Skip to content

ssl: discover default certificate paths in host_env - #8649

Merged
youknowone merged 1 commit into
RustPython:mainfrom
youknowone:ssl-followup-host-env-paths
Sep 4, 2026
Merged

ssl: discover default certificate paths in host_env#8649
youknowone merged 1 commit into
RustPython:mainfrom
youknowone:ssl-followup-host-env-paths

Conversation

@youknowone

@youknowone youknowone commented Sep 4, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Follow-up to #8646, moving the remaining host-specific default certificate path discovery behind rustpython-host_env and carrying over the candidate-path approach from #8007.

Summary

  • keep platform certificate path probing alongside the native certificate provider
  • select the first available OpenSSL-style CA file and hashed CA directory
  • leave SSL_CERT_FILE and SSL_CERT_DIR overrides to Lib/ssl.py
  • preserve empty path strings for the Windows certificate-store backend
  • remove the Android expected failure now that the API always reports string defaults

Test plan

  • cargo test --workspace --exclude rustpython_wasm --exclude rustpython-venvlauncher --exclude rustpython-capi
  • cargo test from crates/capi (103 passed)
  • cargo run --release -- -m test test_ssl (196 run, 43 skipped)
  • cargo test -p rustpython-host_env --features native-certs
  • cargo clippy -p rustpython-host_env --features native-certs --all-targets
  • cargo clippy -p rustpython-stdlib --all-targets
  • cargo check -p rustpython-host_env --target x86_64-pc-windows-gnu --features native-certs
  • pre-commit hooks

Summary by CodeRabbit

  • Improvements
    • SSL certificate verification now automatically discovers trusted certificate files and directories from the host system.
    • Platform-specific certificate locations are detected at runtime, improving compatibility across supported environments.
    • Systems without matching certificate locations continue to use empty defaults safely.

@youknowone
ssl: discover default certificate paths in host_env
10aa120 
Keep host certificate path probing with the native certificate provider, select the first available OpenSSL-style file and directory, and leave environment overrides to ssl.py. This also gives Android string defaults instead of the previous None values.

Co-authored-by: Ivan Mironov <[email protected]>

Assisted-by: OpenAI Codex: GPT-5
@coderabbitai

coderabbitai Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Team

Run ID: 8f6827a3-6e28-45ce-8cda-29f88c4be158

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8fcb4 and 10aa120.

⛔ Files ignored due to path filters (1)
  • Lib/test/test_ssl.py is excluded by !Lib/**
📒 Files selected for processing (2)
  • crates/host_env/src/native_certs.rs
  • crates/stdlib/src/ssl.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Walkthrough

The change adds runtime discovery of native certificate file and directory paths. The SSL default verification API now returns these resolved paths instead of hardcoded platform values.

Changes

Native certificate paths

Layer / File(s) Summary
Certificate candidate discovery
crates/host_env/src/native_certs.rs		 default_verify_paths checks platform-specific certificate candidates in order, returns empty paths on Windows, and applies standard fallbacks on other platforms. Tests cover candidate ordering and no-match behavior.
SSL default path integration
crates/stdlib/src/ssl.rs		 get_default_verify_paths uses rustpython_host_env::native_certs::default_verify_paths() and returns the resolved certificate file and directory paths.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 10aa1

SSL defaults now discover available native certificate paths at runtime while preserving platform-specific empty-path behavior. No concrete merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant SSL as get_default_verify_paths
  participant NativeCerts as default_verify_paths
  participant Filesystem as Host filesystem
  SSL->>NativeCerts: Request native verification paths
  NativeCerts->>Filesystem: Check platform-specific candidates
  Filesystem-->>NativeCerts: Return existing file and directory
  NativeCerts-->>SSL: Return cafile and capath strings
Loading

Suggested reviewers: shaharnaveh, kyokuping

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: moving SSL default certificate path discovery into host_env.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
  • Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

📦 Library Dependencies

The following Lib/ modules were modified. Here are their dependencies:

[x] lib: cpython/Lib/ssl.py
[ ] test: cpython/Lib/test/test_ssl.py (TODO: 7)

dependencies:

  • ssl

dependent tests: (54 tests)

  • ssl: test_asyncio test_ftplib test_httplib test_httpservers test_imaplib test_logging test_poplib test_ssl test_urllib test_urllib2_localnet test_venv test_xmlrpc
    • asyncio.selector_events: test_asyncio
    • ftplib: test_urllib2
      • urllib.request: test_http_cookiejar test_pathlib test_pydoc test_sax test_site test_urllib2net test_urllibnet
    • http.client: test_docxmlrpc test_hashlib test_ucn test_unicodedata test_wsgiref
      • logging.handlers: test_concurrent_futures test_pkgutil
    • http.server: test_robotparser
      • pydoc: test_enum
    • smtplib: test_smtplib test_smtpnet
    • urllib.request:
      • pathlib: test_ast test_dbm_sqlite3 test_ensurepip test_importlib test_json test_launcher test_os test_pathlib test_peg_generator test_pyrepl test_runpy test_tarfile test_tempfile test_tomllib test_tools test_traceback test_unparse test_winapi test_zipapp test_zipfile test_zoneinfo test_zstd

Legend:

  • [+] path exists in CPython
  • [x] up-to-date, [ ] outdated

@youknowone
youknowone merged commit cc990d0 into RustPython:main Sep 4, 2026
30 checks passed
@youknowone
youknowone deleted the ssl-followup-host-env-paths branch September 4, 2026 17:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@youknowone