---
 certifi/core.py |   91 ++++++++++++--------------------------------------------
 1 file changed, 20 insertions(+), 71 deletions(-)

Index: certifi-2026.5.20/certifi/core.py
===================================================================
--- certifi-2026.5.20.orig/certifi/core.py	2026-06-17 00:19:03.550347364 +0200
+++ certifi-2026.5.20/certifi/core.py	2026-06-17 00:20:46.453271021 +0200
@@ -3,81 +3,30 @@
 ~~~~~~~~~~
 
 This module returns the installation location of cacert.pem or its contents.
+Patched by openSUSE: return the system bundle
 """
-import sys
-import atexit
+import io
 
-def exit_cacert_ctx() -> None:
-    _CACERT_CTX.__exit__(None, None, None)  # type: ignore[union-attr]
 
+def read_text(_module=None, _path=None, encoding="ascii"):
+    with io.open(where(), "r", encoding=encoding) as data:
+        return data.read()
 
-if sys.version_info >= (3, 11):
 
-    from importlib.resources import as_file, files
-
-    _CACERT_CTX = None
-    _CACERT_PATH = None
-
-    def where() -> str:
-        # This is slightly terrible, but we want to delay extracting the file
-        # in cases where we're inside of a zipimport situation until someone
-        # actually calls where(), but we don't want to re-extract the file
-        # on every call of where(), so we'll do it once then store it in a
-        # global variable.
-        global _CACERT_CTX
-        global _CACERT_PATH
-        if _CACERT_PATH is None:
-            # This is slightly janky, the importlib.resources API wants you to
-            # manage the cleanup of this file, so it doesn't actually return a
-            # path, it returns a context manager that will give you the path
-            # when you enter it and will do any cleanup when you leave it. In
-            # the common case of not needing a temporary file, it will just
-            # return the file system location and the __exit__() is a no-op.
-            #
-            # We also have to hold onto the actual context manager, because
-            # it will do the cleanup whenever it gets garbage collected, so
-            # we will also store that at the global level as well.
-            _CACERT_CTX = as_file(files("certifi").joinpath("cacert.pem"))
-            _CACERT_PATH = str(_CACERT_CTX.__enter__())
-            atexit.register(exit_cacert_ctx)
-
-        return _CACERT_PATH
-
-    def contents() -> str:
-        return files("certifi").joinpath("cacert.pem").read_text(encoding="ascii")
-
-else:
-
-    from importlib.resources import path as get_path, read_text
-
-    _CACERT_CTX = None
-    _CACERT_PATH = None
-
-    def where() -> str:
-        # This is slightly terrible, but we want to delay extracting the
-        # file in cases where we're inside of a zipimport situation until
-        # someone actually calls where(), but we don't want to re-extract
-        # the file on every call of where(), so we'll do it once then store
-        # it in a global variable.
-        global _CACERT_CTX
-        global _CACERT_PATH
-        if _CACERT_PATH is None:
-            # This is slightly janky, the importlib.resources API wants you
-            # to manage the cleanup of this file, so it doesn't actually
-            # return a path, it returns a context manager that will give
-            # you the path when you enter it and will do any cleanup when
-            # you leave it. In the common case of not needing a temporary
-            # file, it will just return the file system location and the
-            # __exit__() is a no-op.
-            #
-            # We also have to hold onto the actual context manager, because
-            # it will do the cleanup whenever it gets garbage collected, so
-            # we will also store that at the global level as well.
-            _CACERT_CTX = get_path("certifi", "cacert.pem")
-            _CACERT_PATH = str(_CACERT_CTX.__enter__())
-            atexit.register(exit_cacert_ctx)
+def where():
+    # Try the legacy location first
+    legacy_path = "/etc/ssl/ca-bundle.pem"
+    if os.path.exists(legacy_path):
+        return legacy_path
 
-        return _CACERT_PATH
+    # Try the primary location
+    primary_path = "/var/lib/ca-certificates/ca-bundle.pem"
+    if os.path.exists(primary_path):
+        return primary_path
 
-    def contents() -> str:
-        return read_text("certifi", "cacert.pem", encoding="ascii")
+    # Return None to let Python use system defaults
+    return None
+
+
+def contents() -> str:
+    return read_text(encoding="ascii")