fix(build): configure bundled CA for binary HTTPS

agentrun.spec

@@ -57,7 +57,7 @@ a = Analysis(
     hiddenimports=[],
     hookspath=[],
     hooksconfig={},
-    runtime_hooks=[],
+    runtime_hooks=['src/agentrun_cli/_utils/pyinstaller_certifi_hook.py'],
     excludes=EXCLUDES,
     noarchive=False,
     optimize=0,

pyproject.toml

@@ -21,6 +21,7 @@ classifiers = [
 
 dependencies = [
     "agentrun-sdk[core]>=0.0.37",
+    "certifi>=2024.0.0",
     "oss2>=2.19.1",
     "pyyaml>=6.0",
     "questionary>=2.0",

src/agentrun_cli/_utils/certificates.py

@@ -0,0 +1,15 @@
+"""Certificate bundle setup for frozen CLI binaries."""
+
+import os
+import sys
+
+import certifi
+
+
+def configure_default_ca_bundle() -> None:
+    """Use the bundled certifi CA file when running as a frozen binary."""
+    if not getattr(sys, "frozen", False):
+        return
+    if os.environ.get("SSL_CERT_FILE"):
+        return
+    os.environ["SSL_CERT_FILE"] = certifi.where()

src/agentrun_cli/_utils/pyinstaller_certifi_hook.py

@@ -0,0 +1,5 @@
+"""PyInstaller runtime hook for bundled CA certificates."""
+
+from agentrun_cli._utils.certificates import configure_default_ca_bundle
+
+configure_default_ca_bundle()

tests/unit/test_certificates.py

@@ -0,0 +1,31 @@
+"""Unit tests for frozen-binary certificate setup."""
+
+from agentrun_cli._utils import certificates
+
+
+class TestConfigureDefaultCaBundle:
+    def test_uses_certifi_for_frozen_binary(self, monkeypatch):
+        monkeypatch.setattr(certificates.sys, "frozen", True, raising=False)
+        monkeypatch.delenv("SSL_CERT_FILE", raising=False)
+        monkeypatch.setattr(certificates.certifi, "where", lambda: "/tmp/cacert.pem")
+
+        certificates.configure_default_ca_bundle()
+
+        assert certificates.os.environ["SSL_CERT_FILE"] == "/tmp/cacert.pem"
+
+    def test_preserves_user_ssl_cert_file(self, monkeypatch):
+        monkeypatch.setattr(certificates.sys, "frozen", True, raising=False)
+        monkeypatch.setenv("SSL_CERT_FILE", "/custom/ca.pem")
+        monkeypatch.setattr(certificates.certifi, "where", lambda: "/tmp/cacert.pem")
+
+        certificates.configure_default_ca_bundle()
+
+        assert certificates.os.environ["SSL_CERT_FILE"] == "/custom/ca.pem"
+
+    def test_skips_regular_python_runtime(self, monkeypatch):
+        monkeypatch.delattr(certificates.sys, "frozen", raising=False)
+        monkeypatch.delenv("SSL_CERT_FILE", raising=False)
+
+        certificates.configure_default_ca_bundle()
+
+        assert "SSL_CERT_FILE" not in certificates.os.environ