PYTHON-5775 Coverage increase for `ocsp_support.py` by aclark4life · Pull Request #2763 · mongodb/mongo-python-driver

aclark4life · 2026-04-17T01:38:16Z

Changes in this PR

Adds test/test_ocsp_support.py with 58 unit tests for pymongo/ocsp_support.py:

_get_issuer_cert() (4) — issuer found in chain, in trusted CAs, not found returns None, no candidates.
_verify_signature() (7) — RSA / ECDSA / DSA / X25519 / X448 (skip-verify path), invalid-signature returns 0, fallback key path.
_get_extension() (2) — extension present returns the value, missing extension returns None via ExtensionNotFound.
_public_key_hash() (3) — RSA / EC / fallback key serialization paths.
_get_certs_by_key_hash() / _get_certs_by_name() (4) — match, no-match, and responder-name filtering.
_verify_response_signature() (8) — direct-issuer signing (by name and by key hash), delegated responder cert lookup (by key hash and by name), missing OCSP-signing EKU, signature verification failures.
_verify_response() (6) — successful, unauthorized / try-later / malformed-request response statuses, GOOD / REVOKED / UNKNOWN cert statuses.
_get_ocsp_response() (7) — request build, HTTP POST, RequestException handling, non-200 status, OCSP response parse, cache write on success.
_ocsp_callback() (17) — must-staple enforcement, AIA-URL absent / present, cached responses, response-validation outcomes, end-to-end accept / reject paths.

External dependencies (cryptography x509/OCSP types, requests.post) are mocked via unittest.mock so no network or real certificates are required.

The module is gated with pytestmark = pytest.mark.ocsp and pytest.importorskip("cryptography") so it is excluded from the default suite and skipped when the ocsp extra is not installed.

Test Plan

uv run --extra ocsp --extra test python -m pytest test/test_ocsp_support.py -v -m ocsp

Checklist

Checklist for Author

Did you update the changelog (if necessary)?
Is there test coverage?
Is any followup work tracked in a JIRA ticket? If so, add link(s).

Checklist for Reviewer

Does the title of the PR reference a JIRA Ticket?
Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
Is all relevant documentation (README or docstring) updated?

codecov-commenter · 2026-04-17T01:48:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copilot

Pull request overview

Adds a new unit test module to substantially increase coverage of pymongo.ocsp_support, exercising OCSP request/response building and verification logic as well as the OCSP callback behavior.

Changes:

Introduces test/test_ocsp_support.py with extensive unit tests for pymongo.ocsp_support helper functions and callback flows.
Adds coverage for multiple success/failure branches (signature verification, EKU handling, timestamp validation, cache behavior, and stapled vs non-stapled OCSP).

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

sleepyStick

I think these test failures are related to the changes you've made? Can you look into it?
ex:

[2026/04/20 17:26:06.299] ERROR: collection failure ()
[2026/04/20 17:26:06.299] ImportError while importing test module '/data/mci/eab0c9621d344811fb525a305df0a895/src/test/test_ocsp_[support.py](http://support.py/)'.
[2026/04/20 17:26:06.299] Hint: make sure your test modules/packages have valid Python names.
[2026/04/20 17:26:06.299] Traceback:
[2026/04/20 17:26:06.299] /opt/python/pypy3.11/lib/pypy3.11/importlib/__init__.py:126: in import_module
[2026/04/20 17:26:06.299]     return _bootstrap._gcd_import(name[level:], package, level)
[2026/04/20 17:26:06.299]            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[2026/04/20 17:26:06.299] test/test_ocsp_[support.py:30](http://support.py:30/): in <module>
[2026/04/20 17:26:06.299]     from cryptography.exceptions import InvalidSignature
[2026/04/20 17:26:06.299] E   ModuleNotFoundError: No module named 'cryptography'

