fixes #1422

packaging/linux.spec

@@ -2,15 +2,14 @@
 
 import os
 import glob
-
+import certifi
-from PyInstaller.utils.hooks import collect_data_files
 
 block_cipher = None
 
 # customtkinter ships JSON themes + assets that must be bundled
 import customtkinter
 ctk_path = os.path.dirname(customtkinter.__file__)
-certifi_datas = collect_data_files('certifi')
+certifi_cafile = certifi.where()
 
 _i18n_path = os.path.join(os.path.dirname(SPEC), os.pardir, 'ui', 'i18n')
 
@@ -25,7 +24,7 @@ a = Analysis(
     [os.path.join(os.path.dirname(SPEC), os.pardir, 'linux.py')],
     pathex=[],
     binaries=appindicator_binaries,
-    datas=[(ctk_path, 'customtkinter/'), (_i18n_path, 'ui/i18n')] + certifi_datas,
+    datas=[(ctk_path, 'customtkinter/'), (_i18n_path, 'ui/i18n')],
     hiddenimports=[
         'httpx',
         'h2',
@@ -63,6 +62,8 @@ a = Analysis(
     cipher=block_cipher,
 )
 
+a.datas += [('certifi/cacert.pem', certifi_cafile, 'DATA')]
+
 _required_libraries = {
     'libglib-2.0.so.0', 'libgobject-2.0.so.0', 'libgio-2.0.so.0',
     'libgtk-3.so.0', 'libappindicator3.so.1',

proxy/utils.py

@@ -3,7 +3,9 @@ import urllib.request
 import http.client
 import ssl
 import logging
+import os
 import re
+import sys
 
 import certifi
 
@@ -141,7 +143,10 @@ class _PinnedHTTPSHandler(urllib.request.HTTPSHandler):
 
 
 def create_ssl_context(*, check_hostname: bool = True) -> ssl.SSLContext:
-    context = ssl.create_default_context(cafile=certifi.where())
+    bundle_dir = getattr(sys, '_MEIPASS', None)
+    cafile = (os.path.join(bundle_dir, 'certifi', 'cacert.pem')
+              if bundle_dir else certifi.where())
+    context = ssl.create_default_context(cafile=cafile)
     context.load_default_certs()
     context.check_hostname = check_hostname
     return context