fix(certifi): 改用最新 CertifiFixer 发布包修复证书

Author: PencilMario

.github/workflows/release.yml

@@ -102,6 +102,34 @@ jobs:
         mkdir -p game/Submods
         cp -R "$dependency_source" game/Submods/
 
+    - name: Download CertifiFixer dependency
+      if: steps.get_version.outputs.is_development == 'false' && steps.check_release.outputs.create_release == 'true'
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        dependency_tmp_dir="$(mktemp -d)"
+        trap 'rm -rf "$dependency_tmp_dir"' EXIT
+
+        gh release download --repo MAS-Submod-MoyuTeam/mas_certifi_fixer \
+          --pattern "CertifiFixer-*.zip" --dir "$dependency_tmp_dir"
+        dependency_archive="$(find "$dependency_tmp_dir" -maxdepth 1 -type f -name 'CertifiFixer-*.zip' -print -quit)"
+        if [ -z "$dependency_archive" ]; then
+          echo "CertifiFixer release archive was not found" >&2
+          exit 1
+        fi
+
+        mkdir -p "$dependency_tmp_dir/extracted"
+        unzip -q "$dependency_archive" -d "$dependency_tmp_dir/extracted"
+        dependency_source="$dependency_tmp_dir/extracted/game/Submods/CertifiFixer"
+        for filename in certifi_fixer.rpy certifi/core.py certifi/__init__.py certifi/cacert.pem; do
+          if [ ! -f "$dependency_source/$filename" ]; then
+            echo "CertifiFixer release is missing $filename" >&2
+            exit 1
+          fi
+        done
+
+        cp -R "$dependency_source" game/Submods/
+
     - name: Copy documentation into submod package
       if: steps.get_version.outputs.is_development == 'false' && steps.check_release.outputs.create_release == 'true'
       run: |

docs/codex/certificate-repair-risk.md

@@ -1,23 +1,17 @@
-# Certifi 修复流程风险记录
-
-## 位置
-
-- `game/Submods/MAICA_ChatSubmod/api.rpy`：`maica_download_certifi_files`（约 259-305 行）及其后台启动函数。
-- `game/Submods/MAICA_ChatSubmod/api.rpy`：`start_maica` 对 `mas_can_import.certifi()` 的检测和触发逻辑。
-
-## 原因
-
-部分设备，尤其是某些 Ren'Py/Android 运行环境，Ren'Py 内置 Python 无法正确读取设备根证书或 MAS 提供的 certifi 包。没有可信根证书时，客户端无法同时做到“从网络获取修复材料”和“验证修复材料来源”这两个条件；因此不存在在当前运行环境内完全安全的自修复方案。
-
-当前流程在证书异常时使用 `verify=False` 下载 Python 源码和 CA bundle，先尝试 GitHub raw，再 fallback 到明文 HTTP 镜像，并直接覆盖本地 `certifi` 文件。该流程属于兼容性兜底，不是可信供应链更新机制。
-
-## 影响范围
-
-- **供应链完整性**：TLS 验证被禁用，镜像或链路被篡改可能导致任意 Python 代码或证书内容写入游戏目录。
-- **运行时稳定性**：下载到错误版本或截断文件会使后续 HTTPS、导入或启动失败。
-- **凭据与隐私**：修复失败后可能继续切换到普通连接节点，风险见 [`plaintext-provider-fallback.md`](plaintext-provider-fallback.md)。
-- **更新一致性**：文件来自 moving `master`/镜像，不与当前子模组版本绑定。
-
-## 本次处理边界
-
-本次仍不替换下载源、不改变 `verify=False` 行为，仅补齐 fallback provider 的运行时同步，并在后台修复完成后重新检查可用性。任何进一步整改都应先确定设备信任根、签名/哈希校验、原子替换和回滚方案，再单独评审。
+# Certifi 修复流程
+
+MAICA 声明 `CertifiFixer` 为模组依赖，并在发布构建时获取它的最新 Release，
+加入发布包的 `game/Submods/CertifiFixer/`；本仓库不保存其源码。其 `init -100` 脚本在 MAS
+无法导入 `certifi` 时，将随包的 `core.py`、`__init__.py` 和 `cacert.pem` 复制到
+`game/python-packages/certifi/`。文件在游戏启动阶段被直接覆盖，修复后可能需要
+重启游戏，让 MAS 重新加载模块。
+
+MAICA 在 `game/Submods/MAICA_ChatSubmod/api.rpy` 的 `start_maica()` 中重新调用
+`store.mas_can_import.certifi()`；只有仍无法导入时才切换到 provider 2。MAICA
+不再通过后台线程从网络下载修复文件。
+
+随包文件需要与受支持的 MAS / Ren'Py Python 版本保持兼容。复制过程没有备份或
+回滚；若依赖复制后导入仍失败，MAICA 会切换 provider 2。目标目录不可写等
+未被 CertifiFixer 捕获的复制异常可能中断游戏初始化。
+该节点的传输方式取决于远端节点列表，详见
+[`plaintext-provider-fallback.md`](plaintext-provider-fallback.md)。

