From 1df155888f79e68b5fc0c6a90a1d4cc2eee5ba62 Mon Sep 17 00:00:00 2001 From: Stepan Shamaiev <59963936+skippdot@users.noreply.github.com> Date: Fri, 21 Aug 2026 12:09:14 +0300 Subject: [PATCH] fix(auth): pass an explicit protocol to ssl.SSLContext() in tests - Replace the ten bare `ssl.SSLContext()` calls in tests/transport/test__custom_tls_signer.py with `ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)` - Constructing an SSLContext without a protocol argument is deprecated since Python 3.10 and emits a DeprecationWarning on every run of this module - PROTOCOL_TLS_CLIENT matches what the library receives in production, where contexts come from `urllib3.util.ssl_.create_urllib3_context()`; the tests only hand the context to mocked native libraries and never inspect its verification settings, so no assertion depends on the bare-context defaults Fixes #17760 --- .../transport/test__custom_tls_signer.py | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/packages/google-auth/tests/transport/test__custom_tls_signer.py b/packages/google-auth/tests/transport/test__custom_tls_signer.py index fa210ee0b8d7..542f39ab1400 100644 --- a/packages/google-auth/tests/transport/test__custom_tls_signer.py +++ b/packages/google-auth/tests/transport/test__custom_tls_signer.py @@ -215,7 +215,7 @@ def test_custom_tls_signer_provider(): ENTERPRISE_CERT_FILE_PROVIDER ) signer_object.load_libraries() - signer_object.attach_to_ssl_context(ssl.SSLContext()) + signer_object.attach_to_ssl_context(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)) assert signer_object.should_use_provider() assert signer_object._enterprise_cert_file_path == ENTERPRISE_CERT_FILE_PROVIDER @@ -238,7 +238,7 @@ def test_custom_tls_signer_failed_to_attach(): signer_object._sign_callback = mock.MagicMock() signer_object._cert = b"mock cert" signer_object._offload_lib.ConfigureSslContext.return_value = False - signer_object.attach_to_ssl_context(ssl.SSLContext()) + signer_object.attach_to_ssl_context(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)) assert excinfo.match("failed to configure ECP Offload SSL context") @@ -249,7 +249,7 @@ def test_custom_tls_signer_failed_to_attach_provider(): ) signer_object._provider_lib = mock.MagicMock() signer_object._provider_lib.ECP_attach_to_ctx.return_value = False - signer_object.attach_to_ssl_context(ssl.SSLContext()) + signer_object.attach_to_ssl_context(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)) assert excinfo.match("failed to configure ECP Provider SSL context") @@ -258,12 +258,12 @@ def test_custom_tls_signer_failed_to_attach_no_libs(): signer_object = _custom_tls_signer.CustomTlsSigner(ENTERPRISE_CERT_FILE) signer_object._offload_lib = None signer_object._signer_lib = None - signer_object.attach_to_ssl_context(ssl.SSLContext()) + signer_object.attach_to_ssl_context(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)) assert excinfo.match("Invalid ECP configuration.") def test_cast_ssl_ctx_to_void_p_stdlib_success(): - context = ssl.SSLContext() + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) fake_impl = mock.Mock() fake_impl.name = "cpython" with mock.patch("sys.implementation", fake_impl): @@ -282,7 +282,7 @@ def test_cast_ssl_ctx_to_void_p_stdlib_success(): def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_pypy(): - context = ssl.SSLContext() + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) fake_impl = mock.Mock() fake_impl.name = "pypy" @@ -295,7 +295,7 @@ def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_pypy(): def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_trace_refs(): - context = ssl.SSLContext() + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) fake_impl = mock.Mock() fake_impl.name = "cpython" @@ -317,7 +317,7 @@ def test_cast_ssl_ctx_to_void_p_stdlib_type_error(): def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_debug_flag(): - context = ssl.SSLContext() + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) fake_impl = mock.Mock() fake_impl.name = "cpython" with mock.patch("sys.implementation", fake_impl), mock.patch( @@ -331,7 +331,7 @@ def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_debug_flag(): def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_free_threaded(): - context = ssl.SSLContext() + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) def mock_get_config_var(var): if var == "Py_GIL_DISABLED": @@ -351,7 +351,7 @@ def mock_get_config_var(var): def test_cast_ssl_ctx_to_void_p_stdlib_dynamic_offset(): - context = ssl.SSLContext() + context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) with mock.patch("sys.getsizeof", return_value=40) as mock_sizeof: with mock.patch("ctypes.c_void_p.from_address") as mock_from_address: _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)