allura_issues: use Requests to avoid HTTPS issues.

[avm]

The Requests library uses the Certifi list of certificates, so you don't have to install ca-certificates to work with Sourceforge or the likes.
(The downside is, of course, that you have to install Requests.)

[gperciva]

Why is ca-certificates difficult to install? It's more trustworthy than an additional python program.

[avm]

ca-certificates does not exist on Mac OS, whereas `pip install requests` works fine.I could provide a fallback to `urllib.urlopen` if a hard dependency on Requests is unacceptable.

[gperciva]

Good reason to change something! I'd still like a bit more info.

Is this with python 2 or 3? And what version of OSX? I know that the script just calls /usr/bin/python, so that's probably python 2. (Unless Apple did something weird, which wouldn't surprise me.)

For python 3 and OSX 10.11+, it looks like another solution is:
https://stackoverflow.com/a/42334357/7541781

[gperciva]

PS: hmm, casual skimming suggests that this readme does involve installing certifi. So maybe that package is reliable after all.

I'm tentatively ok with this PR, but I'd like a bit more time to think about it. I'm still curious about the python and OSX versions involved, though.

[avm]

I'm on OS X 10.11.6 (El Capitan). With /usr/bin/python (the system-installed Python 2.7), the certificates actually don't even come into play, as Sourceforge.net resets the connection after TLS handshake:

>>> urllib2.urlopen('https://sourceforge.net')
Traceback (most recent call last):
...
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1197, in do_open
    raise URLError(err)
urllib2.URLError: <urlopen error [Errno 54] Connection reset by peer>

This does not happen with other sites, so there is probably an incompatibility in the versions of OpenSSL or whatever, I don't see a way to fix it.

With Homebrew-installed Python 2.7, urllib2.urlopen bails with [SSL: CERTIFICATE_VERIFY_FAILED], while requests.get works fine, as expected.

(Didn't test with Python 3, as it does not have urllib2 :-].)

[avm]

This reminds me: it's probably better to use /usr/bin/env python instead of /usr/bin/python (the user has control over the former via his PATH setting, while the latter may well be an immovable part of the system).