From b5ee704bb72e6ee5a83a8cf17df193e35cdfc762 Mon Sep 17 00:00:00 2001
From: Ondrej Samohel <ondrej.samohel@orbi.tools>
Date: Wed, 5 May 2021 16:30:33 +0200
Subject: [PATCH] added SSL_CERT_FILE for frozen code

---
 start.py | 91 +++++++++++++++++++++++++++++++-------------------------
 1 file changed, 51 insertions(+), 40 deletions(-)

diff --git a/start.py b/start.py
index c24e20f63f..fc07a5ec3a 100644
--- a/start.py
+++ b/start.py
@@ -38,47 +38,47 @@ So, bootstrapping OpenPype looks like this::
 
 .. code-block:: bash
 
-+-------------------------------------------------------+
-| Determine MongoDB connection:                         |
-| Use `OPENPYPE_MONGO`, system keyring `openPypeMongo`  |
-+--------------------------|----------------------------+
-                   .--- Found? --.
+┌───────────────────────────────────────────────────────┐
+│ Determine MongoDB connection:                         │
+│ Use `OPENPYPE_MONGO`, system keyring `openPypeMongo`  │
+└──────────────────────────┬────────────────────────────┘
+                  ┌───- Found? -─┐
                  YES             NO
-                  |              |
-                  |       +------v--------------+
-                  |       | Fire up Igniter GUI |<---------+
-                  |       | and ask User        |          |
-                  |       +---------------------+          |
-                  |                                        |
-                  |                                        |
-+-----------------v------------------------------------+   |
-| Get location of OpenPype:                            |   |
-|   1) Test for `OPENPYPE_PATH` environment variable   |   |
-|   2) Test `openPypePath` in registry setting         |   |
-|   3) Test user data directory                        |   |
-| ...................................................  |   |
-| If running from frozen code:                         |   |
-|   - Use latest one found in user data dir            |   |
-| If running from live code:                           |   |
-|   - Use live code and install it to user data dir    |   |
-| * can be overridden with `--use-version` argument    |   |
-+-------------------------|----------------------------+   |
-             .-- Is OpenPype found? --.                    |
-             YES                     NO                    |
-              |                      |                     |
-              |      +---------------v-----------------+   |
-              |      | Look in `OPENPYPE_PATH`, find   |   |
-              |      | latest version and install it   |   |
-              |      | to user data dir.               |   |
-              |      +--------------|------------------+   |
-              |         .-- Is OpenPype found? --.         |
-              |         YES                     NO --------+
-              |          |
-              |<---------+
-              |
-+-------------v------------+
-|      Run OpenPype        |
-+--------------------------+
+                  │              │
+                  │       ┌──────┴──────────────┐
+                  │       │ Fire up Igniter GUI ├<-────────┐
+                  │       │ and ask User        │          │
+                  │       └─────────────────────┘          │
+                  │                                        │
+                  │                                        │
+┌─────────────────┴─────────────────────────────────────┐  │
+│ Get location of OpenPype:                             │  │
+│   1) Test for `OPENPYPE_PATH` environment variable    │  │
+│   2) Test `openPypePath` in registry setting          │  │
+│   3) Test user data directory                         │  │
+│ ····················································· │  │
+│ If running from frozen code:                          │  │
+│   - Use latest one found in user data dir             │  │
+│ If running from live code:                            │  │
+│   - Use live code and install it to user data dir     │  │
+│ * can be overridden with `--use-version` argument     │  │
+└──────────────────────────┬────────────────────────────┘  │
+              ┌─- Is OpenPype found? -─┐                   │
+             YES                       NO                  │
+              │                        │                   │
+              │      ┌─────────────────┴─────────────┐     │
+              │      │ Look in `OPENPYPE_PATH`, find │     │
+              │      │ latest version and install it │     │
+              │      │ to user data dir.             │     │
+              │      └──────────────┬────────────────┘     │
+              │         ┌─- Is OpenPype found? -─┐         │
+              │        YES                       NO -──────┘
+              │         │
+              ├<-───────┘
+              │
+┌─────────────┴────────────┐
+│      Run OpenPype        │
+└─────═══════════════──────┘
 
 
 Todo:
@@ -110,6 +110,17 @@ if not getattr(sys, 'frozen', False):
 else:
     OPENPYPE_ROOT = os.path.dirname(sys.executable)
 
+    # FIX #1469: Certificates from certifi are not available in some
+    # macos builds, so connection to ftrack/mongo will fail with
+    # unable to verify certificate issuer error. This will add certifi
+    # certificates so ssl can see them.
+    # WARNING: this can break stuff if custom certificates are used. In that
+    # case they need to be merged to certificate bundle and SSL_CERT_FILE
+    # should point to them.
+    if not os.getenv("SSL_CERT_FILE"):
+        ssl_cert_file = Path(OPENPYPE_ROOT) / "dependencies" / "certifi" / "cacert.pem"  # noqa: E501
+        os.environ["SSL_CERT_FILE"] = ssl_cert_file.as_posix()
+
     # add dependencies folder to sys.pat for frozen code
     frozen_libs = os.path.normpath(
         os.path.join(OPENPYPE_ROOT, "dependencies")