Patch certifi to use environ for passing cert

Author: uranusjr

src/pip/_vendor/certifi/core.py

@@ -8,7 +8,21 @@
 """
 import os
 
+
+class _PipPatchedCertificate(Exception):
+    pass
+
+
 try:
+    # Return a certificate file on disk for a standalone pip zipapp running in
+    # an isolated build environment to use. Passing --cert to the standalone
+    # pip does not work since requests calls where() unconditionally on import.
+    _PIP_STANDALONE_CERT = os.environ.get("_PIP_STANDALONE_CERT")
+    if _PIP_STANDALONE_CERT:
+        def where():
+            return _PIP_STANDALONE_CERT
+        raise _PipPatchedCertificate()
+
     from importlib.resources import path as get_path, read_text
 
     _CACERT_CTX = None
@@ -38,6 +52,8 @@ def where():
 
         return _CACERT_PATH
 
+except _PipPatchedCertificate:
+    pass
 
 except ImportError:
     # This fallback will work for Python versions prior to 3.7 that lack the

tools/vendoring/patches/certifi.patch

@@ -1,13 +1,41 @@
 diff --git a/src/pip/_vendor/certifi/core.py b/src/pip/_vendor/certifi/core.py
-index 5d2b8cd32..8987449f6 100644
+index 5d2b8cd32..b8140cf1a 100644
 --- a/src/pip/_vendor/certifi/core.py
 +++ b/src/pip/_vendor/certifi/core.py
-@@ -33,7 +33,7 @@ try:
+@@ -8,7 +8,21 @@ This module returns the installation location of cacert.pem or its contents.
+ """
+ import os
+ 
++
++class _PipPatchedCertificate(Exception):
++    pass
++
++
+ try:
++    # Return a certificate file on disk for a standalone pip zipapp running in
++    # an isolated build environment to use. Passing --cert to the standalone
++    # pip does not work since requests calls where() unconditionally on import.
++    _PIP_STANDALONE_CERT = os.environ.get("_PIP_STANDALONE_CERT")
++    if _PIP_STANDALONE_CERT:
++        def where():
++            return _PIP_STANDALONE_CERT
++        raise _PipPatchedCertificate()
++
+     from importlib.resources import path as get_path, read_text
+ 
+     _CACERT_CTX = None
+@@ -33,11 +47,13 @@ try:
              # We also have to hold onto the actual context manager, because
              # it will do the cleanup whenever it gets garbage collected, so
              # we will also store that at the global level as well.
 -            _CACERT_CTX = get_path("certifi", "cacert.pem")
 +            _CACERT_CTX = get_path("pip._vendor.certifi", "cacert.pem")
              _CACERT_PATH = str(_CACERT_CTX.__enter__())
-
+ 
          return _CACERT_PATH
+ 
++except _PipPatchedCertificate:
++    pass
+ 
+ except ImportError:
+     # This fallback will work for Python versions prior to 3.7 that lack the