ssl: pass test_ssl with the rustls backend by youknowone · Pull Request #8502 · RustPython/RustPython

youknowone · 2026-08-12T07:12:43Z

Summary

align the rustls/AWS-LC SSL backend with CPython-visible test_ssl behavior
verify TLS 1.2 and TLS 1.3 handshake signatures even when certificate-chain verification is disabled
recognize legacy self-issued X.509v1 trust anchors and report the expected SNI callback error reason
give debug-build Python worker threads an 8 MiB default stack so the threaded SSL test server does not hit the native stack guard
add a regression test that checks the actual pthread stack size on Linux and macOS

Root cause

Several rustls compatibility details diverged from the behavior expected by CPython's SSL tests. In addition, Rust's 2 MiB default worker-thread stack is too small for RustPython's unoptimized debug call chains: the threaded SSL server reached the native stack guard at a Python recursion depth of only 21. The stack override is debug-only, preserves explicit threading.stack_size() values, and leaves release behavior unchanged.

Impact

cargo run -- -m test test_ssl now completes successfully with all 196 enabled tests passing. The changes keep the non-OpenSSL rustls/AWS-LC implementation and improve handshake correctness and certificate compatibility.

Validation

cargo run -- -m test test_ssl
cargo run --release -- -m test test_ssl test_thread
cargo test -p rustpython-vm --features threading default_python_thread_stack_size_debug -- --nocapture
cargo test --workspace --exclude rustpython_wasm --exclude rustpython-venvlauncher --exclude rustpython-capi
(cd crates/capi && cargo test)
cargo fmt --all -- --check
cargo clippy --workspace --exclude rustpython_wasm --exclude rustpython-venvlauncher --exclude rustpython-capi --all-targets

The clippy run completed with only five pre-existing must_use_candidate warnings in rustpython-compiler-source.

Summary by CodeRabbit

Bug Fixes
- Improved TLS compatibility reporting for the AWS-LC/rustls backend.
- Corrected SNI error classification for clearer TLS failure handling.
- Recognized legacy self-issued certificates as valid certificate authorities where appropriate.
- TLS handshake signature verification now follows the configured provider’s supported schemes.
- Debug-mode Python threads now use a consistent default stack size on supported platforms, improving reliability.

Assisted-by: OpenAI Codex:GPT-5

coderabbitai · 2026-08-12T07:12:51Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: 460cda6e-470e-466c-9341-2e1a2eeb723b

📥 Commits

Reviewing files that changed from the base of the PR and between 2ab612f and fea9e04.

📒 Files selected for processing (1)

crates/stdlib/src/ssl.rs

🚧 Files skipped from review as they are similar to previous changes (1)

crates/stdlib/src/ssl.rs

📝 Walkthrough

Walkthrough

The PR updates AWS-LC rustls compatibility metadata and SNI error reporting, improves certificate and handshake signature verification, and sets an 8 MiB default stack for debug Python threads with Linux and macOS tests.

Changes

SSL behavior updates

Layer / File(s)	Summary
SSL metadata and SNI errors `crates/stdlib/src/ssl.rs`	The human-readable SSL version identifies the AWS-LC rustls backend. Numeric compatibility values remain unchanged. Unavailable SNI callback owners now use `PARSE_TLSEXT`.
Certificate and signature verification rules `crates/stdlib/src/ssl/cert.rs`	Self-issued X.509v1 certificates without extensions can classify as CA certificates. `NoVerifier` uses the configured provider for TLS 1.2 and TLS 1.3 signature verification and supported scheme discovery.

Debug thread stack sizing

Layer / File(s)	Summary
Debug stack default and validation `crates/vm/src/stdlib/_thread.rs`	Debug threads use an 8 MiB default stack when no explicit size is configured. Linux and macOS tests measure the native stack size.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

RustPython/RustPython#7657: Modifies related NoVerifier provider integration and SSL certificate verification logic.

Suggested labels: z-ca-2026

Suggested reviewers: shaharnaveh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: making the SSL test suite pass with the rustls backend.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

🧹 Nitpick comments (1)

crates/vm/src/stdlib/_thread.rs (1)
2034-2047: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover the explicit stack-size path.

The test only covers vm.state.stacksize == 0. Add a debug Linux/macOS test that sets a value larger than DEFAULT_THREAD_STACK_SIZE and verifies that the observed native stack size is at least that configured value. This verifies that an explicit threading.stack_size() value continues to override the debug default.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/vm/src/stdlib/_thread.rs` around lines 2034 - 2047, Add a debug
Linux/macOS test alongside default_python_thread_stack_size_debug that sets
vm.state.stacksize to a value larger than DEFAULT_THREAD_STACK_SIZE before
calling apply_thread_stack_size, then spawn and join current_thread_stack_size
and assert the observed size is at least the configured value. Keep the test
scoped to the supported debug platforms and verify the explicit stack-size
setting overrides the default.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/vm/src/stdlib/_thread.rs`:
- Around line 2034-2047: Add a debug Linux/macOS test alongside
default_python_thread_stack_size_debug that sets vm.state.stacksize to a value
larger than DEFAULT_THREAD_STACK_SIZE before calling apply_thread_stack_size,
then spawn and join current_thread_stack_size and assert the observed size is at
least the configured value. Keep the test scoped to the supported debug
platforms and verify the explicit stack-size setting overrides the default.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: b11c80dd-21cb-4f69-a121-1691a32525ec

📥 Commits

Reviewing files that changed from the base of the PR and between 81df1ff and 2ab612f.

📒 Files selected for processing (3)

crates/stdlib/src/ssl.rs
crates/stdlib/src/ssl/cert.rs
crates/vm/src/stdlib/_thread.rs

Assisted-by: OpenAI Codex:GPT-5

Fix rustls test_ssl compatibility

2ab612f

Assisted-by: OpenAI Codex:GPT-5

youknowone marked this pull request as ready for review August 12, 2026 07:17

coderabbitai Bot reviewed Aug 12, 2026

View reviewed changes

Keep urllib3 compatible SSL version prefix

fea9e04

Assisted-by: OpenAI Codex:GPT-5

youknowone merged commit 24bd3b3 into RustPython:main Aug 12, 2026
27 checks passed

youknowone deleted the RustPython-7 branch August 12, 2026 08:55

Navigation Menu

Uh oh!

ssl: pass test_ssl with the rustls backend - #8502

ssl: pass test_ssl with the rustls backend#8502
youknowone merged 2 commits into
RustPython:mainfrom
youknowone:RustPython-7

youknowone commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

youknowone commented Aug 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Impact

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

youknowone commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading