PYTHON-5775 Coverage increase for ocsp_support.py#2763
Draft
aclark4life wants to merge 3 commits intomongodb:masterfrom
Draft
PYTHON-5775 Coverage increase for ocsp_support.py#2763aclark4life wants to merge 3 commits intomongodb:masterfrom
ocsp_support.py#2763aclark4life wants to merge 3 commits intomongodb:masterfrom
Conversation
aclark4life
changed the title
aclark4life
changed the title
aclark4life
changed the title
aclark4life
changed the title
aclark4life
force-pushed
the
PYTHON-5775
branch
2 times, most recently
from
c24daf7 to
8ead683
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new unit test module to substantially increase coverage of pymongo.ocsp_support, exercising OCSP request/response building and verification logic as well as the OCSP callback behavior.
Changes:
- Introduces
test/test_ocsp_support.pywith extensive unit tests forpymongo.ocsp_supporthelper functions and callback flows. - Adds coverage for multiple success/failure branches (signature verification, EKU handling, timestamp validation, cache behavior, and stapled vs non-stapled OCSP).
aclark4life
changed the title
aclark4life
changed the title
sleepyStick
requested changes
Apr 27, 2026
Contributor
sleepyStick
left a comment
sleepyStick
left a comment
There was a problem hiding this comment.
I think these test failures are related to the changes you've made? Can you look into it?
ex:
[2026/04/20 17:26:06.299] ERROR: collection failure ()
[2026/04/20 17:26:06.299] ImportError while importing test module '/data/mci/eab0c9621d344811fb525a305df0a895/src/test/test_ocsp_[support.py](http://support.py/)'.
[2026/04/20 17:26:06.299] Hint: make sure your test modules/packages have valid Python names.
[2026/04/20 17:26:06.299] Traceback:
[2026/04/20 17:26:06.299] /opt/python/pypy3.11/lib/pypy3.11/importlib/__init__.py:126: in import_module
[2026/04/20 17:26:06.299] return _bootstrap._gcd_import(name[level:], package, level)
[2026/04/20 17:26:06.299] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[2026/04/20 17:26:06.299] test/test_ocsp_[support.py:30](http://support.py:30/): in <module>
[2026/04/20 17:26:06.299] from cryptography.exceptions import InvalidSignature
[2026/04/20 17:26:06.299] E ModuleNotFoundError: No module named 'cryptography'
7a0d508 to
258977e
Compare
sleepyStick
previously approved these changes
May 6, 2026
Ensures tests only run when OCSP dependencies (cryptography, requests) are installed, preventing failures in environments with only pymongo[test].
aclark4life
force-pushed
the
PYTHON-5775
branch
3 times, most recently
from
5e75992 to
a299e0c
Compare
aclark4life
changed the title
aclark4life
changed the title
aclark4life
changed the title
ocsp_support.py
aclark4life
changed the title
ocsp_support.pyocsp_support.py
aclark4life
changed the title
ocsp_support.pyocsp_support.py
aclark4life
changed the title
ocsp_support.pyocsp_support.py
Comment on lines
+103
to
+133
| def test_rsa_valid(self): | ||
| key = MagicMock(spec=RSAPublicKey) | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1) | ||
| key.verify.assert_called_once() | ||
|
|
||
| def test_rsa_invalid(self): | ||
| key = MagicMock(spec=RSAPublicKey) | ||
| key.verify.side_effect = InvalidSignature() | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 0) | ||
|
|
||
| def test_dsa_valid(self): | ||
| key = MagicMock(spec=DSAPublicKey) | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1) | ||
| key.verify.assert_called_once() | ||
|
|
||
| def test_ec_valid(self): | ||
| key = MagicMock(spec=EllipticCurvePublicKey) | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1) | ||
| key.verify.assert_called_once() | ||
|
|
||
| def test_x25519_skips_verify(self): | ||
| key = MagicMock(spec=X25519PublicKey) | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1) | ||
|
|
||
| def test_x448_skips_verify(self): | ||
| key = MagicMock(spec=X448PublicKey) | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1) | ||
|
|
||
| def test_other_key_valid(self): | ||
| key = Mock() | ||
| self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1) |
Comment on lines
+150
to
+173
| def test_rsa(self): | ||
| key = MagicMock(spec=RSAPublicKey) | ||
| key.public_bytes.return_value = b"rsa_key_bytes" | ||
| cert = Mock() | ||
| cert.public_key.return_value = key | ||
| result = _public_key_hash(cert) | ||
| self.assertEqual(len(result), 20) # SHA-1 digest | ||
|
|
||
| def test_ec(self): | ||
| key = MagicMock(spec=EllipticCurvePublicKey) | ||
| key.public_bytes.return_value = b"ec_key_bytes" | ||
| cert = Mock() | ||
| cert.public_key.return_value = key | ||
| result = _public_key_hash(cert) | ||
| self.assertEqual(len(result), 20) | ||
|
|
||
| def test_other_key_type(self): | ||
| key = Mock() | ||
| key.public_bytes.return_value = b"other_key_bytes" | ||
| cert = Mock() | ||
| cert.public_key.return_value = key | ||
| result = _public_key_hash(cert) | ||
| self.assertEqual(len(result), 20) | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PYTHON-5775
Changes in this PR
Adds
test/test_ocsp_support.pywith 58 unit tests forpymongo/ocsp_support.py:_get_issuer_cert()(4) — issuer found in chain, in trusted CAs, not found returnsNone, no candidates._verify_signature()(7) — RSA / ECDSA / DSA / X25519 / X448 (skip-verify path), invalid-signature returns0, fallback key path._get_extension()(2) — extension present returns the value, missing extension returnsNoneviaExtensionNotFound._public_key_hash()(3) — RSA / EC / fallback key serialization paths._get_certs_by_key_hash()/_get_certs_by_name()(4) — match, no-match, and responder-name filtering._verify_response_signature()(8) — direct-issuer signing (by name and by key hash), delegated responder cert lookup (by key hash and by name), missing OCSP-signing EKU, signature verification failures._verify_response()(6) — successful, unauthorized / try-later / malformed-request response statuses, GOOD / REVOKED / UNKNOWN cert statuses._get_ocsp_response()(7) — request build, HTTP POST,RequestExceptionhandling, non-200 status, OCSP response parse, cache write on success._ocsp_callback()(17) — must-staple enforcement, AIA-URL absent / present, cached responses, response-validation outcomes, end-to-end accept / reject paths.External dependencies (
cryptographyx509/OCSP types,requests.post) are mocked viaunittest.mockso no network or real certificates are required.The module is gated with
pytestmark = pytest.mark.ocspandpytest.importorskip("cryptography")so it is excluded from the default suite and skipped when theocspextra is not installed.Test Plan
Checklist
Checklist for Author
Checklist for Reviewer