GeezerVison is showing github.com — ssl: discover default certificate paths in host_env by youknowone · Pull Request #8649 · RustPython/RustPython
Conversation
youknowone
commented
Sep 4, 2026
•
edited by coderabbitai
Bot
Loading
Uh oh!
There was an error while loading. Please reload this page.
Follow-up to #8646, moving the remaining host-specific default certificate path discovery behind rustpython-host_env and carrying over the candidate-path approach from #8007.
Summary
- keep platform certificate path probing alongside the native certificate provider
- select the first available OpenSSL-style CA file and hashed CA directory
- leave SSL_CERT_FILE and SSL_CERT_DIR overrides to Lib/ssl.py
- preserve empty path strings for the Windows certificate-store backend
- remove the Android expected failure now that the API always reports string defaults
Test plan
- cargo test --workspace --exclude rustpython_wasm --exclude rustpython-venvlauncher --exclude rustpython-capi
- cargo test from crates/capi (103 passed)
- cargo run --release -- -m test test_ssl (196 run, 43 skipped)
- cargo test -p rustpython-host_env --features native-certs
- cargo clippy -p rustpython-host_env --features native-certs --all-targets
- cargo clippy -p rustpython-stdlib --all-targets
- cargo check -p rustpython-host_env --target x86_64-pc-windows-gnu --features native-certs
- pre-commit hooks
Summary by CodeRabbit
- Improvements
- SSL certificate verification now automatically discovers trusted certificate files and directories from the host system.
- Platform-specific certificate locations are detected at runtime, improving compatibility across supported environments.
- Systems without matching certificate locations continue to use empty defaults safely.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Keep host certificate path probing with the native certificate provider, select the first available OpenSSL-style file and directory, and leave environment overrides to ssl.py. This also gives Android string defaults instead of the previous None values.
Co-authored-by: Ivan Mironov <[email protected]>
Assisted-by: OpenAI Codex: GPT-5
coderabbitai
Bot
commented
Sep 4, 2026
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
|
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Team
Run ID: 8f6827a3-6e28-45ce-8cda-29f88c4be158
📥 Commits
Reviewing files that changed from the base of the PR and between 0b8fcb4 and 10aa120.
⛔ Files ignored due to path filters (1)
Lib/test/test_ssl.py is excluded by !Lib/**
📒 Files selected for processing (2)
crates/host_env/src/native_certs.rscrates/stdlib/src/ssl.rs
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.
📝 Walkthrough
Walkthrough
The change adds runtime discovery of native certificate file and directory paths. The SSL default verification API now returns these resolved paths instead of hardcoded platform values.
Changes
Native certificate paths
| Layer / File(s) |
Summary |
Certificate candidate discovery
crates/host_env/src/native_certs.rs |
default_verify_paths checks platform-specific certificate candidates in order, returns empty paths on Windows, and applies standard fallbacks on other platforms. Tests cover candidate ordering and no-match behavior. |
SSL default path integration
crates/stdlib/src/ssl.rs |
get_default_verify_paths uses rustpython_host_env::native_certs::default_verify_paths() and returns the resolved certificate file and directory paths. |
Estimated code review effort: 3 (Moderate) | ~20 minutes
Merge Risk: ⚪ Minimal · up to 10aa1
SSL defaults now discover available native certificate paths at runtime while preserving platform-specific empty-path behavior. No concrete merge-blocking risk remains.
Sequence Diagram(s)
sequenceDiagram
participant SSL as get_default_verify_paths
participant NativeCerts as default_verify_paths
participant Filesystem as Host filesystem
SSL->>NativeCerts: Request native verification paths
NativeCerts->>Filesystem: Check platform-specific candidates
Filesystem-->>NativeCerts: Return existing file and directory
NativeCerts-->>SSL: Return cafile and capath strings
Loading
Suggested reviewers: shaharnaveh, kyokuping
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name |
Status |
Explanation |
Resolution |
| Docstring Coverage |
⚠️ Warning |
Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 2 files. |
Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
| Check name |
Status |
Explanation |
| Description Check |
✅ Passed |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check |
✅ Passed |
The title clearly and concisely describes the main change: moving SSL default certificate path discovery into host_env. |
| Linked Issues check |
✅ Passed |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check |
✅ Passed |
Check skipped because no linked issues were found for this pull request. |
- Fix all pre-merge checks with AI
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
📦 Library Dependencies
The following Lib/ modules were modified. Here are their dependencies:
[x] lib: cpython/Lib/ssl.py
[ ] test: cpython/Lib/test/test_ssl.py (TODO: 7)
dependencies:
dependent tests: (54 tests)
- ssl: test_asyncio test_ftplib test_httplib test_httpservers test_imaplib test_logging test_poplib test_ssl test_urllib test_urllib2_localnet test_venv test_xmlrpc
- asyncio.selector_events: test_asyncio
- ftplib: test_urllib2
- urllib.request: test_http_cookiejar test_pathlib test_pydoc test_sax test_site test_urllib2net test_urllibnet
- http.client: test_docxmlrpc test_hashlib test_ucn test_unicodedata test_wsgiref
- logging.handlers: test_concurrent_futures test_pkgutil
- http.server: test_robotparser
- smtplib: test_smtplib test_smtpnet
- urllib.request:
- pathlib: test_ast test_dbm_sqlite3 test_ensurepip test_importlib test_json test_launcher test_os test_pathlib test_peg_generator test_pyrepl test_runpy test_tarfile test_tempfile test_tomllib test_tools test_traceback test_unparse test_winapi test_zipapp test_zipfile test_zoneinfo test_zstd
Legend:
[+] path exists in CPython[x] up-to-date, [ ] outdated
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
youknowone
added a commit
that referenced
this pull request
Sep 16, 2026
Keep host certificate path probing with the native certificate provider, select the first available OpenSSL-style file and directory, and leave environment overrides to ssl.py. This also gives Android string defaults instead of the previous None values.
Co-authored-by: Ivan Mironov <[email protected]>
Assisted-by: OpenAI Codex: GPT-5
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.