Replaced boto certificate

third_party/gsutil/oauth2_plugin/oauth2_client.py

Index: third_party/gsutil/oauth2_plugin/oauth2_client.py
diff --git a/third_party/gsutil/oauth2_plugin/oauth2_client.py b/third_party/gsutil/oauth2_plugin/oauth2_client.py
index 84c74c87c76f539abb033674424a29e0fb397ed0..c8cb01c4b7e94a9c29911ca5730d0f71d23b1676 100644
--- a/third_party/gsutil/oauth2_plugin/oauth2_client.py
+++ b/third_party/gsutil/oauth2_plugin/oauth2_client.py
@@ -65,9 +65,6 @@ LOG = logging.getLogger('oauth2_client')
 # operation doesn't attempt concurrent refreshes.
 token_exchange_lock = threading.Lock()
 
-# SHA1 sum of the CA certificates file imported from boto.
-CACERTS_FILE_SHA1SUM = 'ed024a78d9327f8669b3b117d9eac9e3c9460e9b'

[ghost stip (do not use), 2014/03/28 21:17:03]

instead of removing, shouldn't we just switch it to the modified sha?

[Ryan Tseng, 2014/03/28 21:32:35]

In theory - yes.
But I'm not sure why we should even bother checking if the CA cert is correct.
From a security standpoint, anyone who has access to the cert file can also
change this sha1 sum, so we don't really gain anything.

[pgervais, 2014/03/28 22:10:18]

Plus replacing the certificates for developers should be as easy as possible. I
was very surprised by the very existence of this check. It sort of makes sense
for the upstream project, but not here.

-
 class Error(Exception):
   """Base exception for the OAuth2 module."""
   pass
@@ -298,15 +295,6 @@ class OAuth2Client(object):
         os.path.dirname(os.path.abspath(cacerts.__file__)), 'cacerts.txt')
 
     if url_opener is None:
-      # Check that the cert file distributed with boto has not been tampered
-      # with.
-      h = sha1()
-      h.update(file(self.ca_certs_file).read())
-      actual_sha1 = h.hexdigest()
-      if actual_sha1 != CACERTS_FILE_SHA1SUM:
-        raise Error(
-            'CA certificates file does not have expected SHA1 sum; '
-            'expected: %s, actual: %s' % (CACERTS_FILE_SHA1SUM, actual_sha1))
       # TODO(Google): set user agent?
       url_opener = urllib2.build_opener(
           fancy_urllib.FancyProxyHandler(),