Bug 2015326

python-virtualenv 0:15.1.0-4.el7_7 ships a seed pip that vendors requests with a cacert.pem that can not connect to LetsEncrypt sites after the DST Root CA X3 signature expiration (https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/)

Perhaps not many have noticed because pypi will still work -- but any attempts to connect to sites with certs issued by LetsEncrypt will fail.  For example, below I show an example of getting requirements from opendev.

# yum info python-virtualenv
Name        : python-virtualenv
Arch        : noarch
Version     : 15.1.0
Release     : 4.el7_7

# repoquery --list '*python-virtualenv*'
...
/usr/lib/python2.7/site-packages/virtualenv_support/pip-9.0.1-py2.py3-none-any.whl
...

# virtualenv /tmp/venv
....

# /tmp/venv/bin/pip install --constraint https://opendev.org/openstack/requirements/raw/stable/stein/upper-constraints.txt --upgrade pip setuptools wheel
Exception:
Traceback (most recent call last):
  File "/tmp/venv/lib/python2.7/site-packages/pip/basecommand.py", line 215, in main
    status = self.run(options, args)
  File "/tmp/venv/lib/python2.7/site-packages/pip/commands/install.py", line 312, in run
    wheel_cache
  File "/tmp/venv/lib/python2.7/site-packages/pip/basecommand.py", line 269, in populate_requirement_set
    session=session, wheel_cache=wheel_cache):
  File "/tmp/venv/lib/python2.7/site-packages/pip/req/req_file.py", line 84, in parse_requirements
    filename, comes_from=comes_from, session=session
  File "/tmp/venv/lib/python2.7/site-packages/pip/download.py", line 417, in get_file_content
    resp = session.get(url)
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 510, in get
    return self.request('GET', url, **kwargs)
  File "/tmp/venv/lib/python2.7/site-packages/pip/download.py", line 386, in request
    return super(PipSession, self).request(method, url, *args, **kwargs)
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 497, in request
    resp = self.send(prep, **send_kwargs)
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 639, in send
    history = [resp for resp in gen] if allow_redirects else []
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 203, in resolve_redirects
    **adapter_kwargs
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/sessions.py", line 618, in send
    r = adapter.send(request, **kwargs)
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/cachecontrol/adapter.py", line 47, in send
    resp = super(CacheControlAdapter, self).send(request, **kw)
  File "/tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/adapters.py", line 497, in send
    raise SSLError(e, request=request)
SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:618)
You are using pip version 9.0.1, however version 21.3 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.

# ls -l /tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/cacert.pem
-rw-r--r--. 1 root root 344712 Oct 18 23:05 /tmp/venv/lib/python2.7/site-packages/pip/_vendor/requests/cacert.pem