gitRepo: Rewrite the "urllib.request.urlopen" patch for Python 3

The old variant is still working but setting "cafile" is deprecated
since version 3.6 [0] and generates a warning:
DeprecationWarning: cafile, capath and cadefault are deprecated, use a custom context instead.

But without this patch "fetchRepoProject" still fails with
"error no host given" (see 337380ea1de).

[0]: https://docs.python.org/3.7/library/urllib.request.html#urllib.request.urlopen

2 files changed, 15 insertions, 3 deletions

diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index f45c841241b..ae8cfb3abc7 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, makeWrapper
-, python3, git, gnupg, less, cacert
+, python3, git, gnupg, less
 }:
 
 stdenv.mkDerivation rec {
@@ -13,13 +13,15 @@ stdenv.mkDerivation rec {
     sha256 = "1a6vyj7a9qba9nidi6x3hkpvpzikskh5jsagzkx7m95p0hcvvb7v";
   };
 
+  patches = [ ./import-ssl-module.patch ];
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ python3 ];
 
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace repo --replace \
       'urllib.request.urlopen(url)' \
-      'urllib.request.urlopen(url, cafile="${cacert}/etc/ssl/certs/ca-bundle.crt")'
+      'urllib.request.urlopen(url, context=ssl.create_default_context())'
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/version-management/git-repo/import-ssl-module.patch b/pkgs/applications/version-management/git-repo/import-ssl-module.patch
new file mode 100644
index 00000000000..783a2c17dee
--- /dev/null
+++ b/pkgs/applications/version-management/git-repo/import-ssl-module.patch
@@ -0,0 +1,10 @@
+--- a/repo	2020-02-05 21:11:52.773854798 +0100
++++ b/repo	2020-02-05 21:12:34.018329462 +0100
+@@ -137,6 +137,7 @@
+ import stat
+ import subprocess
+ import sys
++import ssl
+ 
+ if sys.version_info[0] == 3:
+   import urllib.request