Ensure HTTPS support for subvertpy binary wheels

.github/workflows/macos-wheels.yml

@@ -24,10 +24,28 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install build and pytest Python packages
         run: sudo pip install build pytest
-      - name: Install MacPorts
+      # sudo is required to restore macports cache, apply same workaround from
+      # https://github.com/actions/cache/issues/629#issuecomment-1189184648
+      - name: Install gtar wrapper
+        run: |
+          gtar_path=$(which gtar)
+          echo "#!/bin/sh" > gtar
+          echo "exec sudo $gtar_path.orig \"\$@\"" >> gtar
+          sudo mv $gtar_path $gtar_path.orig
+          sudo mv gtar $gtar_path
+          sudo chmod +x $gtar_path
+      - name: Restore macports cache
+        id: restore-macports-cache
+        uses: actions/cache/restore@v5
+        with:
+          path: /opt/local/
+          key: macports-cache-${{ matrix.config.arch }}-${{ matrix.config.os }}
+          restore-keys: macports-cache-${{ matrix.config.arch }}-${{ matrix.config.os }}
+      - name: Install MacPorts and other tools
         run: |
           curl -LO https://raw.githubusercontent.com/GiovanniBussi/macports-ci/master/macports-ci
           source ./macports-ci install --sync=rsync
+          brew install md5sha1sum rust
       - name: Set macOS deployment target and install MacOSX sdk 11.3
         run: |
           echo 'macosx_deployment_target 11.0' | sudo tee -a /opt/local/etc/macports/macports.conf
@@ -37,6 +55,17 @@ jobs:
           sudo mv MacOSX11.3.sdk /Library/Developer/CommandLineTools/SDKs/
       - name: Install subvertpy build dependencies
         run: sudo port -N -s install subversion db48
+      # hash software source paths including versions to get a cache key
+      - name: Compute cache key
+        id: cache-key
+        run: |
+          echo "value=$(find /opt/local/var/macports/software | sha1sum | cut -c1-40)" >> $GITHUB_OUTPUT
+        shell: bash
+      - name: Save macports cache
+        uses: actions/cache/save@v5
+        with:
+          path: /opt/local/
+          key: macports-cache-${{ matrix.config.arch }}-${{ matrix.config.os }}-${{ steps.cache-key.outputs.value }}
       - name: Sets CIBW_BUILD and SDKROOT environment variable
         env:
           pyVer: "${{matrix.python-version}}"
@@ -45,16 +74,24 @@ jobs:
           echo "CIBW_BUILD=cp${pyVer/./}-macosx_$arch" >> $GITHUB_ENV
           echo "SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX11.3.sdk" >> $GITHUB_ENV
       - name: Build subvertpy wheel with cibuildwheel
+        env:
+          CIBW_BUILD_VERBOSITY: 1
+          CIBW_BEFORE_BUILD_MACOS:
+          RUSTFLAGS: -C link-args=-Wl,-headerpad_max_install_names
         run: |
           pip install cibuildwheel --user
           python -m cibuildwheel --output-dir wheelhouse
-        env:
-          CIBW_BUILD_VERBOSITY: 1
       - name: Test built wheel can be installed and imported
         working-directory: wheelhouse
         run: |
           pip install $(ls -t | head -1)
-          python -c "from subvertpy import client, ra, repos, subr, wc"
+
+          # check modules import and https support
+          python -c "
+          from subvertpy import client, ra, repos, subr, wc;
+          client = client.Client(auth=ra.Auth([ra.get_username_provider()]));
+          client.info('https://svn.pld-linux.org/svn')"
+
           cd ../ && rm -rf subvertpy && python -m pytest tests
       - uses: actions/upload-artifact@v4
         with:

.github/workflows/manylinux-wheels.yml

@@ -33,8 +33,16 @@ jobs:
       - name: Test wheel can be installed and subvertpy module imported
         run: |
           $Python3_ROOT_DIR/bin/pip install $(ls -t | head -1)
+
           $Python3_ROOT_DIR/bin/python -c "
           from subvertpy import client, ra, repos, subr, wc"
+
+          # check modules import and https support
+          $Python3_ROOT_DIR/bin/python -c "
+          from subvertpy import client, ra, repos, subr, wc;
+          client = client.Client(auth=ra.Auth([ra.get_username_provider()]));
+          client.info('https://svn.pld-linux.org/svn')"
+
           pip3 install pytest
           cd ../ && rm -rf subvertpy && python3 -m pytest tests
         working-directory: wheelhouse