game/Submods/MAICA_ChatSubmod/api.rpy

@@ -612,90 +612,13 @@ init 5 python in maica:
 
         return maica_setting_pane_cache
 
-    maica_certifi_download_thread_running = False
-
     def maica_set_plain_provider():
         store.persistent.maica_setting_dict['provider_id'] = 2
         try:
             store.maica.maica_instance.provider_id = 2
         except Exception as e:
             store.mas_submod_utils.submod_log.error("MAICA: failed to apply fallback provider: {}".format(e))
 
-    def maica_download_certifi_files(fix_certifi, basedir, android, android_masbase):
-        global maica_certifi_download_thread_running
-        try:
-            import requests
-            failed = False
-            if fix_certifi:
-                try:
-                    store.mas_submod_utils.submod_log.warning("Certifi broken, try to fix it")
-                    try:
-                        res = requests.get("https://raw.githubusercontent.com/Monika-After-Story/MonikaModDev/master/Monika%20After%20Story/game/python-packages/certifi/core.py", verify=False, timeout=5)
-                        res2 = requests.get("https://raw.githubusercontent.com/Monika-After-Story/MonikaModDev/master/Monika%20After%20Story/game/python-packages/certifi/__init__.py", verify=False, timeout=5)
-                    except:
-                        store.mas_submod_utils.submod_log.warning("Download from github mirror failed, try to download from 0721play")
-                        res = requests.get("http://sp2.0721play.icu/d/MAS/%E6%89%A9%E5%B1%95%E5%86%85%E5%AE%B9/%E5%AD%90%E6%A8%A1%E7%BB%84/0.12/Github%E5%AD%90%E6%A8%A1%E7%BB%84/MAICA%20%E5%85%89%E8%80%80%E4%B9%8B%E5%9C%B0/core.py", verify=False, timeout=5)
-                        res2 = requests.get("http://sp2.0721play.icu/d/MAS/%E6%89%A9%E5%B1%95%E5%86%85%E5%AE%B9/%E5%AD%90%E6%A8%A1%E7%BB%84/0.12/Github%E5%AD%90%E6%A8%A1%E7%BB%84/MAICA%20%E5%85%89%E8%80%80%E4%B9%8B%E5%9C%B0/__init__.py", verify=False, timeout=5)
-
-                    if res.status_code == 200 and res2.status_code == 200:
-                        with open(os.path.normpath(os.path.join(basedir, "game", "python-packages", "certifi","core.py")), "wb") as file:
-                            file.write(res.content)
-                            store.mas_submod_utils.submod_log.info("MAICA: certifi core.py fixed")
-
-                        with open(os.path.normpath(os.path.join(basedir, "game", "python-packages", "certifi", "__init__.py")), "wb") as file:
-                            file.write(res2.content)
-                            store.mas_submod_utils.submod_log.info("MAICA: certifi __init__.py fixed")
-                        store.maica.maica_instance.disable(
-                            store.maica.maica_instance.MaicaAiStatus.CERTIFI_RESTART_REQUIRED,
-                            sticky=True,
-                        )
-
-                    else:
-                        store.mas_submod_utils.submod_log.error("MAICA: certifi core.py download failed, HTTP code：core{} init{}".format(res.status_code, res2.status_code))
-                        failed = True
-                except Exception as e:
-                    store.mas_submod_utils.submod_log.error("MAICA: certifi core.py download failed: {}".format(e))
-                    failed = True
-
-            url = "https://gitee.com/mirrors/python-certifi/raw/master/certifi/cacert.pem"
-            try:
-                response = requests.get(url, verify=False, timeout=5)
-                if response.status_code == 200:
-                    path = os.path.join(basedir, "game", "python-packages", "certifi", "cacert.pem") if not android else os.path.join(android_masbase, "game", "python-packages", "certifi", "cacert.pem")
-                    with open(path, "wb") as file:
-                        file.write(response.content)
-                    store.mas_submod_utils.submod_log.info("MAICA: cacert.pem downloaded use gitee mirror")
-                else:
-                    store.mas_submod_utils.submod_log.error("MAICA: cacert download failed with gitee mirror, HTTP code：{}".format(response.status_code))
-                    failed = True
-            except Exception as e:
-                store.mas_submod_utils.submod_log.error("MAICA: cacert download failed with gitee mirror: {}".format(e))
-                failed = True
-
-            if failed:
-                maica_set_plain_provider()
-            else:
-                check_accessibility()
-        finally:
-            maica_certifi_download_thread_running = False
-
-    def maica_start_certifi_download_in_background(fix_certifi):
-        global maica_certifi_download_thread_running
-        if maica_certifi_download_thread_running:
-            store.mas_submod_utils.submod_log.info("MAICA: certifi download already running")
-            return
-
-        maica_certifi_download_thread_running = True
-        basedir = renpy.config.basedir
-        android = renpy.android
-        android_masbase = store.ANDROID_MASBASE if android else None
-        store.mas_submod_utils.submod_log.info("MAICA: certifi download started in background")
-        try:
-            renpy.invoke_in_thread(lambda: maica_download_certifi_files(fix_certifi, basedir, android, android_masbase))
-        except Exception as e:
-            maica_certifi_download_thread_running = False
-            store.mas_submod_utils.submod_log.error("MAICA: certifi background download failed to start: {}".format(e))
-
     @store.mas_submod_utils.functionplugin("ch30_preloop", priority=-100)
     def start_maica():
         # 如果从PC迁移到android，切换为plain节点
@@ -716,12 +639,9 @@ init 5 python in maica:
         if store.mas_getAPIKey("Maica_Token") != "":
             store.maica.maica_instance.ciphertext = store.mas_getAPIKey("Maica_Token")
 
-        # certifi修复，仅在MAS原生导入失败时启动
-        certifi_broken = not store.mas_can_import.certifi()
-        if certifi_broken:
+        # CertifiFixer runs during init; retry the MAS import check after it.
+        if not store.mas_can_import.certifi():
             maica_set_plain_provider()
-        if certifi_broken or store.maica_can_update_cacert:
-            maica_start_certifi_download_in_background(certifi_broken)
 
         refresh_setting_pane_cache(force_version=True)
 
@@ -754,18 +674,6 @@ init 5 python in maica:
 
 
 init -700 python:
-    maica_can_update_cacert = False
-    try:
-        import os
-        if not os.path.exists(os.path.normpath(os.path.join(renpy.config.basedir, "game", "python-packages", "certifi", "cacert.pem"))):
-            res = mas_can_import.certifi._update_cert(force=True)
-            if res is None or res < 0:
-                raise RuntimeError("MAS native certifi update failed")
-    except Exception:
-        maica_can_update_cacert = True
-        store.mas_submod_utils.submod_log.warning("MAS native function update cacert failed")
-
-
     import hashlib
 
     def calculate_sha256(file_path):

game/Submods/MAICA_ChatSubmod/header.rpy

@@ -5,7 +5,7 @@ init -990 python:
         name="MAICA Blessland",
         description=_("MAICA Official Submod Frontend"),
         version=maica_ver,
-        dependencies={"Ignore Translation Conflicts": (None, None)},
+        dependencies={"Ignore Translation Conflicts": (None, None), "CertifiFixer": (None, None)},
         settings_pane="maica_setting_pane"
     )
 init -989 python:

tests/test_backend_v13_compat.py

@@ -861,20 +861,14 @@ def test_a_connection_entrypoints_wait_for_shutdown_and_block_mutation():
     )
 
