certificate test of version script fails with newest certifi 2026.6.17
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	Xqt
	Jun 26 2026, 7:56 AM

Project Tags

Referenced Files

None

Subscribers

Aklapper

pywikibot-bugs-list

Xqt

Description

version certificate tests gives

requests version: 2.32.5
  cacerts: C:\Python\Python313\Lib\site-packages\certifi\cacert.pem
    certificate test: not ok

for the newest certifi package. It works with certifi==2024.8.30.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	[bugfix] Remove obsolete WMF_CACERT legacy check	Zaidusyy	pywikibot/core	master	+0 -12

Customize query in gerrit

Related Objects

Mentioned Here: T97392: Pywikibot error when using category.py

Event Timeline

Xqt created this task.Jun 26 2026, 7:56 AM

Restricted Application added subscribers: pywikibot-bugs-list, Aklapper. · View Herald TranscriptJun 26 2026, 7:56 AM

Xqt triaged this task as Medium priority.Jun 26 2026, 7:56 AM

Xqt changed the subtype of this task from "Task" to "Bug Report".

Xqt updated the task description. (Show Details)Jun 26 2026, 9:20 AM

The issue is not a TLS failure. HTTPS to Wikimedia works correctly with certifi==2026.6.17.

The failure is caused by a legacy check that searches for a specific PEM substring (WMF_CACERT pattern in version.py) which is no longer present in the current CA bundle.

The current certificate chain for Wikimedia is:

*.wikipedia.org
Let's Encrypt (YE1)
ISRG Root X2

Since this chain is valid and trusted by modern certifi (via ISRG Root X2), the original certificate check is no longer meaningful and can be removed.

See the version.py implementation.

Xqt added a project: good first task.Jun 26 2026, 9:43 AM

Thank you for tagging this task with good first task for Wikimedia newcomers!

Newcomers often may not be aware of things that may seem obvious to seasoned contributors, so please take a moment to reflect on how this task might look to somebody who has never contributed to Wikimedia projects.

A good first task is a self-contained, non-controversial task with a clear approach. It should be well-described with pointers to help a completely new contributor, for example it should clearly point to the codebase URL and provide clear steps to help a contributor get set up for success. We've included some guidelines at https://phabricator.wikimedia.org/tag/good_first_task/ !

Thank you for helping us drive new contributions to our projects <3

Zaidusyy claimed this task.Jun 26 2026, 2:49 PM

Change #1305916 had a related patch set uploaded (by Zaidusyy; author: Zaidusyy):

[pywikibot/core@master] [bugfix] Remove obsolete WMF_CACERT legacy check

https://gerrit.wikimedia.org/r/1305916

gerritbot added a project: Patch-For-Review.Jun 26 2026, 3:04 PM

Thank you @Zaidusyy. Please add yourself to the AUTHORS.rst file if not already done.

Xqt closed this task as Resolved.Jun 26 2026, 3:38 PM

Change #1305916 merged by Xqt:

[pywikibot/core@master] [bugfix] Remove obsolete WMF_CACERT legacy check

https://gerrit.wikimedia.org/r/1305916

Maintenance_bot removed a project: Patch-For-Review.Jun 26 2026, 4:30 PM

Zaidusyy added a project: RoadToWiki.Fri, Jul 17, 7:12 PM

Zaidusyy moved this task from Incoming to Completed on the RoadToWiki board.Fri, Jul 17, 7:48 PM

certificate test of version script fails with newest certifi 2026.6.17Closed, ResolvedPublicBUG REPORTActions

Description

Details

Related Objects

Event Timeline

certificate test of version script fails with newest certifi 2026.6.17
Closed, ResolvedPublicBUG REPORT
Actions