From a232472cbe2baf0a328af06a9c23904ed961e68d Mon Sep 17 00:00:00 2001
From: Flowseal <sellyalegium@gmail.com>
Date: Fri, 9 Oct 2026 18:54:03 +0300
Subject: [PATCH] fixes #1422

---
 packaging/linux.spec | 9 +++++----
 proxy/utils.py       | 7 ++++++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/packaging/linux.spec b/packaging/linux.spec
index f4d8d2c..3bf72ee 100644
--- a/packaging/linux.spec
+++ b/packaging/linux.spec
@@ -2,15 +2,14 @@
 
 import os
 import glob
-
-from PyInstaller.utils.hooks import collect_data_files
+import certifi
 
 block_cipher = None
 
 # customtkinter ships JSON themes + assets that must be bundled
 import customtkinter
 ctk_path = os.path.dirname(customtkinter.__file__)
-certifi_datas = collect_data_files('certifi')
+certifi_cafile = certifi.where()
 
 _i18n_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'ui', 'i18n')
 
@@ -25,7 +24,7 @@ a = Analysis(
     [os.path.join(os.path.dirname(SPEC), os.pardir, 'linux.py')],
     pathex=[],
     binaries=appindicator_binaries,
-    datas=[(ctk_path, 'customtkinter/'), (_i18n_path, 'ui/i18n')] + certifi_datas,
+    datas=[(ctk_path, 'customtkinter/'), (_i18n_path, 'ui/i18n')],
     hiddenimports=[
         'httpx',
         'h2',
@@ -63,6 +62,8 @@ a = Analysis(
     cipher=block_cipher,
 )
 
+a.datas += [('certifi/cacert.pem', certifi_cafile, 'DATA')]
+
 _required_libraries = {
     'libglib-2.0.so.0', 'libgobject-2.0.so.0', 'libgio-2.0.so.0',
     'libgtk-3.so.0', 'libappindicator3.so.1',
diff --git a/proxy/utils.py b/proxy/utils.py
index 65a507e..34c9097 100644
--- a/proxy/utils.py
+++ b/proxy/utils.py
@@ -3,7 +3,9 @@ import urllib.request
 import http.client
 import ssl
 import logging
+import os
 import re
+import sys
 
 import certifi
 
@@ -141,7 +143,10 @@ class _PinnedHTTPSHandler(urllib.request.HTTPSHandler):
 
 
 def create_ssl_context(*, check_hostname: bool = True) -> ssl.SSLContext:
-    context = ssl.create_default_context(cafile=certifi.where())
+    bundle_dir = getattr(sys, '_MEIPASS', None)
+    cafile = (os.path.join(bundle_dir, 'certifi', 'cacert.pem')
+              if bundle_dir else certifi.where())
+    context = ssl.create_default_context(cafile=cafile)
     context.load_default_certs()
     context.check_hostname = check_hostname
     return context