Skip to content

fix ssl deactivation from catalog properties #2985 #3012

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Fokko merged 3 commits into from
Feb 18, 2026
Merged

fix ssl deactivation from catalog properties #2985 #3012

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e3efa8
fix ssl deactivation from catalog properties #2985
MenelikV Feb 9, 2026
ccc9b4a
fix(lint): fix linting issues
MenelikV Feb 10, 2026
3e84d24
feat(test): simpler test without callback
MenelikV Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pyiceberg/catalog/rest/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -358,7 +358,7 @@ def _create_session(self) -> Session:

# Sets the client side and server side SSL cert verification, if provided as properties.
if ssl_config := self.properties.get(SSL):
if ssl_ca_bundle := ssl_config.get(CA_BUNDLE):
if (ssl_ca_bundle := ssl_config.get(CA_BUNDLE)) is not None:
session.verify = ssl_ca_bundle
Comment on lines +361 to 362
Copy link
Copy Markdown
Contributor

@Fokko Fokko Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit:

Suggested change
if (ssl_ca_bundle := ssl_config.get(CA_BUNDLE)) is not None:
session.verify = ssl_ca_bundle
if ssl_config.get(CA_BUNDLE) is not None:
session.verify = ssl_config.get[CA_BUNDLE]

if ssl_client := ssl_config.get(CLIENT):
if all(k in ssl_client for k in (CERT, KEY)):
Expand Down
25 changes: 24 additions & 1 deletion tests/catalog/test_rest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@
NoSuchViewError,
OAuthError,
ServerError,
TableAlreadyExistsError,
TableAlreadyExistsError, ValidationError,
)
from pyiceberg.io import load_file_io
from pyiceberg.partitioning import PartitionField, PartitionSpec
Expand Down Expand Up @@ -1641,6 +1641,29 @@ def test_update_namespace_properties_invalid_namespace(rest_mock: Mocker) -> Non
assert "Empty namespace identifier" in str(e.value)


def test_with_disabled_ssl_ca_bundle(rest_mock: Mocker) -> None:
from pydantic import ValidationError
Comment thread
MenelikV marked this conversation as resolved.
Outdated
def ssl_check_callback(req, _):
if req.verify:
raise AssertionError("SSL verification is still enabled")
# Given
rest_mock.get(
f"{TEST_URI}v1/config",
json=ssl_check_callback,
status_code=200,
)
# Given
catalog_properties = {
"uri": TEST_URI,
"token": TEST_TOKEN,
"ssl": {
"cabundle": False,
}
}
with pytest.raises(ValidationError) as _:
Copy link
Copy Markdown
Member

@geruh geruh Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should directly assert that session.verify is False for extra confidence here. Then we could just do something like the following without the callback logic

catalog = RestCatalog("rest", **{
  "uri": TEST_URI,
  "token": TEST_TOKEN,
  "ssl": {"cabundle": False},
})

assert catalog._session.verify is False

Copy link
Copy Markdown
Contributor Author

@MenelikV MenelikV Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, works for me.

RestCatalog("rest", **catalog_properties)


def test_request_session_with_ssl_ca_bundle(monkeypatch: pytest.MonkeyPatch) -> None:
# Given
catalog_properties = {
Expand Down
Loading