50 lines
2.0 KiB
Python
50 lines
2.0 KiB
Python
"""Build-time native dependencies; never use unrelated tools from PATH."""
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
|
|
def python_ssl_binaries():
|
|
import _ssl
|
|
import ssl
|
|
import pefile
|
|
|
|
extension = Path(_ssl.__file__).resolve()
|
|
roots = (extension.parent, Path(sys.base_prefix), Path(sys.base_prefix) / "DLLs")
|
|
with pefile.PE(str(extension), fast_load=True) as image:
|
|
image.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_IMPORT"]])
|
|
names = [entry.dll.decode("ascii") for entry in image.DIRECTORY_ENTRY_IMPORT]
|
|
binaries = []
|
|
for name in names:
|
|
if not name.lower().startswith(("libssl", "libcrypto")):
|
|
continue
|
|
source = next((root / name for root in roots if (root / name).is_file()), None)
|
|
if source is None:
|
|
raise RuntimeError(f"Python OpenSSL dependency is missing: {name}")
|
|
binaries.append((name, str(source.resolve()), "BINARY"))
|
|
return binaries
|
|
|
|
|
|
def pin_ssl_binaries(collected, verified):
|
|
"""Replace any PATH-selected DLL with the one belonging to build Python."""
|
|
identities = {name.casefold() for name, _, _ in verified}
|
|
return [item for item in collected if item[0].casefold() not in identities] + list(verified)
|
|
|
|
|
|
def python_ssl_data():
|
|
"""Keep the build interpreter's certificate policy resource beside ssl.py.
|
|
|
|
Some managed Python runtimes load this public PEM in SSLContext.__new__.
|
|
Freezing the module without its sibling breaks every HTTPS context. Copy
|
|
the existing policy verbatim; never replace or disable certificate checks.
|
|
Ordinary Python distributions do not need this additional resource.
|
|
"""
|
|
import ssl
|
|
|
|
source = Path(ssl.__file__).resolve()
|
|
policy = source.with_name("codex-rejected-cas.pem")
|
|
if policy.is_file():
|
|
return [(str(policy), ".")]
|
|
if source.suffix == ".py" and policy.name in source.read_text(encoding="utf-8"):
|
|
raise RuntimeError("Python SSL policy resource is missing: " + str(policy))
|
|
return []
|