fix for https OpenDAP URLs with linux wheels (issue #1246)

.github/workflows/build_latest.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       PNETCDF_VERSION: 1.12.1
-      NETCDF_VERSION: 4.9.1
+      NETCDF_VERSION: 4.9.2
       NETCDF_DIR: ${{ github.workspace }}/..
       NETCDF_EXTRA_CONFIG: --enable-pnetcdf
       CC: mpicc.mpich

.github/workflows/miniconda.yml

@@ -30,7 +30,7 @@ jobs:
         init-shell: bash
         create-args: >-
           python=${{ matrix.python-version }}
-          numpy cython pip pytest hdf5 libnetcdf cftime zlib
+          numpy cython pip pytest hdf5 libnetcdf cftime zlib certifi
           --channel conda-forge
 
     - name: Install netcdf4-python
@@ -61,7 +61,7 @@ jobs:
         init-shell: bash
         create-args: >-
           python=${{ matrix.python-version }}
-          numpy cython pip pytest mpi4py hdf5=*=mpi* libnetcdf=*=mpi* cftime zlib
+          numpy cython pip pytest mpi4py hdf5=*=mpi* libnetcdf=*=mpi* cftime zlib certifi
           --channel conda-forge
 
     - name: Install netcdf4-python with mpi

Changelog

@@ -1,5 +1,9 @@
  version 1.6.4 (tag v1.6.4rel)
-==============================
+===============================
+ * set path to SSL certificates internally, so https DAP URLs work with wheels
+   (issue #1246, requires nc_rc_set function available starting with netcdf-c
+   4.9.1, plus bugfix in netcdf-c PR #2690).
+   Added certifi as a dependency.
  * Added `isopen` method to `MFDataset` object to check if underlying files are open.
 
  version 1.6.3 (tag v1.6.3rel)

README.md

@@ -10,6 +10,10 @@
 ## News
 For details on the latest updates, see the [Changelog](https://github.com/Unidata/netcdf4-python/blob/master/Changelog).
 
+6/4/2023:  Version [1.6.4](https://pypi.python.org/pypi/netCDF4/1.6.4) released.  Now requires 
+[certifi](https://github.com/certifi/python-certifi) to locate SSL certificates - this allows 
+OpenDAP https URLs to work with linux wheels (issue [#1246](https://github.com/Unidata/netcdf4-python/issues/1246).
+
 3/3/2023:  Version [1.6.3](https://pypi.python.org/pypi/netCDF4/1.6.3) released.
 
 11/15/2022:  Version [1.6.2](https://pypi.python.org/pypi/netCDF4/1.6.2) released. Fix for

include/netCDF4.pxi

@@ -366,6 +366,7 @@ cdef extern from "netcdf.h":
     int nc_inq_enum_member(int ncid, nc_type xtype, int idx, char *name, void *value) nogil
 
     int nc_inq_enum_ident(int ncid, nc_type xtype, long long value, char *identifier) nogil
+    int nc_rc_set(char* key, char* value) nogil
 
 IF HAS_QUANTIZATION_SUPPORT:
     cdef extern from "netcdf.h":

pyproject.toml

@@ -42,6 +42,7 @@ classifiers = [
 ]
 dependencies = [
     "cftime",
+    "certifi",
     "numpy",
 ]
 dynamic = ["version"]

setup.py

@@ -60,6 +60,7 @@ def check_api(inc_dirs,netcdf_lib_version):
     has_blosc = False
     has_ncfilter = False
     has_set_alignment = False
+    has_nc_rc_set = False
 
     for d in inc_dirs:
         try:
@@ -83,6 +84,8 @@ def check_api(inc_dirs,netcdf_lib_version):
                 has_quantize = True
             if line.startswith('nc_set_alignment'):
                 has_set_alignment = True
+            if line.startswith('EXTERNL int nc_rc_set'):
+                has_nc_rc_set = True
 
         if has_nc_open_mem:
             try:
@@ -150,7 +153,8 @@ def check_api(inc_dirs,netcdf_lib_version):
     return has_rename_grp, has_nc_inq_path, has_nc_inq_format_extended, \
            has_cdf5_format, has_nc_open_mem, has_nc_create_mem, \
            has_parallel4_support, has_pnetcdf_support, has_szip_support, has_quantize, \
-           has_zstandard, has_bzip2, has_blosc, has_set_alignment, has_ncfilter
+           has_zstandard, has_bzip2, has_blosc, has_set_alignment, has_ncfilter, \
+           has_nc_rc_set
 
 
 def getnetcdfvers(libdirs):
@@ -564,7 +568,7 @@ def _populate_hdf5_info(dirstosearch, inc_dirs, libs, lib_dirs):
     has_rename_grp, has_nc_inq_path, has_nc_inq_format_extended, \
     has_cdf5_format, has_nc_open_mem, has_nc_create_mem, \
     has_parallel4_support, has_pnetcdf_support, has_szip_support, has_quantize, \
-    has_zstandard, has_bzip2, has_blosc, has_set_alignment, has_ncfilter = \
+    has_zstandard, has_bzip2, has_blosc, has_set_alignment, has_ncfilter, has_nc_rc_set = \
     check_api(inc_dirs,netcdf_lib_version)
     # for netcdf 4.4.x CDF5 format is always enabled.
     if netcdf_lib_version is not None and\
@@ -686,6 +690,13 @@ def _populate_hdf5_info(dirstosearch, inc_dirs, libs, lib_dirs):
         sys.stdout.write('netcdf lib does not have nc_inq_filter_avail function\n')
         f.write('DEF HAS_NCFILTER = 0\n')
 
+    if has_nc_rc_set:
+        sys.stdout.write('netcdf lib has nc_rc_set function\n')
+        f.write('DEF HAS_NCRCSET = 1\n')
+    else:
+        sys.stdout.write('netcdf lib does not have nc_rc_set function\n')
+        f.write('DEF HAS_NCRCSET = 0\n')
+
     f.close()
 
     if has_parallel4_support or has_pnetcdf_support:

src/netCDF4/_netCDF4.pyx

@@ -1,5 +1,5 @@
 """
-Version 1.6.3
+Version 1.6.4
 -------------
 
 # Introduction
@@ -1228,7 +1228,7 @@ from .utils import (_StartCountStride, _quantize, _find_dim, _walk_grps,
 import sys
 import functools
 
-__version__ = "1.6.3"
+__version__ = "1.6.4"
 
 # Initialize numpy
 import posixpath
@@ -1259,14 +1259,28 @@ ELSE:
     ctypedef object Comm
     ctypedef object Info
 
+# set path to SSL certificates (issue #1246)
+IF HAS_NCRCSET: # available starting in version 4.9.1
+    import certifi
+    cdef _set_curl_certpath(certpath):
+        cdef char *cert_path
+        cdef char *key
+        cdef int ierr
+        bytestr = _strencode(certpath)
+        cert_path = bytestr
+        ierr = nc_rc_set("HTTP.SSL.CAINFO",cert_path)
+        if ierr != 0:
+            raise RuntimeError('error setting path to SSL certificates')
+    _set_curl_certpath(certifi.where())
+
 # check for required version of netcdf-4 and hdf5.
 
 def _gethdf5libversion():
     cdef unsigned int majorvers, minorvers, releasevers
     cdef herr_t ierr
     with nogil:
         ierr = H5get_libversion( &majorvers, &minorvers, &releasevers)
-    if ierr < 0:
+    if ierr != 0:
         raise RuntimeError('error getting HDF5 library version info')
     return '%d.%d.%d' % (majorvers,minorvers,releasevers)