Mercurial certificates not properly configured on macOS

Question

I'm trying to build mercurial on macOS but it seems like the certificates aren't properly configured:

hg clone https://bitbucket.org/MatthewTurk/rockstar
(an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error)
abort: error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)

This problem was solved for Linux by adding the certificate to hgrc, but it doesn't seem to work for macOS. Note that: https://www.mercurial-scm.org/wiki/CACertificates#Mac_OS_X_10.6_and_higher has several suggestions for how to solve this problem, but none of them seem to work. They claim that:

Mercurial 3.2 or later enables the dummy certificate trick by default.

but it doesn't seem to work for our Spack build. When I build mercurial outside of Spack with ananconda python, it works. But when I link to Spack's Python build, it no longer works. Maybe Python isn't built properly either?

该提问来源于开源项目：spack/spack

Answer 1

The relevant section of source code is: https://www.mercurial-scm.org/repo/hg/file/tip/mercurial/sslutil.py#l687

I wonder if it's worth trying to hack this to use the dummy cert or if we should just download a cert and include it as a dependency. Thoughts?