Allow the CA certificate data to be passed as a string.

[jeamland]

There are some circumstances where we may want to pass the PEM-encoded certificates directly to the SSLContext rather than passing a file or directory. This just plums SSLContext.load_verify_locations()'s cadata parameter through to places where it can be reached.

[sigmavirus24]

Doesn't urllib3 allow users to pass their own SSLContext?

[jeamland]

It does but that's not what requests appears to do. Do you feel that it should?

[sigmavirus24]

I think you can define your own Adapter class in Requests that will allow you to pass down to urllib3 a custom SSLContext. That would give you the functionality you want as far as I understand, especially since it sounds like you control the code calling Requests.

[jeamland]

Actually at the moment you can't even import requests as it calls certifi.where() unconditionally. This is part of an effort to remove that in a way that makes requests "just work".

[sigmavirus24]

Actually at the moment you can't even import requests as it calls certifi.where() unconditionally. This is part of an effort to remove that in a way that makes requests "just work".

I understand that PyOxidizer doesn't have a file-system like thing but does that mean __file__ or os.path.join are broken? That was not made remotely clear on certifi

[jeamland]

PyOxidizer does not set __file__ at all. os.path.join would work for accessing "normal" files but using it to access resources by pivoting off the filesystem path of a module will never work.

[sigmavirus24]

This should make it easier to use cadata from requests though. I'll let one of the real maintainers here approve/provide feedback but otherwise this looks good to me

[sethmlarson]

This looks good to me, thank you for a very high-quality PR. Also thanks to @sigmavirus24 for handling 95% of this PR. :)

Also TIL about PyOxidizer not having access to packages at a filesystem level. That's becoming a requirement for more Python-related tasks it seems eg PyOxidizer, Py2EXE, etc. Maybe needs to be an effort to try loading certifi via certifi.contents() in Requests if certifi.where() fails?