CVE-2013-1630

@@ -1,2 +1,2 @@
 include *.txt *.ini *.cfg *.rst
-recursive-include pyshop *.ico *.png *.css *.scss *.txt *.js *.html *.pot *.po
+recursive-include pyshop *.ico *.png *.css *.scss *.txt *.js *.html *.pot *.po *.pem

@@ -33,7 +33,12 @@ def __call__(self, value, system):
                 if not os.path.exists(dir_):
                     os.makedirs(dir_, 0750)
 
-                resp = requests.get(value['url'])
+                if value['url'].startswith('https://pypi.python.org'):
+                    verify = os.path.join(os.path.dirname(__file__), 'pypi.pem')
+                else:
+                    verify = value['url'].startswith('https:')
+
+                resp = requests.get(value['url'], verify=verify)
                 with open(f, 'wb') as rf:
                     rf.write(resp.content)
                 return resp.content

@@ -6,8 +6,12 @@ def get_release_file(root, request):
     session = DBSession()
 
     f = ReleaseFile.by_id(session, int(request.matchdict['file_id']))
+    url = f.url
+    if url.startswith('http://pypi.python.org'):
+        url = 'https' + url[4:]
+
     rv = {'id': f.id,
-          'url': f.url,
+          'url': url,
           'filename': f.filename,
           }
     f.downloads += 1