Merge branch 'blender-v4.0-release'

source/blender/python/intern/CMakeLists.txt

@@ -142,6 +142,28 @@ if(WITH_PYTHON_MODULE)
   add_definitions(-DWITH_PYTHON_MODULE)
 endif()
 
+
+# Find the SSL certificate for the portable Blender installation.
+# Without this, the absolute path on the builder is used, causing HTTPS access to fail.
+# For example `urllib.request.urlopen("https://projects.blender.org")` fails
+# (or any other HTTPS site). see: #102300 for details.
+# NOTE: that this isn't necessary on WIN32.
+if(WITH_PYTHON AND WITH_PYTHON_INSTALL AND WITH_INSTALL_PORTABLE AND (NOT WIN32))
+  # - `PYTHON_SSL_CERT_FILE` absolute path to the PEM file.
+  find_python_module_file("certifi/cacert.pem" PYTHON_SSL_CERT_FILE _python_ssl_cert_file_relative)
+  mark_as_advanced(PYTHON_SSL_CERT_FILE)
+  if (PYTHON_SSL_CERT_FILE)
+    # This always moves up one level (even if there is a trailing slash).
+    add_definitions(-DPYTHON_SSL_CERT_FILE="${_python_ssl_cert_file_relative}")
+  else()
+    message(WARNING
+      "Unable to find \"certifi/cacert.pem\" within \"${PYTHON_LIBPATH}\", "
+      "this build will not be able to use bundled certificates with the \"ssl\" module!"
+    )
+  endif()
+  unset(_python_ssl_cert_file_relative)
+endif()
+
 if(WITH_PYTHON_SAFETY)
   add_definitions(-DWITH_PYTHON_SAFETY)
 endif()

source/blender/python/intern/bpy_interface.cc

@@ -450,6 +450,18 @@ void BPY_python_start(bContext *C, int argc, const char **argv)
 
         status = PyConfig_SetBytesString(&config, &config.home, py_path_bundle);
         pystatus_exit_on_error(status);
+
+#  ifdef PYTHON_SSL_CERT_FILE
+        /* Point to the portable SSL certificate to support HTTPS access, see: #102300. */
+        const char *ssl_cert_file_env = "SSL_CERT_FILE";
+        if (BLI_getenv(ssl_cert_file_env) == nullptr) {
+          const char *ssl_cert_file_suffix = PYTHON_SSL_CERT_FILE;
+          char ssl_cert_file[FILE_MAX];
+          BLI_path_join(
+              ssl_cert_file, sizeof(ssl_cert_file), py_path_bundle, ssl_cert_file_suffix);
+          BLI_setenv(ssl_cert_file_env, ssl_cert_file);
+        }
+#  endif /* PYTHON_SSL_CERT_FILE */
       }
       else {
 /* Common enough to use the system Python on Linux/Unix, warn on other systems. */