Merge pull request #541 from koordinates/fix-ca-certs-linux

Avoid cert verify issues via https clone on Linux

CHANGELOG.md

@@ -11,6 +11,7 @@ _When adding new entries to the changelog, please include issue/PR numbers where
   - You can now output the history of individual features: `kart log -- <dataset-name>:feature:<feature-primary-key>`. [#496](https://github.com/koordinates/kart/issues/496)
 * `kart clone` now strips `.git` off the end of automatically-generated repo paths, if `--bare` is not specified. [#540](https://github.com/koordinates/kart/issues/540)
 * Simpler developer builds using CMake, see the [contributing notes](./CONTRIBUTING.md).
+* Bugfix: fixed certificate verification errors when cloning HTTPS repositories on some Linux distributions. [#541](https://github.com/koordinates/kart/pull/541)
 * Bugfix: fixed the error when merging a commit where every feature in a dataset is deleted. [#506](https://github.com/koordinates/kart/pull/506)
 * Bugfix: Don't allow `--replace-ids` to be specified during an import where the primary key is changing. [#521](https://github.com/koordinates/kart/issues/521)
 

kart/__init__.py

@@ -71,9 +71,7 @@
     path_extras.append(os.path.join(prefix, "bin"))
 
 os.environ["GIT_EXEC_PATH"] = os.path.join(prefix, "libexec", "git-core")
-os.environ["GIT_TEMPLATE_DIR"] = os.path.join(
-    prefix, "share", "git-core", "templates"
-)
+os.environ["GIT_TEMPLATE_DIR"] = os.path.join(prefix, "share", "git-core", "templates")
 # See locked_git_index in.repo.py:
 os.environ["GIT_INDEX_FILE"] = os.path.join(".kart", "unlocked_index")
 
@@ -102,7 +100,9 @@
     os.environ["OGR_SQLITE_PRAGMA"] = "page_size=65536"
 
 # Write our various additions to $PATH
-os.environ['PATH'] = os.pathsep.join(path_extras) + os.pathsep + os.environ.get("PATH", "")
+os.environ["PATH"] = (
+    os.pathsep.join(path_extras) + os.pathsep + os.environ.get("PATH", "")
+)
 
 # GDAL Error Handling
 from osgeo import gdal, ogr, osr
@@ -128,6 +128,7 @@
 if is_linux:
     import certifi
 
+    # note: cli_util.py also sets this in git's `http.sslCAInfo` config var
     pygit2.settings.ssl_cert_file = certifi.where()
 
 

kart/cli_util.py

@@ -44,6 +44,11 @@ def _pygit2_configs():
     "pack.depth": 0,
     "pack.window": 0,
 }
+if platform.system() == "Linux":
+    import certifi
+
+    GIT_CONFIG_DEFAULT_OVERRIDES["http.sslCAInfo"] = certifi.where()
+
 # These are the settings that Kart always *overrides* in git config.
 # i.e. regardless of your local git settings, kart will use these settings instead.
 GIT_CONFIG_FORCE_OVERRIDES = {