-
-
Notifications
You must be signed in to change notification settings - Fork 98
Fix manual prompt in pyopenssl adapter for private key password #798
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix manual prompt in pyopenssl adapter for private key password #798
Conversation
❌ 1 Tests Failed:
View the full list of 3 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
|
@jatalahd may I ask why does your checklist and up having |
339ca88 to
bb640b0
Compare
I truly do not know. I have to pay attention to this next time. |
|
@webknjaz ; added change log fragment and some answers to your questions. Added also explanation to the main umbrella issue: |
Let me know. I've seen this happening when other people fill out the form but never learned what the cause is. |
bb640b0 to
3f6f038
Compare
3f6f038 to
20885c6
Compare
|
@webknjaz ; In the latest push I have made both adapters to accept callable type for the |
Cool. I was hoping it'd help like that. With the comments I left inline, I think the builtin adapter should be able to mirror the same idea. |
20885c6 to
afc39cd
Compare
|
@webknjaz ; Made some progress in the latest push and overall things start to line up. I am not sure if the password prompting callback should be in |
Good call.
Yep, I feel the same. P.S. Rebase the PR to absorb the fixes on |
|
@jatalahd you'll need fix a conflict when rebasing. |
afc39cd to
529dd97
Compare
|
@webknjaz ; Latest push is closer towards the goal, but I did not manage to resolve all your comments. Let's continue from here. |
webknjaz
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just two small test improvements left.
529dd97 to
2692451
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good (short of the callable link): https://cheroot--798.org.readthedocs.build/en/798/history/#to-be-included-in-the-next-release
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hopefully ok in the latest push.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, it's now clickable!
|
A few fixes left are mostly cosmetic. |
- If pyopenssl adapter was used with password protected private key, the manual entry option was not given, only a fail due to invalid password. The password callback was triggered also in the case where the private_key_password was None. - Added Callable type as possible private_key_password argument
2692451 to
75196e3
Compare
webknjaz
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Perfect, thanks!
| 'transform_password_arg', | ||
| ( | ||
| lambda pass_factory: pass_factory().encode('utf-8'), | ||
| lambda pass_factory: pass_factory(), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jatalahd so I replaced the deprecated macos-13 with macos-15-intel on main (8b8d6f8) and then merged your PR right after.
The CI now fails on that specific VM under PyPy 3.11 with a SEGFAULT in cheroot/test/test_ssl.py::test_ssl_adapters_with_private_key_password[with-str-password-unencrypted-key-builtin] which this PR touches (but another one introduced originally).
The last successful PR CI run wasn't running pypy under macos: https://github.com/cherrypy/cheroot/actions/runs/20009127282. I just forgot to skip it when changing VMs.
This means that the pathc in this PR isn't necessarily related to the problem but if you have a minute, it might be a good idea to look closer in case this is something that might start happening under classic CPython too...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Although.. The surrounding comments suggest pre-existing issues with pytest-xdist + PyPy. So never mind that.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With 41a44f1, the CI should be fine again.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, hopefully it is fine now. I did not see any test issues when running the unit tests locally with Python 3.11 in MacOS15.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, this was just PyPy, not CPython.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, this was just PyPy, not CPython.
If
pyopenssladapter is used with password protected private key and the manual entry option was not given, only a fail due to invalid password. The password callback used to also be triggered in the case where theprivate_key_passwordwasNone.❓ What kind of change does this PR introduce?
📋 What is the related issue number (starting with
#)Resolves #
❓ What is the current behavior? (You can also link to an open issue here)
Manual prompt to enter private key password is not given in server startup
in the case where private_key_password = None. Functionality conflicts with
documentation and with builtin adapter
❓ What is the new behavior (if this is a feature change)?
With this fix the functionality is matching the documentation
and both ssl adapters work in similar fashion.
📋 Other information:
📋 Contribution checklist:
(If you're a first-timer, check out
this guide on making great pull requests)
the changes have been approved
and description in grammatically correct, complete sentences