Repository navigation
Allow explicit verified TLS contexts for private certificate authorities - #207
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
# Conflicts: # CHANGELOG.md # docs/sdk-reference.md
rmcdaniel
marked this pull request as ready for review
October 23, 2026 08:41
# Conflicts: # CHANGELOG.md
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Python clients cannot select a private certificate authority without process-wide environment changes. Add
tls_context, accepting a verifiedssl.SSLContext, to async and synchronous clients. Query-poller clones, Nexus namespace views and runtime-owned payload transfers retain it. Default certifi/environment behavior stays unchanged; contexts with disabled certificate or hostname verification are rejected.The guide shows starting with certifi's public roots and adding a private CA, explains environment precedence and distinguishes separately configured storage drivers. It explicitly marks the new option unreleased.
Addresses #166. The original unchanged-source controls produce 12 failures and two passing default-trust controls. Current HTTPS coverage has 16 passing controls for explicit trust, public-root preservation, hostname mismatch, verification modes, sync forwarding, cloned query polling and actual upload/cold-client fetch. The original combined TLS/sync/Nexus set passes 63 tests. Functional candidate
6719b1b8passes full local Python 3.12: 3,153 tests / two skips / 105 integration deselections / one existing fork warning, 126.58 seconds. Ruff and mypy on 36 source files pass.CodeQL identified the test server's unspecified minimum TLS version; the fixture now explicitly requires TLS 1.2. Current-target
a919f8f1incorporates main6752909eand passes 75 combined TLS/backoff controls. Fresh whole-head hosted qualification remains required. Supported-version CI requires OpenSSL, preserving existing trust bootstrap, permissions, guards and budgets.Publication, normally installed acceptance and removal of the unreleased notices remain required after the existing #197 registry-side setup clears. No version or release tag changed.