adds certifi certs to the API calls (#1211)

* adds certifi certs to the API calls

* changelog

Author: normanrz

webknossos/Changelog.md

@@ -17,6 +17,7 @@ For upgrade instructions, please check the respective _Breaking Changes_ section
 ### Added
 
 ### Changed
+- Fixes SSL certificate verification for remote datasets by adding CA certificates using `certifi`. [#1211](https://github.com/scalableminds/webknossos-libs/pull/1211)
 
 ### Fixed
 

webknossos/pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
     "attrs >=22.0.0",
     "boltons >=21.0.0",
     "cattrs >=22.0.0",
+    "certifi>=2023",
     "cluster-tools",
     "fsspec ~=2024.6.0",
     "httpx ~=0.27.0",

webknossos/uv.lock

@@ -61,7 +61,7 @@
     RemoteDataset,
     SegmentationLayer,
 )
-from ..dataset.defaults import PROPERTIES_FILE_NAME
+from ..dataset.defaults import PROPERTIES_FILE_NAME, SSL_CONTEXT
 from ..dataset.properties import DatasetProperties, dataset_converter
 from ..geometry import NDBoundingBox, Vec3Int
 from ..skeleton import Skeleton
@@ -897,6 +897,7 @@ def get_remote_annotation_dataset(self) -> Dataset:
         zarr_path = UPath(
             f"{datastore_url}/data/annotations/zarr/{self.annotation_id}/",
             headers={} if token is None else {"X-Auth-Token": token},
+            ssl=SSL_CONTEXT,
         )
         return Dataset.open(zarr_path)
 

webknossos/webknossos/annotation/annotation.py

@@ -4,6 +4,7 @@
 
 import httpx
 
+from ...dataset.defaults import SSL_CONTEXT
 from ._serialization import custom_converter
 from .errors import CannotHandleResponseError, UnexpectedStatusError
 
@@ -197,6 +198,7 @@ def _request(
                 files=files,
                 headers=self.headers,
                 timeout=timeout_seconds or self.timeout_seconds,
+                verify=SSL_CONTEXT,
             )
             if response.status_code == 200 or response.status_code == 400:
                 # Stop retrying in case of success or bad request

webknossos/webknossos/client/api_client/_abstract_api_client.py

@@ -53,6 +53,7 @@
     DEFAULT_CHUNKS_PER_SHARD_ZARR,
     DEFAULT_DATA_FORMAT,
     PROPERTIES_FILE_NAME,
+    SSL_CONTEXT,
     ZARR_JSON_FILE_NAME,
     ZATTRS_FILE_NAME,
     ZGROUP_FILE_NAME,
@@ -681,6 +682,7 @@ def open_remote(
         zarr_path = UPath(
             f"{datastore_url}/data/zarr/{organization_id}/{dataset_name}/",
             headers={} if token is None else {"X-Auth-Token": token},
+            ssl=SSL_CONTEXT,
         )
         return RemoteDataset(
             zarr_path, dataset_name, organization_id, sharing_token, context_manager

webknossos/webknossos/dataset/dataset.py

@@ -1,4 +1,7 @@
 import os
+import ssl
+
+import certifi
 
 from ..geometry import Vec3Int
 from .data_format import DataFormat
@@ -22,3 +25,4 @@
 ZGROUP_FILE_NAME = ".zgroup"
 ZATTRS_FILE_NAME = ".zattrs"
 ZARR_JSON_FILE_NAME = "zarr.json"
+SSL_CONTEXT = ssl.create_default_context(cafile=certifi.where())