use msys2 built zlib which fails # Make it possible to use msys2 built zlib which fails
# when not using the mingw toolchain as it uses unistd.h # when not using the mingw toolchain as it uses unistd.h