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

+    def test_rsa_valid(self):
+        key = MagicMock(spec=RSAPublicKey)
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1)
+        key.verify.assert_called_once()
+
+    def test_rsa_invalid(self):
+        key = MagicMock(spec=RSAPublicKey)
+        key.verify.side_effect = InvalidSignature()
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 0)
+
+    def test_dsa_valid(self):
+        key = MagicMock(spec=DSAPublicKey)
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1)
+        key.verify.assert_called_once()
+
+    def test_ec_valid(self):
+        key = MagicMock(spec=EllipticCurvePublicKey)
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1)
+        key.verify.assert_called_once()
+
+    def test_x25519_skips_verify(self):
+        key = MagicMock(spec=X25519PublicKey)
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1)
+
+    def test_x448_skips_verify(self):
+        key = MagicMock(spec=X448PublicKey)
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1)
+
+    def test_other_key_valid(self):
+        key = Mock()
+        self.assertEqual(_verify_signature(key, b"sig", Mock(), b"data"), 1)


+    def test_rsa(self):
+        key = MagicMock(spec=RSAPublicKey)
+        key.public_bytes.return_value = b"rsa_key_bytes"
+        cert = Mock()
+        cert.public_key.return_value = key
+        result = _public_key_hash(cert)
+        self.assertEqual(len(result), 20)  # SHA-1 digest
+
+    def test_ec(self):
+        key = MagicMock(spec=EllipticCurvePublicKey)
+        key.public_bytes.return_value = b"ec_key_bytes"
+        cert = Mock()
+        cert.public_key.return_value = key
+        result = _public_key_hash(cert)
+        self.assertEqual(len(result), 20)
+
+    def test_other_key_type(self):
+        key = Mock()
+        key.public_bytes.return_value = b"other_key_bytes"
+        cert = Mock()
+        cert.public_key.return_value = key
+        result = _public_key_hash(cert)
+        self.assertEqual(len(result), 20)
+


Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Ensures tests only run when OCSP dependencies (cryptography, requests) are installed, preventing failures in environments with only pymongo[test].

blink1073 · 2026-06-02T22:50:23Z

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Unit tests for pymongo.ocsp_support."""


There is an existing test/ocsp/test_ocsp.py. Perhaps we should move that up a level and merge it with these changes. It was originally in the sub-folder when we used unittest discovery, but now that it has a pytest marker we can move it up.

blink1073

LGTM!

aclark4life changed the title ~~PYTHON-5778 Add unit tests for ocsp_support.py to increase coverage~~ PYTHON-5778 Increase code coverage for ocsp_support.py Apr 20, 2026

aclark4life changed the title ~~PYTHON-5778 Increase code coverage for ocsp_support.py~~ PYTHON-5778 Increase ocsp_support.py coverage from 57.64% to ~99% Apr 20, 2026

aclark4life changed the title ~~PYTHON-5778 Increase ocsp_support.py coverage from 57.64% to ~99%~~ PYTHON-5778 Increase ocsp_support.py coverage from 57.64% to >=80% Apr 20, 2026

aclark4life changed the title ~~PYTHON-5778 Increase ocsp_support.py coverage from 57.64% to >=80%~~ PYTHON-5775 Increase ocsp_support.py coverage from 57.64% to >=80% Apr 20, 2026

aclark4life force-pushed the PYTHON-5775 branch 2 times, most recently from c24daf7 to 8ead683 Compare April 20, 2026 22:28

aclark4life marked this pull request as ready for review April 20, 2026 22:29

aclark4life requested a review from a team as a code owner April 20, 2026 22:29

aclark4life requested review from Copilot and sleepyStick April 20, 2026 22:29

Copilot started reviewing on behalf of aclark4life April 20, 2026 22:30 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Comment thread test/test_ocsp_support.py Outdated

Comment thread test/test_ocsp_support.py Outdated

aclark4life requested a review from Copilot April 21, 2026 00:21

Copilot started reviewing on behalf of aclark4life April 21, 2026 00:22 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

Comment thread test/test_ocsp_support.py

aclark4life requested a review from Copilot April 21, 2026 21:26

Copilot started reviewing on behalf of aclark4life April 21, 2026 21:26 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

