[FontBakeryCondition:api_gfonts_ttFont]: urlopen error [SSL: CERTIFICATE_VERIFY_FAILED]

original title of this issue was: Checks 117–119, 154: Unable to get info from hosted fonts

Observed behaviour

When running fontbakery on Cabin and Expletus Sans, I end up with 4 errors all with an SSL certificate issue and the same traceback:

>> com.google.fonts/check/154 with (('font[0]', 'Cabin-Regular.ttf'),)
   Check font has same encoded glyphs as version hosted on fonts.google.com
 * ERROR: The condition <FontBakeryCondition:api_gfonts_ttFont> had an error: FailedConditionError: The condition <FontBakeryCondition:remote_styles> had an error: URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificateverify failed (_ssl.c:841)>
           File "/Users/lags/Desktop/fontbakery-venv/lib/python3.6/site-packages/fontbakery/checkrunner.py", line 370, in _evaluate_condition
             args = self._get_args(condition, iterargs, path)
           File "/Users/lags/Desktop/fontbakery-venv/lib/python3.6/site-packages/fontbakery/checkrunner.py", line 509, in _get_args
             args[name] = self._get(name, iterargs, path)
           File "/Users/lags/Desktop/fontbakery-venv/lib/python3.6/site-packages/fontbakery/checkrunner.py", line 483, in _get
             raise error


   Result: ERROR

This happens when running fontbakery on a font file when there is also a METADATA.pb file in the same directory, but if I remove the METADATA.pb file, then I only get an error for check 117.

It is very possible I may be doing something wrong on my end, though I am not sure what that would be; my setup is very straightforward: I am running fontbakery v0.6.5 from a virtual environment.

Expected behaviour

I would expect METADATA.pb to not affect checks that don’t relate to it

Resources and exact process needed to replicate

The exact location I was running fontbakery on can be found here

[anthrotype]

He probably installed official Mac python from python.org but forgot to also install the certificates. There is a note in the installer Readme about that. Check the Python folder in the Applications directory, you should find a shell script to install the certificates.

[anthrotype]

For reference, this is a screenshot of the “python-3.7.2-macosx10.9.pkg” installer from Python.org, and the relevant paragraph from the installer’s info page:

Certificate verification and OpenSSL This variant of Python 3.7 includes its own private copy of OpenSSL 1.1.0. The deprecated Apple-supplied OpenSSL libraries are no longer used. This means that the trust certificates in system and user keychains managed by the Keychain Access application and the security command line utility are no longer used as defaults by the Python ssl module. A sample command script is included in /Applications/Python 3.7 to install a curated bundle of default root certificates from the third-party certifi package (https://pypi.org/project/certifi/). If you choose to use certifi, you should consider subscribing to the project’s email update service to be notified when the certificate bundle is updated. The bundled pip included with this installer has its own default certificate store for verifying download connections.

Even when the installation is completed, the installer reminds the user to double-click on the bundled “Install Certificates.command” shell, found in “/Applications/Python 3.7” folder.