From 72fc5e447639e7fda0482a3ee06dfacd3e5d704e Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Tue, 6 Oct 2026 11:18:10 +0530 Subject: [PATCH] refactor(ssl): collapse the duplicated union arm in _shared_context The SSL_CERT_FILE (union) arm repeated the platform arm line for line plus a load_verify_locations call. Build the context from one of two classes (stdlib for a replacing provider bundle, injected for everything else) and load the bundle once when there is one. Equivalence probed on 44a807c2c7 vs this head for (path, False), (path, True), (None, False): identical type, verify_mode, check_hostname and cert_store_stats(). Fold3 finding 1 (reuse/quality Low). --- agent/ssl_verify.py | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/agent/ssl_verify.py b/agent/ssl_verify.py index 1fc289aad1..a95e366103 100644 --- a/agent/ssl_verify.py +++ b/agent/ssl_verify.py @@ -101,20 +101,16 @@ def _shared_context(ca_path: str | None, union: bool = False) -> ssl.SSLContext: with _CA_CONTEXTS_LOCK: ctx = _CA_CONTEXTS.get((ca_path, union)) if ctx is None: - if union: - ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) - if not _installed: - ctx.load_default_certs() - ctx.load_verify_locations(cafile=ca_path) - elif ca_path is not None: + if ca_path is not None and not union: # PROTOCOL_TLS_CLIENT sets hostname checking and CERT_REQUIRED; # assigning the original class's properties after injection recurses. ctx = _stdlib_ssl_context_class()(ssl.PROTOCOL_TLS_CLIENT) - ctx.load_verify_locations(cafile=ca_path) else: ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) if not _installed: ctx.load_default_certs() + if ca_path is not None: + ctx.load_verify_locations(cafile=ca_path) _CA_CONTEXTS[(ca_path, union)] = ctx return ctx