Fatal ssl.SSLCertVerificationError when running pyright after new install from pip

[jonmooser]

I originally posted this to the pyright project (microsoft/pyright#5909). The moderator directed me to this project.

python 3.11
MacOS Monterey 12.3.1
pyright 1.1.326

After installing pyright using pip, I tried to run on the command line and got the error below. It could because the pyrightconfig.json is not configured correctly, but I don't see anything obvious there that would cause this bug.

Also note that in the example below I don't specify a source file, but the same error appears if I do

> pip install pyright
> pyright

/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/nodeenv.py:26: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1282, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1328, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1277, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1037, in _send_output
    self.send(msg)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 975, in send
    self.connect()
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/ssl.py", line 517, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/ssl.py", line 1075, in _create
    self.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/nodeenv.py", line 1540, in <module>
    main()
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/nodeenv.py", line 1111, in main
    args.node = get_last_stable_node_version()
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/nodeenv.py", line 1044, in get_last_stable_node_version
    return _get_versions_json()[0]['version'].lstrip('v')
           ^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/nodeenv.py", line 1020, in _get_versions_json
    response = urlopen('%s/index.json' % src_base_url)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/nodeenv.py", line 640, in urlopen
    return urllib2.urlopen(req)
           ^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 519, in open
    response = self._open(req, data)
               ^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)>
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.11/bin/pyright", line 8, in <module>
    sys.exit(entrypoint())
             ^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/cli.py", line 34, in entrypoint
    sys.exit(main(sys.argv[1:]))
             ^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/cli.py", line 19, in main
    return run(*args, **kwargs).returncode
           ^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/cli.py", line 25, in run
    pkg_dir = install_pyright(args, quiet=None)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/_utils.py", line 61, in install_pyright
    node.run(
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/node.py", line 103, in run
    binary = _ensure_available(target)
             ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/node.py", line 38, in _ensure_available
    return Binary(path=_ensure_node_env(target), strategy=Strategy.NODEENV)
                       ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/node.py", line 65, in _ensure_node_env
    _install_node_env()
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/pyright/node.py", line 96, in _install_node_env
    subprocess.run(args, check=True)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/subprocess.py", line 569, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11', 

[d33m00n]

brew install node@18 helped

[Avasam]

This has been raised as an issue from a dev in python/typeshed#11575 (review) as well.

It may or may not be related to ekalinin/nodeenv#316 (comment) and ekalinin/nodeenv#331 (comment)

[eloj]

This is mostly a FYI I guess, but I'm getting this same error on a fully up to date MSYS2 installation:

$ python3 --version
Python 3.11.9
$ python3 -m venv pydev
$ source pydev/bin/activate
$ pip install pyright
Collecting pyright
  Downloading pyright-1.1.363-py3-none-any.whl.metadata (6.2 kB)
Collecting nodeenv>=1.6.0 (from pyright)
  Downloading nodeenv-1.8.0-py2.py3-none-any.whl.metadata (21 kB)
Requirement already satisfied: setuptools in c:/dev/msys64/home/me/dev/pydev/pydev/lib/python3.11/site-packages (from nodeenv>=1.6.0->pyright) (65.5.0)
Downloading pyright-1.1.363-py3-none-any.whl (18 kB)
Downloading nodeenv-1.8.0-py2.py3-none-any.whl (22 kB)
Installing collected packages: nodeenv, pyright
Successfully installed nodeenv-1.8.0 pyright-1.1.363
$ pyright
C:/dev/msys64/home/me/dev/pydev/pydev/lib/python3.11/site-packages/nodeenv.py:26: DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13
  import pipes
....
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)

I thought that perhaps installing python-certifi on the system level could be a solution. It was not.

I also tried to install it into the venv which also didn't change anything.

$ pip install certifi
...
Successfully installed certifi-2024.2.2
$ python3 -m certifi
C:/dev/msys64/home/me/dev/pydev/lib/python3.11/site-packages/certifi/cacert.pem

[RobertCraigie]

I'm going to close this issue as I believe this should only happen when making requests to the nodejs servers and the next release will add nodejs-wheel as an alternative to nodeenv which should be more reliable.

You can try it out today with

python -m pip install 'git+https://github.com/RobertCraigie/pyright-python.git#egg=pyright[nodejs]'

When released, it will be

pip install pyright[nodejs]

Please let me know if you run into any issues with this new setup.