[Python-apps-team] Bug#951382: Weasyprint does not work without ca-certificates package

[n_petr at seznam.cz]

Package: weasyprint
Version: 51-1


When I invoke `weasyprint "https://www.google.com" google.pdf' an error occurs, rather than the expected creation of *.pdf file.
Here is a transcript:


root at b4879d89318d:/home# weasyprint "https://www.google.com" google.pdf
Traceback (most recent call last):
  File "/usr/lib/python3.7/urllib/request.py", line 1319, in do_open
    encode_chunked=req.has_header('Transfer-encoding'))
  File "/usr/lib/python3.7/http/client.py", line 1252, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/usr/lib/python3.7/http/client.py", line 1298, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.7/http/client.py", line 1247, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.7/http/client.py", line 1026, in _send_output
    self.send(msg)
  File "/usr/lib/python3.7/http/client.py", line 966, in send
    self.connect()
  File "/usr/lib/python3.7/http/client.py", line 1422, in connect
    server_hostname=server_hostname)
  File "/usr/lib/python3.7/ssl.py", line 423, in wrap_socket
    session=session
  File "/usr/lib/python3.7/ssl.py", line 870, in _create
    self.do_handshake()
  File "/usr/lib/python3.7/ssl.py", line 1139, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/weasyprint/urls.py", line 284, in fetch
    result = url_fetcher(url)
  File "/usr/lib/python3/dist-packages/weasyprint/urls.py", line 248, in default_url_fetcher
    timeout=timeout, context=ssl_context)
  File "/usr/lib/python3.7/urllib/request.py", line 222, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/lib/python3.7/urllib/request.py", line 525, in open
    response = self._open(req, data)
  File "/usr/lib/python3.7/urllib/request.py", line 543, in _open
    '_open', req)
  File "/usr/lib/python3.7/urllib/request.py", line 503, in _call_chain
    result = func(*args)
  File "/usr/lib/python3.7/urllib/request.py", line 1362, in https_open
    context=self._context, check_hostname=self._check_hostname)
  File "/usr/lib/python3.7/urllib/request.py", line 1321, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/weasyprint", line 11, in <module>
    load_entry_point('WeasyPrint==51', 'console_scripts', 'weasyprint')()
  File "/usr/lib/python3/dist-packages/weasyprint/__main__.py", line 211, in main
    media_type=args.media_type)
  File "/usr/lib/python3/dist-packages/weasyprint/__init__.py", line 112, in __init__
    with result as (source_type, source, base_url, protocol_encoding):
  File "/usr/lib/python3.7/contextlib.py", line 112, in __enter__
    return next(self.gen)
  File "/usr/lib/python3/dist-packages/weasyprint/__init__.py", line 396, in _select_source
    with result as result:
  File "/usr/lib/python3.7/contextlib.py", line 112, in __enter__
    return next(self.gen)
  File "/usr/lib/python3/dist-packages/weasyprint/__init__.py", line 406, in _select_source
    with fetch(url_fetcher, url) as result:
  File "/usr/lib/python3.7/contextlib.py", line 112, in __enter__
    return next(self.gen)
  File "/usr/lib/python3/dist-packages/weasyprint/urls.py", line 286, in fetch
    raise URLFetchingError('%s: %s' % (type(exc).__name__, str(exc)))
weasyprint.urls.URLFetchingError: URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1076)>


I suggest that the "ca-certificates" should be added into "Depends". When the package ca-certificates is installed, weasyprint works well.

I am using docker image "debian:bullseye":
  PRETTY_NAME="Debian GNU/Linux bullseye/sid"
  NAME="Debian GNU/Linux"
  ID=debian
  Linux b4879d89318d 4.19.76-linuxkit #1 SMP Thu Oct 17 19:31:58 UTC 2019 x86_64 GNU/Linux.


Yours sincerely,
Petr Novak