Repository navigation
gh-160736: Fix test_distrusted_spki on AWS-LC builds - #161213
torben-hansen wants to merge 1 commit into
Conversation
|
All commit authors signed the Contributor License Agreement. |
|
Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
|
The AWS-LC test job fails because it uses an earlier version without the change. This is the earliest version with the AWS-LC intermediate distrust feature: https://github.com/aws/aws-lc/releases/tag/v5.12.0 |
Can you first open a PR for bumping the AWS-LC version (or add more versions to it if there is a notion of LTS for AWS-LC?) |
I can do that for sure. But if done in a separate PR, it would fail the test case :) |
|
You can do it in ths PR actually. Add the new version to test in AWS-LC and skip the test depending on the version. |
test_distrusted_spkifails on builds linked against AWS-LC.AWS-LC maintains its own SPKI denylist and rejects a set of intermediates
during chain building, before
_ssl's verify callback can see the certificate.AWS-LC's error (
X509_V_ERR_CERT_REVOKED, 23) is thereforereported instead of
_ssl's ownX509_V_ERR_CERT_REJECTED(28).The test assumes the latter error code.
Accept either code depending on the TLS library. Test-only change.
#160736