From ff8a62a3fb9214aaaa111a2c0a488985002873fc Mon Sep 17 00:00:00 2001
From: Sam Clegg <sbc@chromium.org>
Date: Tue, 11 Aug 2020 11:51:47 -0700
Subject: [PATCH] Pre-bundle requests module with macOS bundles python (#589)

The problem is that python can have trouble finding the default
certifcate set on macOS.  The actual bundle is installed by the certifi
package which the requests module uses under the hood.

Fixes: #588
---
 emsdk_manifest.json      | 16 ++++++++--------
 scripts/update_python.py | 21 +++++++++++++++------
 2 files changed, 23 insertions(+), 14 deletions(-)

diff --git a/emsdk_manifest.json b/emsdk_manifest.json
index 2861604..0c9150e 100644
--- a/emsdk_manifest.json
+++ b/emsdk_manifest.json
@@ -290,10 +290,10 @@
   },
   {
     "id": "python",
-    "version": "3.7.4",
+    "version": "3.7.4-2",
     "bitness": 64,
     "arch": "x86_64",
-    "macos_url": "python-3.7.4-macos.tar.gz",
+    "macos_url": "python-3.7.4-2-macos.tar.gz",
     "activated_path": "%installation_dir%/bin",
     "activated_cfg": "PYTHON='%installation_dir%/bin/python3'",
     "activated_env": "EMSDK_PYTHON=%installation_dir%/bin/python3"
@@ -485,7 +485,7 @@
   {
     "version": "upstream-master",
     "bitness": 64,
-    "uses": ["llvm-git-master-64bit", "node-12.18.1-64bit", "python-3.7.4-64bit", "emscripten-master-64bit", "binaryen-master-64bit"],
+    "uses": ["llvm-git-master-64bit", "node-12.18.1-64bit", "python-3.7.4-2-64bit", "emscripten-master-64bit", "binaryen-master-64bit"],
     "os": "macos"
   },
   {
@@ -515,7 +515,7 @@
   {
     "version": "fastcomp-master",
     "bitness": 64,
-    "uses": ["fastcomp-clang-master-64bit", "node-12.18.1-64bit", "python-3.7.4-64bit", "emscripten-master-64bit", "binaryen-master-64bit"],
+    "uses": ["fastcomp-clang-master-64bit", "node-12.18.1-64bit", "python-3.7.4-2-64bit", "emscripten-master-64bit", "binaryen-master-64bit"],
     "os": "macos"
   },
   {
@@ -576,7 +576,7 @@
   {
     "version": "releases-upstream-%releases-tag%",
     "bitness": 64,
-    "uses": ["node-12.18.1-64bit", "python-3.7.4-64bit", "releases-upstream-%releases-tag%-64bit"],
+    "uses": ["node-12.18.1-64bit", "python-3.7.4-2-64bit", "releases-upstream-%releases-tag%-64bit"],
     "os": "macos",
     "custom_install_script": "emscripten_npm_install"
   },
@@ -597,7 +597,7 @@
   {
     "version": "releases-fastcomp-%releases-tag%",
     "bitness": 64,
-    "uses": ["node-12.18.1-64bit", "python-3.7.4-64bit", "releases-fastcomp-%releases-tag%-64bit"],
+    "uses": ["node-12.18.1-64bit", "python-3.7.4-2-64bit", "releases-fastcomp-%releases-tag%-64bit"],
     "os": "macos",
     "custom_install_script": "emscripten_npm_install"
   },
@@ -647,7 +647,7 @@
   {
     "version": "fastcomp-%precompiled_tag32%",
     "bitness": 32,
-    "uses": ["fastcomp-clang-e%precompiled_tag32%-32bit", "node-8.9.1-32bit", "python-3.7.4-64bit", "emscripten-%precompiled_tag32%"],
+    "uses": ["fastcomp-clang-e%precompiled_tag32%-32bit", "node-8.9.1-32bit", "python-3.7.4-2-64bit", "emscripten-%precompiled_tag32%"],
     "os": "macos",
     "version_filter": [
       ["%precompiled_tag32%", ">", "1.37.22"]
@@ -656,7 +656,7 @@
   {
     "version": "fastcomp-%precompiled_tag64%",
     "bitness": 64,
-    "uses": ["fastcomp-clang-e%precompiled_tag64%-64bit", "node-8.9.1-64bit", "python-3.7.4-64bit", "emscripten-%precompiled_tag64%"],
+    "uses": ["fastcomp-clang-e%precompiled_tag64%-64bit", "node-8.9.1-64bit", "python-3.7.4-2-64bit", "emscripten-%precompiled_tag64%"],
     "os": "macos",
     "version_filter": [
       ["%precompiled_tag64%", ">", "1.37.22"]
diff --git a/scripts/update_python.py b/scripts/update_python.py
index e1f81e3..10142da 100755
--- a/scripts/update_python.py
+++ b/scripts/update_python.py
@@ -32,6 +32,7 @@ from subprocess import check_call
 
 version = '3.7.4'
 base = 'https://www.python.org/ftp/python/%s/' % version
+revision = '2'
 
 pywin32_version = '227'
 pywin32_base = 'https://github.com/mhammond/pywin32/releases/download/b%s/' % pywin32_version
@@ -100,13 +101,21 @@ def build_python():
     check_call(['make', 'install', 'DESTDIR=install'], cwd=src_dir)
 
     install_dir = os.path.join(src_dir, 'install')
-    os.rename(os.path.join(install_dir, 'usr', 'local'), 'python-%s' % version)
-    tarball = 'python-%s-%s.tar.gz' % (version, osname)
-    shutil.rmtree(os.path.join('python-%s' % version, 'lib', 'python3.7', 'test'))
-    shutil.rmtree(os.path.join('python-%s' % version, 'include'))
-    for lib in glob.glob(os.path.join('python-%s' % version, 'lib', 'lib*.a')):
+
+    # Install requests module.  This is needed in particualr on macOS to ensure
+    # SSL certificates are available (certifi in installed and used by requests).
+    pybin = os.path.join(src_dir, 'install', 'usr', 'local', 'bin', 'python3')
+    pip = os.path.join(src_dir, 'install', 'usr', 'local', 'bin', 'pip3')
+    check_call([pybin, pip, 'install', 'requests'])
+
+    dirname = 'python-%s-%s' % (version, revision)
+    os.rename(os.path.join(install_dir, 'usr', 'local'), dirname)
+    tarball = 'python-%s-%s-%s.tar.gz' % (version, revision, osname)
+    shutil.rmtree(os.path.join(dirname, 'lib', 'python3.7', 'test'))
+    shutil.rmtree(os.path.join(dirname, 'include'))
+    for lib in glob.glob(os.path.join(dirname, 'lib', 'lib*.a')):
       os.remove(lib)
-    check_call(['tar', 'zcvf', tarball, 'python-%s' % version])
+    check_call(['tar', 'zcvf', tarball, dirname])
     print('Uploading: ' + upload_base + tarball)
     check_call(['gsutil', 'cp', '-n', tarball, upload_base + tarball])