Tests for 4.0.0 failing on openSUSE Tumbleweed: ''

[kastl-ars]

Dear maintainers,

I just tried to update the openSUSE package for gql to 4.0.0 and found that some tests were failing in our build environment.

All of them seem to fail with the same error:

[   55s]         if cafile or capath or cadata:
[   55s] >           context.load_verify_locations(cafile, capath, cadata)
[   55s] E           FileNotFoundError: [Errno 2] No such file or directory
[   55s] 
[   55s] /usr/lib64/python3.11/ssl.py:770: FileNotFoundError

The list of failing tests is:

[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_query - FileNotFound...
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_sync_batch_query - FileNotFoundE...
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_query_without_session
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_error_code - FileNot...
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[{}]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[qlsjfqsdlkj]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[{"not_data_or_errors": 35}]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[[{}]]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[[qlsjfqsdlkj]]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[[{"not_data_or_errors": 35}]]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[[]]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_invalid_protocol[[1]]
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_extra_args - FileNot...
[   55s] FAILED tests/test_httpx_batch.py::test_httpx_async_batch_query_with_extensions

Any idea which file(s) is/are not being found here?

Kind Regards,
Johannes

P.S.: A full trace would look like this:

[   56s] _________________ test_httpx_async_batch_query_with_extensions _________________
[   56s]                                     
[   56s] aiohttp_server = <function aiohttp_server_base.<locals>.go at 0x7ff2e974a980>
[   56s]                                                                                                                      
[   56s]     @pytest.mark.aiohttp                                                                                             
[   56s]     @pytest.mark.asyncio
[   56s]     async def test_httpx_async_batch_query_with_extensions(aiohttp_server):
[   56s]         from aiohttp import web                                                                                      
[   56s]                                                      
[   56s]         from gql.transport.httpx import HTTPXAsyncTransport
[   56s]                                          
[   56s]         async def handler(request):         
[   56s]             return web.Response(                     
[   56s]                 text=query1_server_answer_with_extensions_list,
[   56s]                 content_type="application/json",
[   56s]             )
[   56s]                                       
[   56s]         app = web.Application()                                                                                      
[   56s]         app.router.add_route("POST", "/", handler)                                                                   
[   56s]         server = await aiohttp_server(app)
[   56s]                                                    
[   56s]         url = str(server.make_url("/"))                                                                              
[   56s]                     
[   56s]         transport = HTTPXAsyncTransport(url=url)                                                                     
[   56s]                                                                                                                      
[   56s]         query = [GraphQLRequest(query1_str)]                                                                         
[   56s]                      
[   56s] >       async with Client(transport=transport) as session:                                                                                                                                                                                          [   56s]                                       
[   56s] tests/test_httpx_batch.py:369:                   
[   56s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
[   56s] gql/client.py:803: in __aenter__                                                                                     
[   56s]     return await self.connect_async()                                                                                
[   56s]            ^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                
[   56s] gql/client.py:782: in connect_async                                                                                  
[   56s]     await self.session.connect()                                                                                     
[   56s] gql/client.py:1851: in connect                                                                                       
[   56s]     raise e                                                                                                          
[   56s] gql/client.py:1848: in connect                                                                                       
[   56s]     await self.transport.connect()                                                                                   
[   56s] gql/transport/httpx.py:329: in connect                                                                               
[   56s]     self.client = httpx.AsyncClient(**self.kwargs)                                                                   
[   56s]                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                   
[   56s] /usr/lib/python3.11/site-packages/httpx/_client.py:1402: in __init__         
[   56s]     self._transport = self._init_transport(                                                                          
[   56s] /usr/lib/python3.11/site-packages/httpx/_client.py:1445: in _init_transport     
[   56s]     return AsyncHTTPTransport(                                                                                       
[   56s] /usr/lib/python3.11/site-packages/httpx/_transports/default.py:297: in __init__ 
[   56s]     ssl_context = create_ssl_context(verify=verify, cert=cert, trust_env=trust_env)
[   56s]                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[   56s] /usr/lib/python3.11/site-packages/httpx/_config.py:40: in create_ssl_context
[   56s]     ctx = ssl.create_default_context(cafile=certifi.where())
[   56s]           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[   56s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _     
[   56s] 
[   56s] purpose = <Purpose.SERVER_AUTH: _ASN1Object(nid=129, shortname='serverAuth', longname='TLS Web Server Authentication', oid='1.3.6.1.5.5.7.3.1')>
[   56s]                     
[   56s]     def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
[   56s]                                capath=None, cadata=None):
[   56s]         """Create a SSLContext object with default settings.                                 
[   56s]                                            
[   56s]         NOTE: The protocol and settings may change anytime without prior
[   56s]               deprecation. The values represent a fair balance between maximum
[   56s]               compatibility and security.
[   56s]         """
[   56s]         if not isinstance(purpose, _ASN1Object):
[   56s]             raise TypeError(purpose)
[   56s]     
[   56s]         # SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION,
[   56s]         # OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE
[   56s]         # by default.
[   56s]         if purpose == Purpose.SERVER_AUTH:
[   56s]             # verify certs and host name in client mode
[   56s]             context = SSLContext(PROTOCOL_TLS_CLIENT)
[   56s]             context.verify_mode = CERT_REQUIRED
[   56s]             context.check_hostname = True
[   56s]         elif purpose == Purpose.CLIENT_AUTH:
[   56s]             context = SSLContext(PROTOCOL_TLS_SERVER)
[   56s]         else:
[   56s]             raise ValueError(purpose)
[   56s]     
[   56s]         if cafile or capath or cadata:
[   56s] >           context.load_verify_locations(cafile, capath, cadata)
[   56s] E           FileNotFoundError: [Errno 2] No such file or directory
[   56s] 
[   56s] /usr/lib64/python3.11/ssl.py:770: FileNotFoundError

