feat: Add ssl credentials workaround with optional OpenSSL import

.github/workflows/python_ci.yaml

@@ -28,6 +28,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install '.[development]'
+          pip install '.[other]'
           pip install .
 
       - name: Lint

python/lib/sift_py/grpc/transport.py

@@ -24,6 +24,27 @@
 SiftAsyncChannel: TypeAlias = grpc_aio.Channel
 
 
+def get_ssl_credentials() -> grpc.ChannelCredentials:
+    """
+    Returns SSL credentials for use with gRPC.
+    Workaround for this issue: https://github.com/grpc/grpc/issues/29682
+    """
+    try:
+        import ssl
+
+        from OpenSSL import crypto
+
+        ssl_context = ssl.create_default_context()
+        certs_der = ssl_context.get_ca_certs(binary_form=True)
+        certs_x509 = [crypto.load_certificate(crypto.FILETYPE_ASN1, x) for x in certs_der]
+        certs_pem = [crypto.dump_certificate(crypto.FILETYPE_PEM, x) for x in certs_x509]
+        certs_bytes = b"".join(certs_pem)
+
+        return grpc.ssl_channel_credentials(certs_bytes)
+    except ImportError:
+        return grpc.ssl_channel_credentials()
+
+
 def use_sift_channel(
     config: SiftChannelConfig, metadata: Optional[Dict[str, Any]] = None
 ) -> SiftChannel:
@@ -41,7 +62,7 @@ def use_sift_channel(
     if not use_ssl:
         return _use_insecure_sift_channel(config, metadata)
 
-    credentials = grpc.ssl_channel_credentials()
+    credentials = get_ssl_credentials()
     options = _compute_channel_options(config)
     api_uri = _clean_uri(config["uri"], use_ssl)
     channel = grpc.secure_channel(api_uri, credentials, options)
@@ -63,7 +84,7 @@ def use_sift_async_channel(
 
     return grpc_aio.secure_channel(
         target=_clean_uri(config["uri"], use_ssl),
-        credentials=grpc.ssl_channel_credentials(),
+        credentials=get_ssl_credentials(),
         options=_compute_channel_options(config),
         interceptors=_compute_sift_async_interceptors(config, metadata),
     )

python/pyproject.toml

@@ -60,6 +60,11 @@ build = [
   "pdoc==14.5.0",
   "build==1.2.1",
 ]
+other = [
+  "pyOpenSSL<24.0.0",
+  "types-pyOpenSSL<24.0.0",
+  "cffi~=1.14",
+]
 
 [build-system]
 requires = ["setuptools"]

python/scripts/dev

@@ -31,6 +31,7 @@ pip_install() {
   source venv/bin/activate
   pip install '.[development]'
   pip install '.[build]'
+  pip install '.[other]'
   pip install -e .
 }