tests: fix ssl generation#3365
Merged
Merged
Conversation
the "integration-dind-ssl" tests were failing due to an issue with the
test-certs created;
==================================== ERRORS ====================================
_________ ERROR at setup of BuildTest.test_build_container_with_target _________
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:464: in _make_request
self._validate_conn(conn)
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:1093: in _validate_conn
conn.connect()
/usr/local/lib/python3.12/site-packages/urllib3/connection.py:790: in connect
sock_and_verified = _ssl_wrap_socket_and_match_hostname(
/usr/local/lib/python3.12/site-packages/urllib3/connection.py:969: in _ssl_wrap_socket_and_match_hostname
ssl_sock = ssl_wrap_socket(
/usr/local/lib/python3.12/site-packages/urllib3/util/ssl_.py:480: in ssl_wrap_socket
ssl_sock = _ssl_wrap_socket_impl(sock, context, tls_in_tls, server_hostname)
/usr/local/lib/python3.12/site-packages/urllib3/util/ssl_.py:524: in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
/usr/local/lib/python3.12/ssl.py:455: in wrap_socket
return self.sslsocket_class._create(
/usr/local/lib/python3.12/ssl.py:1041: in _create
self.do_handshake()
/usr/local/lib/python3.12/ssl.py:1319: in do_handshake
self._sslobj.do_handshake()
E ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1010)
During handling of the above exception, another exception occurred:
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:787: in urlopen
response = self._make_request(
/usr/local/lib/python3.12/site-packages/urllib3/connectionpool.py:488: in _make_request
raise new_e
E urllib3.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: invalid CA certificate (_ssl.c:1010)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
There was a problem hiding this comment.
Pull Request Overview
This PR fixes SSL certificate generation issues in the integration test suite. The changes address certificate verification failures by properly configuring CA, server, and client certificates with correct X.509 v3 extensions and key usage attributes.
- Adds proper v3_ca extension configuration for the Certificate Authority
- Implements correct key usage and extended key usage for server certificates
- Configures proper client authentication extensions for client certificates
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
vvoland
approved these changes
Oct 14, 2025
mergify Bot
added a commit
to ArcadeData/arcadedb
that referenced
this pull request
Jul 12, 2026
…e-python [skip ci] Updates the requirements on [docker](https://github.com/docker/docker-py) to permit the latest version. Release notes *Sourced from [docker's releases](https://github.com/docker/docker-py/releases).* > 7.2.0 > ----- > > Upgrade Notes > ------------- > > * `docker.from_env()` now honors the active Docker CLI context when `DOCKER_HOST` is not set. > + This means the client may connect to the daemon selected by `DOCKER_CONTEXT` or the current context in `~/.docker/config.json`, matching Docker CLI behavior more closely. > + If your application relied on the previous default connection behavior, set `DOCKER_HOST` explicitly, set `DOCKER_CONTEXT=default`, or pass `use_context=False` to `DockerClient.from_env()`. > * Added `docker.from_context()` / `DockerClient.from_context()` for explicitly creating a client from a Docker CLI context. > > Features > -------- > > * Added support for Docker contexts when creating the default client > * Added subpath support for volumes > > Bugfixes > -------- > > * Fixed `exec_run` documentation for the `stream` parameter > * Fixed image loading to avoid depending on the deprecated `JSONMessage.error` field > * Preserved the rotated unlock key in swarm integration tests > * Fixed SSL certificate generation in tests > * Fixed IPv6 integration tests by explicitly enabling IPv6 where required > > Miscellaneous > ------------- > > * Updated tests for newer Docker Engine behavior > * CI and build updates > > What's Changed > -------------- > > * tests/exec: expect 127 exit code for missing executable by [`@laurazard`](https://github.com/laurazard) in [docker/docker-py#3290](https://redirect.github.com/docker/docker-py/pull/3290) > * fixing doc for stream param in exec\_run by [`@yasonk`](https://github.com/yasonk) in [docker/docker-py#3292](https://redirect.github.com/docker/docker-py/pull/3292) > * Bump default API version to 1.45 (Moby 26.0/26.1) by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3261](https://redirect.github.com/docker/docker-py/pull/3261) > * Set a dummy-version if none set, and remove unused APT\_MIRROR build-arg by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3267](https://redirect.github.com/docker/docker-py/pull/3267) > * test\_service\_logs: stop testing experimental versions by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#2442](https://redirect.github.com/docker/docker-py/pull/2442) > * Makefile: fix circular reference for integration-dind by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3297](https://redirect.github.com/docker/docker-py/pull/3297) > * image load: don't depend on deprecated JSONMessage.error field by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3307](https://redirect.github.com/docker/docker-py/pull/3307) > * integration: test\_create\_volume\_invalid\_driver allow either 400 or 404 by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3296](https://redirect.github.com/docker/docker-py/pull/3296) > * integration: adjust tests for omitted "OnBuild" by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3336](https://redirect.github.com/docker/docker-py/pull/3336) > * Implement Subpath Support for Volumes in Docker-Py ([#3243](https://redirect.github.com/docker/docker-py/issues/3243)) by [`@Khushiyant`](https://github.com/Khushiyant) in [docker/docker-py#3270](https://redirect.github.com/docker/docker-py/pull/3270) > * tests: fix ssl generation by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3365](https://redirect.github.com/docker/docker-py/pull/3365) > * test/integration: don't check for deprecated Networks field by [`@thaJeztah`](https://github.com/thaJeztah) in [docker/docker-py#3362](https://redirect.github.com/docker/docker-py/pull/3362) > * test: Skip from\_env\_unix tests if DOCKER\_HOST is network socket by [`@ricardobranco777`](https://github.com/ricardobranco777) in [docker/docker-py#3366](https://redirect.github.com/docker/docker-py/pull/3366) > * test\_connect\_with\_ipv6\_address: enable IPv6 by [`@robmry`](https://github.com/robmry) in [docker/docker-py#3372](https://redirect.github.com/docker/docker-py/pull/3372) > * test\_create\_with\_ipv6\_address: enable IPv6 by [`@robmry`](https://github.com/robmry) in [docker/docker-py#3373](https://redirect.github.com/docker/docker-py/pull/3373) > * tests: Migrate off gpg2 and regenerate key ed25519 by [`@vvoland`](https://github.com/vvoland) in [docker/docker-py#3399](https://redirect.github.com/docker/docker-py/pull/3399) > * gha: Pin to digests by [`@vvoland`](https://github.com/vvoland) in [docker/docker-py#3408](https://redirect.github.com/docker/docker-py/pull/3408) > * Fix integration tests on non-amd64 hosts and add ARM64 CI by [`@vvoland`](https://github.com/vvoland) in [docker/docker-py#3407](https://redirect.github.com/docker/docker-py/pull/3407) > * integration/swarm: Preserve rotated unlock key by [`@vvoland`](https://github.com/vvoland) in [docker/docker-py#3410](https://redirect.github.com/docker/docker-py/pull/3410) > * [DKP-2535] Honour context if present for default client, add contexts support by [`@ebriney`](https://github.com/ebriney) in [docker/docker-py#3401](https://redirect.github.com/docker/docker-py/pull/3401) > * docs: 7.2.0 changelog by [`@vvoland`](https://github.com/vvoland) in [docker/docker-py#3415](https://redirect.github.com/docker/docker-py/pull/3415) > > New Contributors > ---------------- > > * [`@laurazard`](https://github.com/laurazard) made their first contribution in [docker/docker-py#3290](https://redirect.github.com/docker/docker-py/pull/3290) > * [`@yasonk`](https://github.com/yasonk) made their first contribution in [docker/docker-py#3292](https://redirect.github.com/docker/docker-py/pull/3292) > * [`@ricardobranco777`](https://github.com/ricardobranco777) made their first contribution in [docker/docker-py#3366](https://redirect.github.com/docker/docker-py/pull/3366) ... (truncated) Commits * [`5ad5327`](docker/docker-py@5ad5327) Merge pull request [#3415](https://redirect.github.com/docker/docker-py/issues/3415) from vvoland/update-changelog * [`d242230`](docker/docker-py@d242230) docs: 7.2.0 changelog * [`ba01cc7`](docker/docker-py@ba01cc7) Merge pull request [#3401](https://redirect.github.com/docker/docker-py/issues/3401) from ebriney/client-from-context * [`ae5dfe9`](docker/docker-py@ae5dfe9) Merge pull request [#3410](https://redirect.github.com/docker/docker-py/issues/3410) from vvoland/fix-flaky * [`aa99999`](docker/docker-py@aa99999) integration/swarm: Preserve rotated unlock key * [`059d371`](docker/docker-py@059d371) Merge pull request [#3407](https://redirect.github.com/docker/docker-py/issues/3407) from vvoland/fix-arm64 * [`9b4b9b8`](docker/docker-py@9b4b9b8) gha: Add arm64 integration CI * [`9e9f8ff`](docker/docker-py@9e9f8ff) Skip tests incompatible with host architecture * [`e0542d9`](docker/docker-py@e0542d9) Merge pull request [#3408](https://redirect.github.com/docker/docker-py/issues/3408) from vvoland/gha-pin * [`578a11d`](docker/docker-py@578a11d) gha: Pin to digests * Additional commits viewable in [compare view](docker/docker-py@7.1.0...7.2.0) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
the "integration-dind-ssl" tests were failing due to an issue with the test-certs created;