[leszekhanusz]

Here is Gemini's answer:

The issue the openSUSE maintainer is running into is related to how the certifi package is modified on openSUSE systems and how it interacts with an isolated build environment.

Here's a breakdown of what is happening:

1. The Error Trace: The tests are failing when the httpx transport in gql initializes an httpx.AsyncClient. By default, httpx creates an SSL context for making HTTPS requests and calls certifi.where() to find the path to the trusted Certificate Authority (CA) bundle.
2. OpenSUSE's Patched certifi: In standard Python environments, the certifi package comes bundled with its own CA certificates file. However, openSUSE (and many other Linux distributions) patches the python-certifi package so that certifi.where() returns the path to the system-wide CA certificates bundle (typically /var/lib/ca-certificates/ca-bundle.pem or /etc/ssl/ca-bundle.pem) instead of using a bundled file. They do this to ensure that all applications use a single, centrally managed trust store.
3. The Root Cause: When building and testing packages on the openSUSE Build Service (OBS), tests are executed in a highly minimal, isolated environment (a chroot). In these minimal environments, the system certificates package (ca-certificates or ca-certificates-mozilla) is not installed by default. Therefore, certifi.where() returns a path to a file that should exist on an openSUSE system, but it doesn't exist in that specific isolated build container.

When the ssl module attempts to load the certificates from that non-existent path during the test run, it throws the FileNotFoundError.

How the maintainer can fix it

You can let Johannes know that the missing file is the system CA bundle (like /etc/ssl/ca-bundle.pem).

The standard fix for this in openSUSE packaging is to ensure the certificates are present during the test phase by adding ca-certificates or ca-certificates-mozilla to the BuildRequires in the package's .spec file.

For example, they would need to add:

BuildRequires:  ca-certificates
# or depending on the exact openSUSE setup:
BuildRequires:  ca-certificates-mozilla

This will install the missing system certificates in their build environment, satisfying the path returned by their patched certifi module and allowing the tests to pass.

[kastl-ars]

Thanks for the quick reply. Unfortunately I tested adding both of the mentioned packages already, but still the builds fail as the file does NOT exist...

But I will dig deeper, you confirmed my hunch that a system file might be failing...

[leszekhanusz]

You could try to modify a test to print where certifi.where() is pointing

[leszekhanusz]

@kastl-ars did you find out what was the issue?