Comment thread test/test_ocsp_support.py

aclark4life changed the title ~~PYTHON-5775 Increase ocsp_support.py coverage from 57.64% to >=80%~~ PYTHON-5775 Increase coverage for ocsp_support.py Apr 24, 2026

aclark4life changed the title ~~PYTHON-5775 Increase coverage for ocsp_support.py~~ PYTHON-5775 Increase code coverage for ocsp_support.py Apr 24, 2026

sleepyStick requested changes Apr 27, 2026

View reviewed changes

aclark4life force-pushed the PYTHON-5775 branch 2 times, most recently from 7a0d508 to 258977e Compare May 6, 2026 02:05

aclark4life requested a review from sleepyStick May 6, 2026 02:08

sleepyStick previously approved these changes May 6, 2026

View reviewed changes

aclark4life force-pushed the PYTHON-5775 branch from 258977e to 1207062 Compare May 6, 2026 18:24

aclark4life marked this pull request as draft May 6, 2026 18:25

aclark4life dismissed sleepyStick’s stale review via 5b49e64 May 7, 2026 00:45

aclark4life force-pushed the PYTHON-5775 branch from 5b49e64 to 1418126 Compare May 7, 2026 00:45

aclark4life force-pushed the PYTHON-5775 branch from 5e75992 to a299e0c Compare May 7, 2026 01:42

aclark4life requested a review from Copilot May 7, 2026 02:02

aclark4life changed the title ~~PYTHON-5775 Increase code coverage for ocsp_support.py~~ PYTHON-5775 Improve code coverage for ocsp_support.py May 7, 2026

aclark4life changed the title ~~PYTHON-5775 Improve code coverage for ocsp_support.py~~ PYTHON-5775 Improve coverage for ocsp_support.py May 7, 2026

aclark4life changed the title ~~PYTHON-5775 Improve coverage for ocsp_support.py~~ PYTHON-5775 Improve coverage for ocsp_support.py May 7, 2026

aclark4life changed the title ~~PYTHON-5775 Improve coverage for ocsp_support.py~~ PYTHON-5775 Coverage improvements for ocsp_support.py May 7, 2026

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread test/test_ocsp_support.py

aclark4life changed the title ~~PYTHON-5775 Coverage improvements for ocsp_support.py~~ PYTHON-5775 Coverage improvement for ocsp_support.py May 7, 2026

aclark4life requested a review from Copilot May 7, 2026 02:29

Copilot started reviewing on behalf of aclark4life May 7, 2026 02:30 View session

aclark4life changed the title ~~PYTHON-5775 Coverage improvement for ocsp_support.py~~ PYTHON-5775 Coverage increase for ocsp_support.py May 7, 2026

Copilot AI reviewed May 7, 2026

View reviewed changes

aclark4life force-pushed the PYTHON-5775 branch from c706080 to 87bc26d Compare May 7, 2026 03:01

aclark4life requested a review from Copilot May 7, 2026 03:02

Copilot started reviewing on behalf of aclark4life May 7, 2026 03:03 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

aclark4life force-pushed the PYTHON-5775 branch 2 times, most recently from 0223ceb to 33256a0 Compare June 2, 2026 16:23

aclark4life marked this pull request as ready for review June 2, 2026 16:51

aclark4life requested a review from blink1073 June 2, 2026 19:38

aclark4life added 4 commits June 2, 2026 15:58

PYTHON-5778 Add unit tests for ocsp_support.py to increase coverage

1cbd68d

PYTHON-5775 Add pytest.mark.ocsp marker to test_ocsp_support.py

da9cfe1

Ensures tests only run when OCSP dependencies (cryptography, requests) are installed, preventing failures in environments with only pymongo[test].

Noah + Copilot feedback

78c9487

Claude feedback

a502a7b

aclark4life force-pushed the PYTHON-5775 branch from 6b83ed6 to a502a7b Compare June 2, 2026 19:58

blink1073 reviewed Jun 2, 2026

View reviewed changes

Steve feedback

2f385c0

blink1073 approved these changes Jun 3, 2026

View reviewed changes

aclark4life merged commit 079e329 into mongodb:master Jun 3, 2026
83 of 84 checks passed

aclark4life deleted the PYTHON-5775 branch June 3, 2026 01:20

Conversation

aclark4life commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes in this PR

Test Plan

Checklist

Checklist for Author

Checklist for Reviewer

Uh oh!

codecov-commenter commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

sleepyStick left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

blink1073 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

blink1073 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

aclark4life commented Apr 17, 2026 •

edited

Loading

codecov-commenter commented Apr 17, 2026 •

edited

Loading