(superset) branch test/mariadb-tls-testcontainers updated: test(mariadb): make cert dir traversable and assert untrusted CA is rejected

[ru...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

rusackas pushed a commit to branch test/mariadb-tls-testcontainers
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/test/mariadb-tls-testcontainers by this push:
     new 7b30c79d1e9 test(mariadb): make cert dir traversable and assert untrusted CA is rejected
7b30c79d1e9 is described below

commit 7b30c79d1e922ea06d645c08b1f673a1f13a3fdb
Author: Evan Rusackas <ev...@rusackas.com>
AuthorDate: Wed Oct 21 12:40:31 2026 -0700

    test(mariadb): make cert dir traversable and assert untrusted CA is rejected
    
    Co-Authored-By: Evan Rusackas <ev...@preset.io>
    Co-Authored-By: Claude Sonnet 5.5 <no...@anthropic.com>
---
 .../testcontainers/db_engine_specs/test_mariadb.py | 28 ++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/tests/testcontainers/db_engine_specs/test_mariadb.py b/tests/testcontainers/db_engine_specs/test_mariadb.py
index 171aa2e1138..404fe488a89 100644
--- a/tests/testcontainers/db_engine_specs/test_mariadb.py
+++ b/tests/testcontainers/db_engine_specs/test_mariadb.py
@@ -267,6 +267,9 @@ def tls_container() -> Iterator[tuple[MySqlContainer, str]]:
     with tempfile.TemporaryDirectory() as cert_dir_str:
         cert_dir = Path(cert_dir_str)
         _write_self_signed_cert(cert_dir)
+        # TemporaryDirectory is 0700; the container's mysql user must be able
+        # to traverse the bind-mounted directory on Linux.
+        cert_dir.chmod(0o755)
         container = MySqlContainer(
             "mariadb:11",
             command=(
@@ -279,6 +282,31 @@ def tls_container() -> Iterator[tuple[MySqlContainer, str]]:
             yield started, str(cert_dir / "ca.pem")
 
 
+def test_require_mysql_tls_rejects_untrusted_ca(
+    tls_container: tuple[MySqlContainer, str], tmp_path: Path
+) -> None:
+    """
+    Guards the verification itself: a CA that did not sign the server's cert
+    must be rejected. `Ssl_cipher` alone only shows the session is encrypted,
+    so this fails if `ssl_ca` is dropped or ignored. `VERIFY_CA` is requested
+    explicitly so the outcome does not depend on which client library
+    mysqlclient links (plain `REQUIRED` only demands encryption on Oracle's).
+    """
+    container, _ = tls_container
+    _write_self_signed_cert(tmp_path)
+    wrong_ca = tmp_path / "ca.pem"
+    host = _tcp_host(container)
+    port = container.get_exposed_port(container.port)
+    uri, connect_args = _require_tls_connect_args(
+        f"ssl=1&ssl_mode=VERIFY_CA&ssl_ca={wrong_ca}"
+    )
+    uri = uri.set(host=host, port=int(port), database=container.dbname)
+    tls_engine = create_engine(uri, connect_args=connect_args)
+    with pytest.raises(OperationalError):
+        with tls_engine.connect():
+            pass
+
+
 def test_require_mysql_tls_connects_with_verified_tls(
     tls_container: tuple[MySqlContainer, str],
 ) -> None: