local demo fails on MacOS Python3.11 with CERTIFICATE_VERIFY_FAILED

[peckjon]

For certain out-of-the-box Python installations on MacOS (tested with Python 3.11 on Ventura 13.4.1, and known for Python 3.6 on Sierra), a naive run of the demo streamlit run https://raw.githubusercontent.com/streamlit/demo-uber-nyc-pickups/main/streamlit_app.py will fail, throwing URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed> from /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py line 1391

This is not a problem with the demo per se, but will affect some first user experiences. It occurs because the root certificates shipped with Python are not up-to-date.

Local workaround: run

/Applications/Python\ 3.11/Install\ Certificates.command

Alternative 1: update the demo to ignore SLL failures (only recommended for local testing with known URLs):

ssl._create_default_https_context = ssl._create_unverified_context

Alternative 2: bundle PEM files with the demo and set env (safer, but requires maintenance):

export SSL_CERT_FILE "/some_bundled_path/cacert.pem"
export REQUESTS_CA_BUNDLE = "/some_bundled_path/cacert.pem"