push sheeet

pkgs/development/python-modules/certifi/default.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  cacert,
+  pythonOlder,
+  fetchFromGitHub,
+  setuptools,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "certifi";
+  version = "2025.07.14";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "certifi";
+    repo = "python-certifi";
+    rev = version;
+    hash = "sha256-TSqBca42i7i59ERTrnPN0fLdLWToYMCq5cfFFsgZm5U=";
+  };
+
+  patches = [
+    # Add support for NIX_SSL_CERT_FILE
+    ./env.patch
+  ];
+
+  postPatch = ''
+    # Use our system-wide ca-bundle instead of the bundled one
+    rm -v "certifi/cacert.pem"
+    ln -snvf "${cacert}/etc/ssl/certs/ca-bundle.crt" "certifi/cacert.pem"
+  '';
+
+  nativeBuildInputs = [ setuptools ];
+
+  propagatedNativeBuildInputs = [
+    # propagate cacerts setup-hook to set up `NIX_SSL_CERT_FILE`
+    cacert
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "certifi" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/certifi/python-certifi";
+    description = "Python package for providing Mozilla's CA Bundle";
+    license = licenses.isc;
+    maintainers = with maintainers; [ koral ];
+  };
+}

pkgs/development/python-modules/certifi/env.patch

@@ -0,0 +1,53 @@
+diff --git a/certifi/core.py b/certifi/core.py
+index 1c9661c..7039be3 100644
+--- a/certifi/core.py
++++ b/certifi/core.py
+@@ -4,6 +4,7 @@ certifi.py
+ 
+ This module returns the installation location of cacert.pem or its contents.
+ """
++import os
+ import sys
+ import atexit
+ 
+@@ -11,12 +12,21 @@ def exit_cacert_ctx() -> None:
+     _CACERT_CTX.__exit__(None, None, None)  # type: ignore[union-attr]
+ 
+ 
++def get_cacert_path_from_environ():
++    path = os.environ.get("NIX_SSL_CERT_FILE", None)
++
++    if path == "/no-cert-file.crt":
++        return None
++
++    return path
++
++
+ if sys.version_info >= (3, 11):
+ 
+     from importlib.resources import as_file, files
+ 
+     _CACERT_CTX = None
+-    _CACERT_PATH = None
++    _CACERT_PATH = get_cacert_path_from_environ()
+ 
+     def where() -> str:
+         # This is slightly terrible, but we want to delay extracting the file
+@@ -44,6 +54,8 @@ if sys.version_info >= (3, 11):
+         return _CACERT_PATH
+ 
+     def contents() -> str:
++        if _CACERT_PATH is not None:
++            return open(_CACERT_PATH, encoding="utf-8").read()
+         return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
+ 
+ else:
+@@ -51,7 +63,7 @@ else:
+     from importlib.resources import path as get_path, read_text
+ 
+     _CACERT_CTX = None
+-    _CACERT_PATH = None
++    _CACERT_PATH = get_cacert_path_from_environ()
+ 
+     def where() -> str:
+         # This is slightly terrible, but we want to delay extracting the