.github/workflows/pythonpackage.yml

@@ -32,7 +32,7 @@ jobs:
       if: "matrix.os == 'ubuntu-latest'"
     - name: Install dependencies (brew)
       run: |
-        brew install subversion
+        brew install subversion pkg-config apr apr-util
       if: "matrix.os == 'macos-latest'"
     - name: Install dependencies (Windows)
       uses: johnwason/vcpkg-action@v7
@@ -64,6 +64,8 @@ jobs:
         export PATH="$(brew --prefix)/opt/subversion/libexec:$PATH"
         export PATH="$(brew --prefix)/opt/apr-util/bin:$PATH"
         export PATH="$(brew --prefix)/opt/apr/bin:$PATH"
+        export PKG_CONFIG_PATH="$(brew --prefix apr)/lib/pkgconfig:$(brew --prefix apr-util)/lib/pkgconfig"
+        export LIBRARY_PATH="$(brew --prefix gettext)/lib:$(brew --prefix utf8proc)/lib"
         pip install -e .
       if: "matrix.os == 'macos-latest'"
     - name: Build (Windows)

.github/workflows/windows-wheels.yml

@@ -110,12 +110,20 @@ jobs:
       - name: Test built wheel can be installed and imported
         working-directory: wheelhouse
         run: |
-          set PATH=%Python3_ROOT_DIR%\Scripts:%PATH%
-          set PYTHONIOENCODING=utf-8
-          for /f "tokens=*" %%g in ('dir /b *.whl') do (set wheel=%%g)
-          pip install %wheel%
-          python -c "from subvertpy import client, ra, repos, subr, wc"
-          cd .. && python -m pytest tests
+          python_dir=$(cygpath -u $Python3_ROOT_DIR)
+          export PATH=$python_dir:$python_dir/Scripts:$PATH
+
+          pip install $(ls -t | head -1)
+
+          # check modules import and https support
+          python -c "
+          from subvertpy import client, ra, repos, subr, wc;
+          client = client.Client(auth=ra.Auth([ra.get_username_provider()]));
+          client.info('https://svn.pld-linux.org/svn')"
+
+          pip install pytest
+          cd ../ && rm -rf subvertpy && python -m pytest tests
+        shell: msys2 {0}
       - uses: actions/upload-artifact@v4
         with:
           name: subvertpy-wheel-windows-${{ matrix.python-version }}

.gitignore

@@ -19,3 +19,7 @@ apidocs
 
 /target
 subvertpy.egg-info
+
+
+# bundled certificate for wheels
+subvertpy/cert/cacert.pem

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=61.2", "setuptools_rust"]
+requires = ["setuptools>=61.2", "setuptools_rust", "requests"]
 build-backend = "setuptools.build_meta"
 
 [project.optional-dependencies]

setup.py

@@ -2,17 +2,20 @@
 # Setup file for subvertpy
 # Copyright (C) 2005-2010 Jelmer Vernooij <jelmer@jelmer.uk>
 
-import sys
+import os
 
+import requests
 from setuptools import setup
 from setuptools_rust import Binding, RustExtension
 
 
 def package_data():
-    if sys.platform == "win32":
-        return {"subvertpy": ["subvertpy/*.dll"]}
-    else:
-        return {}
+    os.makedirs("subvertpy/cert", exist_ok=True)
+    with open("subvertpy/cert/cacert.pem", "wb") as cert:
+        response = requests.get("https://curl.se/ca/cacert.pem")
+        response.raise_for_status()
+        cert.write(response.content)
+    return {"subvertpy": ["cert/cacert.pem"]}
 
 
 if __name__ == "__main__":

subvertpy/__init__.py

@@ -16,6 +16,8 @@
 
 """Python bindings for Subversion."""
 
+import os
+
 __author__ = "Jelmer Vernooij <jelmer@jelmer.uk>"
 __version__ = (0, 12, 0)
 
@@ -98,6 +100,17 @@
 SSL_UNKNOWNCA = 0x00000008
 SSL_OTHER = 0x40000000
 
+_module_dir = os.path.dirname(__file__)
+_wheel_libs_dir = os.path.join(_module_dir, "../subvertpy.libs")
+_wheel_dylibs_dir = os.path.join(_module_dir, ".dylibs")
+
+if os.path.exists(_wheel_libs_dir) or os.path.exists(_wheel_dylibs_dir):
+    # when subvertpy is installed from a binary wheel the hardcoded path to
+    # certificates in bundled openssl does not necessarily exist on the host
+    # system so we ensure one can be found or manipulating remote svn repos
+    # through HTTPS does not work
+    os.environ["SSL_CERT_FILE"] = os.path.join(_module_dir, "cert/cacert.pem")
+
 
 class SubversionException(Exception):
     """A Subversion exception."""