Replace pip-installed requests CA bundle with link

If the version of python-requests required is higher than
that provided by the operating system, pip will install
it from upstream.

The upstream version provides its own CA certificate bundle
based on the Mozilla bundle, and defaults to that in case
a CA certificate file is not specified for a request.

The distribution-specific packages point to the system-wide
CA bundle that can be managed by tools such as
update-ca-trust (Fedora/RHEL) and update-ca-certificates
(Debian/Ubuntu).

When installing in SSL/TLS mode, either with SSL=True or by
adding tls-proxy to ENABLED_SERVICES, if a non-systemwide
CA bundle is used, then the CA generated by devstack will
not be used causing the installation to fail.

Replace the upstream-provided bundle with a link to the
system bundle when possible.

Change-Id: I349662ff8f851b4a7f879f89b8975a068f2d73dc
Closes-Bug: #1459789

tools/fixup_stuff.sh

@@ -138,3 +138,24 @@ fi
 # and installing the latest version using pip.
 uninstall_package python-virtualenv
 pip_install -U virtualenv
+
+# If a non-system python-requests is installed then it will use the
+# built-in CA certificate store rather than the distro-specific
+# CA certificate store. Detect this and symlink to the correct
+# one. If the value for the CA is not rooted in /etc then we know
+# we need to change it.
+capath=$(python -c "from requests import certs; print certs.where()")
+
+if is_service_enabled tls-proxy || [ "$USE_SSL" == "True" ]; then
+    if [[ ! $capath =~ ^/etc/.* && ! -L $capath ]]; then
+        if is_fedora; then
+            sudo rm -f $capath
+            sudo ln -s /etc/pki/tls/certs/ca-bundle.crt $capath
+        elif is_ubuntu; then
+            sudo rm -f $capath
+            sudo ln -s /etc/ssl/certs/ca-certificates.crt $capath
+        else
+            echo "Don't know how to set the CA bundle, expect the install to fail."
+        fi
+    fi
+fi