Python虚拟环境SSL证书验证失败，安装证书遇权限问题求助

在VS Code的Python虚拟环境（venv_x86，基于Python3.11）中执行音频处理命令时出现以下问题：

1. 执行allin1命令无法下载Demucs预训练模型，触发SSL证书验证错误
2. 运行Python官方证书安装脚本时遭遇权限拒绝
3. 系统环境中Python3.11与pip版本不匹配，升级certifi未解决问题

模型下载错误日志 #

(venv_x86) aryandaga@Aryans-MacBook-Pro-2 AI-DJ % allin1 data/audio_samples/ATMOSPHERE\ -\ FISHER\ x\ KITA\ ALEXANDER.mp3
=> Found 0 tracks already analyzed and 1 tracks to analyze.
=> Found 0 tracks already demixed, 1 to demix.
Downloading: "https://dl.fbaipublicfiles.com/demucs/hybrid_transformer/955717e8-8726e21a.th" to /Users/aryandaga/.cache/torch/hub/checkpoints/955717e8-8726e21a.th
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1282, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1328, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1277, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1037, in _send_output
    self.send(msg)
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 975, in send
    self.connect()
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/http/client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/ssl.py", line 517, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/ssl.py", line 1075, in _create
    self.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/separate.py", line 219, in <module>
    main()
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/separate.py", line 133, in main
    model = get_model_from_args(args)
            ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/pretrained.py", line 96, in get_model_from_args
    return get_model(name=args.name, repo=args.repo)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/pretrained.py", line 76, in get_model
    model = any_repo.get_model(name)
            ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/repo.py", line 148, in get_model
    return self.bag_repo.get_model(name_or_sig)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/repo.py", line 130, in get_model
    models = [self.model_repo.get_model(sig) for sig in signatures]
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/repo.py", line 130, in <listcomp>
    models = [self.model_repo.get_model(sig) for sig in signatures]
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/demucs/repo.py", line 65, in get_model
    pkg = torch.hub.load_state_dict_from_url(
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/torch/hub.py", line 766, in load_state_dict_from_url
    download_url_to_file(url, cached_file, hash_prefix, progress=progress)
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/torch/hub.py", line 620, in download_url_to_file
    u = urlopen(req)
        ^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 519, in open
    response = self._open(req, data)
               ^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 496, in _call_chain
    result = func(*args)
             ^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/urllib/request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)>
Traceback (most recent call last):
  File "/Users/aryandaga/AI-DJ/venv_x86/bin/allin1", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/allin1/cli.py", line 53, in main
    analyze(
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/allin1/analyze.py", line 118, in analyze
    demix_paths = demix(todo_paths, demix_dir, device)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/aryandaga/AI-DJ/venv_x86/lib/python3.11/site-packages/allin1/demix.py", line 30, in demix
    subprocess.run(
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/subprocess.py", line 569, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/Users/aryandaga/AI-DJ/venv_x86/bin/python3.11', '-m', 'demucs.separate', '--out', '/Users/aryandaga/AI-DJ/demix', '--name', 'htdemucs', '--device', 'cpu', '/Users/aryandaga/AI-DJ/data/audio_samples/ATMOSPHERE - FISHER x KITA ALEXANDER.mp3']' returned non-zero exit status 1.
(venv_x86) aryandaga@Aryans-MacBook-Pro-2 AI-DJ % pip install --upgrade certifi
Requirement already satisfied: certifi in ./venv_x86/lib/python3.11/site-packages (2024.7.4)

证书安装错误日志 #

/Applications/Python\ 3.11/Install\ Certificates.command ; exit;
 -- pip install --upgrade certifi
Collecting certifi
  Using cached certifi-2024.7.4-py3-none-any.whl (162 kB)
Installing collected packages: certifi
ERROR: Could not install packages due to an OSError: [Errno 13] Permission denied: '/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/certifi'
Consider using the `--user` option or check the permissions.


[notice] A new release of pip available: 22.3 -> 24.2
[notice] To update, run: pip3 install --upgrade pip
Traceback (most recent call last):
  File "<stdin>", line 44, in <module>
  File "<stdin>", line 24, in main
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/subprocess.py", line 413, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['/Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11', '-E', '-s', '-m', 'pip', 'install', '--upgrade', 'certifi']' returned non-zero exit status 1.

Saving session...
...copying shared history...
...saving history...truncating history files...
...completed.

系统环境信息 #

aryandaga@Aryans-MacBook-Pro-2 ~ % python3 --version
Python 3.11.0
aryandaga@Aryans-MacBook-Pro-2 ~ % pip --version
pip 24.2 from /usr/local/lib/python3.10/site-packages/pip (python 3.10)
aryandaga@Aryans-MacBook-Pro-2 ~ % pip install --upgrade certifi
Requirement already satisfied: certifi in /usr/local/lib/python3.10/site-packages (2024.7.4)

1. 配置虚拟环境使用正确证书 #

激活虚拟环境后，强制指定Python使用虚拟环境内的certifi证书：

• 激活虚拟环境：

  source venv_x86/bin/activate
  

• 获取虚拟环境内certifi证书路径并设置环境变量：

  export SSL_CERT_FILE=$(python -c "import certifi; print(certifi.where())")
  export REQUESTS_CA_BUNDLE=$(python -c "import certifi; print(certifi.where())")
  

• 执行allin1命令测试模型下载

2. 以管理员权限运行证书安装脚本 #

使用sudo绕过权限限制，执行官方证书安装脚本：

sudo /Applications/Python\ 3.11/Install\ Certificates.command

输入系统密码完成安装后，重新激活虚拟环境尝试下载模型

3. 修正Python3.11与pip的版本绑定 #

直接调用Python3.11的pip工具，升级自身和certifi：

• 升级pip和certifi：

  /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11 -m pip install --upgrade pip certifi
  

• 若仍有权限问题，添加--user参数安装到用户目录：

  /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11 -m pip install --upgrade --user pip certifi
  

4. 手动下载预训练模型 #

如果上述方法无效，直接手动获取模型文件：

• 复制模型地址到浏览器下载：https://dl.fbaipublicfiles.com/demucs/hybrid_transformer/955717e8-8726e21a.th
• 将下载的文件重命名为955717e8-8726e21a.th，放到路径：/Users/aryandaga/.cache/torch/hub/checkpoints/
• 再次执行allin1命令，系统会直接读取本地缓存的模型

内容的提问来源于stack exchange，提问作者Whichman