86f20a367a
The E2E cells (test_update_with_corporate_root_only_in_ssl_cert_file, test_p2_env_lock_refusal_is_not_reported_as_success) now assert the fixed behaviour directly.
37 lines
1.5 KiB
Python
37 lines
1.5 KiB
Python
"""SSL_CERT_FILE → GIT_SSL_CAINFO for the updater's git children (#124654).
|
|
|
|
git's libcurl ignores ``SSL_CERT_FILE``; behind a TLS-inspecting proxy whose root lives only
|
|
there, the channel read (Python) passed and the next ``git fetch`` failed. The mapping lands in
|
|
``os.environ`` so the partial clone's lazy promisor fetches inherit it too.
|
|
"""
|
|
|
|
import os
|
|
import subprocess
|
|
|
|
from hermes_cli import update_cmd
|
|
|
|
|
|
def _git_config(configured: str | None):
|
|
def run(cmd, args, **kwargs):
|
|
assert args[:3] == ["config", "--get", "http.sslCAInfo"], args
|
|
return subprocess.CompletedProcess(cmd, 0 if configured else 1, configured or "", "")
|
|
return run
|
|
|
|
|
|
def test_ssl_cert_file_reaches_network_git_children(monkeypatch, tmp_path):
|
|
bundle = str(tmp_path / "corp-bundle.pem")
|
|
monkeypatch.setenv("SSL_CERT_FILE", bundle)
|
|
monkeypatch.delenv("GIT_SSL_CAINFO", raising=False)
|
|
monkeypatch.setattr(update_cmd, "_git_run", _git_config(None))
|
|
update_cmd._map_ssl_cert_file_for_git(["git"])
|
|
assert update_cmd._no_prompt_git_kwargs()["env"]["GIT_SSL_CAINFO"] == bundle
|
|
assert os.environ["GIT_SSL_CAINFO"] == bundle
|
|
|
|
|
|
def test_configured_git_ca_is_not_overridden(monkeypatch, tmp_path):
|
|
monkeypatch.setenv("SSL_CERT_FILE", str(tmp_path / "corp-bundle.pem"))
|
|
monkeypatch.delenv("GIT_SSL_CAINFO", raising=False)
|
|
monkeypatch.setattr(update_cmd, "_git_run", _git_config(str(tmp_path / "configured.pem")))
|
|
update_cmd._map_ssl_cert_file_for_git(["git"])
|
|
assert "GIT_SSL_CAINFO" not in os.environ
|