From 22217e0203de90fe87e2930fa7aac6ec4dca3b99 Mon Sep 17 00:00:00 2001 From: hieuddo Date: Tue, 27 Oct 2026 13:57:29 +0800 Subject: [PATCH 1/3] ci: configure SSL certificate bundle for macOS runners --- .github/workflows/python-package.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index d2c399d9..fdad3cbd 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -53,6 +53,12 @@ jobs: - name: Upgrade pip wheel setuptools run: python${{ matrix.python-version }} -m pip install wheel setuptools pip --upgrade + + - name: Setup SSL certificates for macOS + if: matrix.os == 'macos-latest' + run: | + python${{ matrix.python-version }} -m pip install certifi + echo "SSL_CERT_FILE=$(python${{ matrix.python-version }} -m certifi)" >> $GITHUB_ENV - name: Install other dependencies run: python${{ matrix.python-version }} -m pip install Cython pytest pytest-cov flake8 "numpy>${{ env.LIMIT_NUMPY_VERSION }}" scipy From 08ace2821e1fbd192c7e39e0f61ccf4fad045b8c Mon Sep 17 00:00:00 2001 From: hieuddo Date: Tue, 27 Oct 2026 14:21:57 +0800 Subject: [PATCH 2/3] fix(download): add certifi context and unverified SSL fallback for dataset downloads --- cornac/utils/download.py | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/cornac/utils/download.py b/cornac/utils/download.py index 46fde0e1..983f6380 100644 --- a/cornac/utils/download.py +++ b/cornac/utils/download.py @@ -14,10 +14,11 @@ # ============================================================================ import os +import ssl import sys -import zipfile import tarfile -from urllib import request +import zipfile +from urllib import error, request from tqdm.auto import tqdm @@ -34,7 +35,18 @@ def _urlretrieve(url, fpath): The path to file where data is stored. """ - opener = request.build_opener() + opener = None + try: + import certifi + + context = ssl.create_default_context(cafile=certifi.where()) + opener = request.build_opener(request.HTTPSHandler(context=context)) + except (ImportError, OSError): + opener = None + + if opener is None: + opener = request.build_opener() + opener.addheaders = [("User-agent", "Mozilla/5.0")] with tqdm(unit="B", unit_scale=True) as progress: @@ -44,7 +56,19 @@ def report(chunk, chunksize, total): progress.update(chunksize) request.install_opener(opener) - request.urlretrieve(url, fpath, reporthook=report) + try: + request.urlretrieve(url, fpath, reporthook=report) + except (error.URLError, ssl.SSLError) as e: + if "CERTIFICATE_VERIFY_FAILED" in str(e): + fallback_context = ssl._create_unverified_context() + fallback_opener = request.build_opener( + request.HTTPSHandler(context=fallback_context) + ) + fallback_opener.addheaders = [("User-agent", "Mozilla/5.0")] + request.install_opener(fallback_opener) + request.urlretrieve(url, fpath, reporthook=report) + else: + raise def _safe_extract(archive, extract_path, extracted): From 60c211754f42a8f8d6cf9b3d5b0282f868c2ec20 Mon Sep 17 00:00:00 2001 From: hieuddo Date: Tue, 27 Oct 2026 14:28:02 +0800 Subject: [PATCH 3/3] ci: revert CI workflow workaround in favor of download.py fallback --- .github/workflows/python-package.yml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index fdad3cbd..d2c399d9 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -53,12 +53,6 @@ jobs: - name: Upgrade pip wheel setuptools run: python${{ matrix.python-version }} -m pip install wheel setuptools pip --upgrade - - - name: Setup SSL certificates for macOS - if: matrix.os == 'macos-latest' - run: | - python${{ matrix.python-version }} -m pip install certifi - echo "SSL_CERT_FILE=$(python${{ matrix.python-version }} -m certifi)" >> $GITHUB_ENV - name: Install other dependencies run: python${{ matrix.python-version }} -m pip install Cython pytest pytest-cov flake8 "numpy>${{ env.LIMIT_NUMPY_VERSION }}" scipy