From ff3d05be49a3b067637107f83298066745dc5a1e Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 09:09:01 +0100 Subject: [PATCH] Set an explicit TLS floor for the synthetic PBS guide server CodeQL on PRs 2361 and 2362 flags the fixture's implicit protocol floor. Require TLS 1.2 explicitly and test that same context; retain trusted, untrusted and wrong-host certificate controls without changing product TLS or documentation. Contract-Neutral: Synthetic TLS test fixture only; no runtime or subsystem contract delta. Change-source: pulse-maintainer --- scripts/tests/test_pbs_docs.py | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/scripts/tests/test_pbs_docs.py b/scripts/tests/test_pbs_docs.py index fc19a7c2fd..d13c26dab5 100644 --- a/scripts/tests/test_pbs_docs.py +++ b/scripts/tests/test_pbs_docs.py @@ -62,6 +62,13 @@ def certificate(directory, name): return certificate, key +def server_context(cert, key): + context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) + context.minimum_version = ssl.TLSVersion.TLSv1_2 + context.load_cert_chain(str(cert), str(key)) + return context + + @contextmanager def server(cert, key, status=200, installer=None, installer_path="/install.sh"): requests = [] @@ -78,8 +85,7 @@ def server(cert, key, status=200, installer=None, installer_path="/install.sh"): pass http = HTTPServer(("127.0.0.1", 0), Handler) - context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) - context.load_cert_chain(str(cert), str(key)) + context = server_context(cert, key) http.socket = context.wrap_socket(http.socket, server_side=True) thread = threading.Thread(target=http.serve_forever, daemon=True) thread.start() @@ -102,6 +108,10 @@ class PBSDocsTest(unittest.TestCase): def tearDownClass(cls): cls.temporary.cleanup() + def test_tls_fixture_explicitly_rejects_legacy_protocols(self): + self.assertEqual(server_context(self.cert, self.key).minimum_version, + ssl.TLSVersion.TLSv1_2) + def test_shipped_copy_and_safe_scope(self): self.assertEqual(DOC.read_bytes(), (ROOT / "frontend-modern/public/docs/PBS.md").read_bytes()) text = DOC.read_text()