fix(utils): swallow ssl.SSLError from empty/corrupt CA bundle

single_kernel_postgresql/utils/__init__.py

@@ -9,8 +9,7 @@
 import secrets
 import string
 from asyncio import as_completed, create_task, run, wait
-from contextlib import suppress
-from ssl import CERT_NONE, create_default_context
+from ssl import CERT_NONE, SSLError, create_default_context
 from typing import Any
 
 from httpx import AsyncClient, BasicAuth, HTTPError
@@ -172,8 +171,15 @@ async def _httpx_get_request(
 ) -> dict[str, Any] | None:
     ssl_ctx = create_default_context()
     if verify:
-        with suppress(FileNotFoundError):
+        # A missing OR empty/corrupt CA bundle must not crash the caller:
+        # load_verify_locations raises FileNotFoundError when the file is
+        # absent, but ssl.SSLError (NO_CERTIFICATE_OR_CRL_FOUND) when it exists
+        # yet holds no certificates. Both mean "cannot verify this endpoint",
+        # so degrade to an unreachable request instead of propagating.
+        try:
             ssl_ctx.load_verify_locations(cafile=cafile)
+        except (FileNotFoundError, SSLError):
+            pass
     else:
         ssl_ctx.check_hostname = False
         ssl_ctx.verify_mode = CERT_NONE

tests/unit/test_utils.py

@@ -4,13 +4,16 @@
 import re
 from unittest.mock import mock_open, patch
 
+from httpx import BasicAuth
+
 from single_kernel_postgresql.config.enums import Substrates
 from single_kernel_postgresql.utils import (
     any_cpu_to_cores,
     any_memory_to_bytes,
     create_directory,
     label2name,
     new_password,
+    parallel_patroni_get_request,
     render_file,
 )
 
@@ -105,3 +108,36 @@ def test_create_directory():
         _chmod.assert_called_once_with("test", 0o640)
         _chown.assert_called_once_with("test", uid=35, gid=35)
         _pwnam.assert_called_with("postgres")
+
+
+def test_parallel_patroni_get_request_empty_ca_bundle_does_not_crash(tmp_path):
+    # An empty (or corrupt) CA bundle file must not crash the request:
+    # load_verify_locations raises ssl.SSLError (NO_CERTIFICATE_OR_CRL_FOUND)
+    # for an existing-but-certless file, which the old suppress(FileNotFoundError)
+    # did not catch — propagating up and failing the storage-detaching hook.
+    # With the fix it degrades to an unreachable endpoint and returns None.
+    empty_ca = tmp_path / "ca.pem"
+    empty_ca.write_text("")
+    auth = BasicAuth("patroni", password="unused")
+
+    assert (
+        parallel_patroni_get_request(
+            "/cluster", ["127.0.0.1"], str(empty_ca), auth, verify=True
+        )
+        is None
+    )
+
+
+def test_parallel_patroni_get_request_missing_ca_bundle_does_not_crash():
+    # A missing CA bundle is already swallowed (FileNotFoundError); this guards
+    # against a regression that narrows the suppression back to FileNotFoundError only.
+    assert (
+        parallel_patroni_get_request(
+            "/cluster",
+            ["127.0.0.1"],
+            "/tmp/does-not-exist-ca-bundle.pem",
+            BasicAuth("patroni", password="unused"),
+            verify=True,
+        )
+        is None
+    )