Repository navigation
🧪 Silence pyOpenSSL deprecation warnings instead - #852
Conversation
pyba-chronographer
Bot
added
the
bot:chronographer:provided
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #852 +/- ##
=======================================
Coverage 78.20% 78.20%
=======================================
Files 41 41
Lines 4791 4791
Branches 548 548
=======================================
Hits 3747 3747
Misses 905 905
Partials 139 139 |
webknjaz
changed the title
| @@ -0,0 +1,13 @@ | |||
| Silenced the ``DeprecationWarning``\ s that :pypi:`pyOpenSSL` 26.3.0+ | |||
| raises for | |||
There was a problem hiding this comment.
the library doesn't raise warnings as exceptions so don't make it sound like it does:
| raises for | |
| emits for |
It only sends warnings through standard machinery and our filterwarnings=error in the pytest config is what elevates warnings to errors.
This is our doing, which also means this is not a bug and the change note should be in the contrib category, not bugfix.
| @@ -0,0 +1,13 @@ | |||
| Silenced the ``DeprecationWarning``\ s that :pypi:`pyOpenSSL` 26.3.0+ | |||
There was a problem hiding this comment.
| Silenced the ``DeprecationWarning``\ s that :pypi:`pyOpenSSL` 26.3.0+ | |
| Silenced the :exc:`DeprecationWarning`\ s that :pypi:`pyOpenSSL` 26.3.0+ |
| and | ||
| :external+pyopenssl:py:meth:`X509.get_subject <OpenSSL.crypto.X509.get_subject>` | ||
| -- treated as hard errors here since warnings are configured to fail | ||
| the test suite. A real migration away from these deprecated calls is |
There was a problem hiding this comment.
This phrasing sounds awfully like an LLM output.
There was a problem hiding this comment.
Does the note have to be this verbose? Try leaving the important points without going into too much noise.
pyOpenSSL 26.3.0+ emits DeprecationWarning for Context.set_passwd_cb, X509.get_issuer, and X509.get_subject -- our own filterwarnings=error config is what turns those into hard test failures, not pyOpenSSL itself. Add filterwarnings entries for the exact messages instead of the real migration tracked in cherrypy#846, as a lower-effort stopgap to keep the suite green against newer pyOpenSSL releases. Verified against a real pyOpenSSL 26.4.0 install (the lockfile-pinned 25.3.0 doesn't trigger these yet): the full suite genuinely fails without the filters (30 failures) and passes clean with them (200 passed, 0 failures).
3ce0fbd to
1f3d21e
Compare
| ignore:Context.set_passwd_cb is deprecated. You should decrypt and load your private key yourself, with cryptography's key loading APIs, and then use Context.use_privatekey instead.:DeprecationWarning | ||
| ignore:X509.get_issuer is deprecated. You should use cryptography's X.509 APIs instead.:DeprecationWarning | ||
| ignore:X509.get_subject is deprecated. You should use cryptography's X.509 APIs instead.:DeprecationWarning |
There was a problem hiding this comment.
Could you add a trailing :importable.module.path to scope them so they don't apply to everything but only allow this warning to be dismissed in that one single module?
There was a problem hiding this comment.
I tried this but had issues with set_passwd_cb - test_openssl_adapter_with_false_key_password[too-long-password] fails when the ignore is scoped because this test uses pytest.warns to look for UserWarning about the password being too long but when it sees the deprecation warning it hands it back labeled with the module _py_warnings, so the scoped ignore doesn't match.
Maybe scope the other two but not set_passwd_cb? Otherwise I would have to modify the test I guess.
There was a problem hiding this comment.
Okay then. It'd be too much for for little gain. It's probably worth looking into improving test layering, maybe. But not sure if it's a priority right now. So let's not block on it.
The previous commit stops calling Context.set_passwd_cb, X509.get_issuer, and X509.get_subject, so these three filterwarnings entries (added as a stopgap in cherrypy#852) never match anything anymore.
What kind of change does this PR introduce?
What do these changes do?
pyOpenSSL 26.3.0+ raises DeprecationWarning for Context.set_passwd_cb, X509.get_issuer, and X509.get_subject — treated as hard errors here since warnings are configured to fail the test suite.
This is blocking the CI today. #808 (an automated pip-tools dependency bump) currently fails on Python 3.12 because of exactly this warning, and that single failure cascades via fail-fast into canceling every other job in its Tests matrix — making an otherwise-routine, unrelated maintenance PR look completely broken.
This PR adds filterwarnings entries for the exact messages instead of the real migration in #846, as a stopgap to unblock #808 now, while the long term fix proceeds separately.
Are there changes in behavior for the user?
No — this only changes the test suite's warning-filter configuration. It doesn't affect cheroot's runtime behavior for anyone using the library.
Is it a substantial burden for the maintainers to support this?
Minor, and temporary by design.
Related issue number
This is a temporary patch that can be removed once #846 or equivalent lands.
Checklist
and description in grammatically correct, complete sentences
docs/) and inline docstrings reflect the changes(see good commit messages)
(can be done once the PR number is known; alternatively, you can
use a related issue number if one exists)
code of conduct