 
-def test_a_certificate_repair_and_version_disable_are_sticky():
+def test_version_disable_is_sticky_and_certifi_fallback_is_conditional():
     api = source("game/Submods/MAICA_ChatSubmod/api.rpy")
-    repair = function_body(api, r"maica_download_certifi_files")
     startup = function_body(api, r"start_maica")
     version_guard = function_body(api, r"check_accessibility")
     provider_refresh = function_body(api, r"refresh_provider_list")
 
     assert "13408" not in api
-    assert repair.count("CERTIFI_RESTART_REQUIRED") == 1
-    assert re.search(
-        r"disable\(\s*.*?CERTIFI_RESTART_REQUIRED\s*,\s*sticky\s*=\s*True",
-        repair,
-        re.S,
-    )
+    assert re.search(r"if not store\.mas_can_import\.certifi\(\):\s*maica_set_plain_provider\(\)", startup)
     assert "check_accessibility()" in startup
     assert re.search(
         r"disable\(\s*.*?VERSION_OLD\s*,\s*sticky\s*=\s*True",

tests/test_certifi_fixer_dependency.py

@@ -0,0 +1,35 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+HEADER = ROOT / "game" / "Submods" / "MAICA_ChatSubmod" / "header.rpy"
+WORKFLOW = ROOT / ".github" / "workflows" / "release.yml"
+DEPENDENCY_REPO = "MAS-Submod-MoyuTeam/mas_certifi_fixer"
+
+
+def test_maica_declares_certifi_fixer_dependency_without_vendoring_it():
+    header = HEADER.read_text(encoding="utf-8")
+
+    assert '"CertifiFixer": (None, None)' in header
+    assert not any(
+        path.is_file()
+        for path in (ROOT / "game" / "Submods" / "CertifiFixer").rglob("*")
+    )
+
+
+def test_release_stages_certifi_fixer_before_creating_package():
+    workflow = WORKFLOW.read_text(encoding="utf-8")
+    download_step = workflow.index("- name: Download CertifiFixer dependency")
+    package_step = workflow.index("- name: Create zip package")
+    dependency_block = workflow[download_step:package_step]
+
+    assert DEPENDENCY_REPO in dependency_block
+    assert 'gh release download' in dependency_block
+    assert '--pattern "CertifiFixer-*.zip"' in dependency_block
+    assert "if: steps.get_version.outputs.is_development == 'false' && steps.check_release.outputs.create_release == 'true'" in dependency_block
+    assert "unzip -q" in dependency_block
+    assert "game/Submods/CertifiFixer" in dependency_block
+    for filename in ("certifi_fixer.rpy", "core.py", "__init__.py", "cacert.pem"):
+        assert filename in dependency_block
+    assert 'cp -R "$dependency_source" game/Submods/' in dependency_block
+    assert "exit 1" in dependency_block

tests/test_ignore_translation_conflicts_dependency.py

@@ -13,7 +13,7 @@
 def test_maica_declares_unrestricted_translation_conflicts_dependency():
     header = HEADER.read_text(encoding="utf-8")
 
-    assert 'dependencies={"Ignore Translation Conflicts": (None, None)},' in header
+    assert '"Ignore Translation Conflicts": (None, None)' in header
 
 
 def test_release_stages_dependency_before_creating_package():

tests/test_start_maica_background_download.py

@@ -13,11 +13,14 @@ def _extract_function(source, function_name):
     return source[start:next_def]
 
 
-def test_start_maica_schedules_certifi_download_without_direct_network_io():
-    start_maica = _extract_function(API_RPY.read_text(encoding="utf-8"), "start_maica")
-
-    assert "requests.get(" not in start_maica
-    assert "maica_start_certifi_download_in_background(" in start_maica
+def test_start_maica_rechecks_certifi_after_fixer_then_falls_back_on_failure():
+    source = API_RPY.read_text(encoding="utf-8")
+    start_maica = _extract_function(source, "start_maica")
+
+    assert "if not store.mas_can_import.certifi():\n            maica_set_plain_provider()" in start_maica
+    assert "maica_start_certifi_download_in_background" not in source
+    assert "maica_download_certifi_files" not in source
+    assert "maica_can_update_cacert" not in source
 
 
 def test_start_maica_leaves_topic_reconciliation_to_the_post_migration_hook():