Skip to content

[ARM] Fix #20842: az bicep: Fix to use requests environment variables for CA bundle #21807

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhoxing-ms merged 1 commit into from
Mar 30, 2022
Merged

[ARM] Fix #20842: az bicep: Fix to use requests environment variables for CA bundle #21807

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions src/azure-cli/azure/cli/command_modules/resource/_bicep.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,8 +109,8 @@ def ensure_bicep_installation(release_tag=None, target_platform=None, stdout=Tru
print(f"Installing Bicep CLI {release_tag}...")
else:
print("Installing Bicep CLI...")
ca_file = certifi.where()
request = urlopen(_get_bicep_download_url(system, release_tag, target_platform=target_platform), cafile=ca_file)
os.environ.setdefault("CURL_CA_BUNDLE", certifi.where())
request = urlopen(_get_bicep_download_url(system, release_tag, target_platform=target_platform))
Comment on lines +112 to +113
Copy link
Member

@jiasli jiasli Mar 31, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copying @emitor's comment from e0bb745#r71858253:

Hi @wwmoraes, urlopen does not use the OS environment CURL_CA_BUNDLE as request does. So if you remove the cafile=ca_file parameter this break the command az bicep if you are behind a proxy using a custom CA.

I'm trying to using this at work behind a corporate proxt and does not work anymore and throws the [SSL: CERTIFICATE_VERIFY_FAILED]. I've manually modified the file locally and is working.

In order to do it properly so urlopen does not throw any warnings, you should change it to something like this:

...
import ssl
...
        context = ssl.create_default_context(cafile=certifi.where())
        request = urlopen(_get_bicep_download_url(system, release_tag, target_platform=target_platform), context=context)
...

Would you be able to fix this back please?

Thanks!

Copy link
Member

@jiasli jiasli Mar 31, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In short, urlopen doesn't support REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE and we shouldn't make urlopen support them either.

with open(installation_path, "wb") as f:
f.write(request.read())

Expand Down Expand Up @@ -143,17 +143,17 @@ def is_bicep_file(file_path):

def get_bicep_available_release_tags():
try:
ca_file = certifi.where()
response = requests.get("https://aka.ms/BicepReleases", verify=ca_file)
os.environ.setdefault("CURL_CA_BUNDLE", certifi.where())
response = requests.get("https://aka.ms/BicepReleases")
Comment on lines +146 to +147
Copy link
Member

@jiasli jiasli Mar 31, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification, there is no need to set certifi.where() to CURL_CA_BUNDLE at all.

requests checks CA bundles in following order:

  1. REQUESTS_CA_BUNDLE
  2. CURL_CA_BUNDLE
  3. certifi.where()

If REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE is not set, request by default uses certifi.where().

return [release["tag_name"] for release in response.json()]
except IOError as err:
raise ClientRequestError(f"Error while attempting to retrieve available Bicep versions: {err}.")


def get_bicep_latest_release_tag():
try:
ca_file = certifi.where()
response = requests.get("https://aka.ms/BicepLatestRelease", verify=ca_file)
os.environ.setdefault("CURL_CA_BUNDLE", certifi.where())
response = requests.get("https://aka.ms/BicepLatestRelease")
response.raise_for_status()
return response.json()["tag_name"]
except IOError as err:
Expand Down