Fix SSL cert verification in PyInstaller binaries via certifi

PyInstaller-bundled Python cannot find system CA certs on Linux/macOS.
Use certifi's bundled CA bundle for all GitHub API requests.

https://claude.ai/code/session_01MqEqGhP1guGx5VuFsLaws2

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: pip install pyinstaller click pyyaml
+        run: pip install pyinstaller click pyyaml certifi
 
       - name: Build binary
         run: pyinstaller --onefile --name mdcms mdcms.py

mdcms.py

@@ -10,10 +10,13 @@
 import json
 import os
 import re
+import ssl
 import urllib.error
 import urllib.request
 from pathlib import Path
 
+import certifi
+
 import click
 import yaml
 
@@ -434,7 +437,8 @@ def _github_get(url: str) -> bytes:
             "Accept": "application/vnd.github.v3+json",
         },
     )
-    with urllib.request.urlopen(req, timeout=15) as resp:
+    ctx = ssl.create_default_context(cafile=certifi.where())
+    with urllib.request.urlopen(req, timeout=15, context=ctx) as resp:
         return resp.read()
 
 

pyproject.toml

@@ -13,6 +13,7 @@ requires-python = ">=3.9"
 dependencies = [
     "click>=8.0",
     "PyYAML>=6.0",
+    "certifi>=2024.0",
 ]
 
 [project.scripts]