From 79b142421b88d43066bae7a099c132326a558da6 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 3 Sep 2026 05:58:43 -0500 Subject: [PATCH 1/2] PYTHON-6071 Fix ML-KEM OCSP tests to not depend on cryptography backend support --- test/test_ocsp_support.py | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/test/test_ocsp_support.py b/test/test_ocsp_support.py index f53ba248f2..294688a4a3 100644 --- a/test/test_ocsp_support.py +++ b/test/test_ocsp_support.py @@ -80,8 +80,8 @@ def test_tls(self): from cryptography.hazmat.primitives.asymmetric.dsa import DSAPublicKey from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey from cryptography.hazmat.primitives.asymmetric.mlkem import ( - MLKEM768PrivateKey, - MLKEM1024PrivateKey, + MLKEM768PublicKey, + MLKEM1024PublicKey, ) from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat @@ -189,13 +189,14 @@ class FakeX448: def test_mlkem768_fails_closed(self): # ML-KEM is a key encapsulation mechanism, so an ML-KEM public key has # no verify(). Certificate.public_key() can return one, which used to - # reach the generic branch and raise AttributeError. - key = MLKEM768PrivateKey.generate().public_key() - self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 0) + # reach the generic branch and raise AttributeError. A spec'd mock has + # no verify() either, so reaching that branch again would raise here too. + key = MagicMock(spec=MLKEM768PublicKey) + self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 0) # type: ignore[arg-type] def test_mlkem1024_fails_closed(self): - key = MLKEM1024PrivateKey.generate().public_key() - self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 0) + key = MagicMock(spec=MLKEM1024PublicKey) + self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 0) # type: ignore[arg-type] def test_other_key_valid(self): key = Mock() From 136cc3174427eebe72d7be2607c8fb1954c281eb Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Thu, 3 Sep 2026 06:04:39 -0500 Subject: [PATCH 2/2] PYTHON-6071 Run one min-deps and one latest-CPython stapled OCSP task on PRs --- .evergreen/generated_configs/tasks.yml | 5 ++--- .evergreen/generated_configs/variants.yml | 7 ++++++ .evergreen/scripts/generate_config.py | 27 ++++++++++++++++++++++- 3 files changed, 35 insertions(+), 4 deletions(-) diff --git a/.evergreen/generated_configs/tasks.yml b/.evergreen/generated_configs/tasks.yml index 9fe6b33406..94404d7828 100644 --- a/.evergreen/generated_configs/tasks.yml +++ b/.evergreen/generated_configs/tasks.yml @@ -898,6 +898,7 @@ tasks: - ocsp-ecdsa - "4.4" - ocsp-staple + - pr - name: test-ocsp-ecdsa-valid-cert-server-staples-v5.0-python3.10-min-deps commands: - func: run tests @@ -2162,7 +2163,7 @@ tasks: - ocsp-rsa - rapid - ocsp-staple - - name: test-ocsp-rsa-valid-cert-server-staples-latest-python3.14-cov + - name: test-ocsp-rsa-valid-cert-server-staples-latest-python3.14 commands: - func: run tests vars: @@ -2171,13 +2172,11 @@ tasks: TEST_NAME: ocsp TOOLCHAIN_VERSION: "3.14" VERSION: latest - COVERAGE: "1" tags: - ocsp - ocsp-rsa - latest - ocsp-staple - - pr - name: test-ocsp-rsa-invalid-cert-server-staples-v4.4-python3.10-min-deps commands: - func: run tests diff --git a/.evergreen/generated_configs/variants.yml b/.evergreen/generated_configs/variants.yml index 72af2599f7..9fe505c562 100644 --- a/.evergreen/generated_configs/variants.yml +++ b/.evergreen/generated_configs/variants.yml @@ -398,6 +398,13 @@ buildvariants: run_on: - rhel87-small batchtime: 10080 + - name: ocsp-staples-rhel8 + tasks: + - name: .ocsp-staple .pr + display_name: OCSP Staples RHEL8 + run_on: + - rhel87-small + tags: [pr] - name: ocsp-win64 tasks: - name: .ocsp-rsa !.ocsp-staple .latest diff --git a/.evergreen/scripts/generate_config.py b/.evergreen/scripts/generate_config.py index aaded3130c..033cdb6f6f 100644 --- a/.evergreen/scripts/generate_config.py +++ b/.evergreen/scripts/generate_config.py @@ -67,6 +67,18 @@ def create_ocsp_variants() -> list[BuildVariant]: batchtime=BATCHTIME_WEEK, ) variants.append(variant) + # Run the stapled OCSP tasks (tagged "pr") on every PR so cryptography-backend + # regressions, like the min-deps ML-KEM breakage in PYTHON-6032, are caught before merge + # instead of on the next weekly batch run. + if host == DEFAULT_HOST: + variants.append( + create_variant( + [".ocsp-staple .pr"], + get_variant_name("OCSP Staples", host), + tags=["pr"], + host=host, + ) + ) return variants @@ -992,7 +1004,20 @@ def _create_ocsp_tasks(algo, variant, server_type, base_task_name): tags = ["ocsp", f"ocsp-{algo}", version] if "disableStapling" not in variant: tags.append("ocsp-staple") - if base_task_name == "valid-cert-server-staples" and version == "latest": + # Run exactly one min-deps and one latest-CPython stapled OCSP task on + # every PR (ecdsa only, to avoid doubling coverage across algorithms) + # so a cryptography-backend regression at either dependency extreme, + # like the min-deps ML-KEM breakage in PYTHON-6032, is caught before + # merge instead of on the next weekly mainline batch run. + if ( + base_task_name == "valid-cert-server-staples" + and algo == "ecdsa" + and version + in ( + "latest", + "4.4", + ) + ): tags.append("pr") if "TEST_MIN_DEPS" not in vars: vars["COVERAGE"] = "1"