Use default gRPC roots.pem if none provided

PYTHON-MANIFEST.in

@@ -6,3 +6,4 @@ include src/python/grpcio/commands.py
 include src/python/grpcio/grpc_core_dependencies.py
 include src/python/grpcio/README.rst
 include requirements.txt
+include etc/roots.pem

setup.py

@@ -31,6 +31,7 @@
 
 import os
 import os.path
+import shutil
 import sys
 
 from distutils import core as _core
@@ -130,6 +131,14 @@ COMMAND_CLASS = {
     'run_interop': commands.RunInterop,
 }
 
+# Ensure that package data is copied over before any commands have been run:
+credentials_dir = os.path.join(PYTHON_STEM, 'grpc/_adapter/credentials')
+try:
+  os.mkdir(credentials_dir)
+except OSError:
+  pass
+shutil.copyfile('etc/roots.pem', os.path.join(credentials_dir, 'roots.pem'))
+
 TEST_PACKAGE_DATA = {
     'tests.interop': [
         'credentials/ca.pem',
@@ -144,6 +153,9 @@ TEST_PACKAGE_DATA = {
         'credentials/server1.key',
         'credentials/server1.pem',
     ],
+    'grpc._adapter': [
+        'credentials/roots.pem'
+    ],
 }
 
 TESTS_REQUIRE = (

src/python/grpcio/.gitignore

@@ -14,3 +14,4 @@ nosetests.xml
 doc/
 _grpcio_metadata.py
 htmlcov/
+grpc/_adapter/credentials

src/python/grpcio/commands.py

@@ -156,6 +156,8 @@ class BuildPy(build_py.build_py):
   """Custom project build command."""
 
   def run(self):
+    # TODO(atash): make this warn if the proto modules couldn't be built rather
+    # than cause build failure
     self.run_command('build_proto_modules')
     self.run_command('build_project_metadata')
     build_py.build_py.run(self)

src/python/grpcio/grpc/_adapter/_low.py

@@ -27,6 +27,7 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import pkg_resources
 import threading
 
 from grpc import _grpcio_metadata
@@ -34,6 +35,7 @@ from grpc._cython import cygrpc
 from grpc._adapter import _implementations
 from grpc._adapter import _types
 
+_ROOT_CERTIFICATES_RESOURCE_PATH = 'credentials/roots.pem'
 _USER_AGENT = 'Python-gRPC-{}'.format(_grpcio_metadata.__version__)
 
 ChannelCredentials = cygrpc.ChannelCredentials
@@ -54,6 +56,9 @@ def channel_credentials_ssl(
   pair = None
   if private_key is not None or certificate_chain is not None:
     pair = cygrpc.SslPemKeyCertPair(private_key, certificate_chain)
+  if root_certificates is None:
+    root_certificates = pkg_resources.resource_string(
+      __name__, _ROOT_CERTIFICATES_RESOURCE_PATH)
   return cygrpc.channel_credentials_ssl(root_certificates, pair)