refactor(auth): replace pyOpenSSL with standard ssl and cryptography by nbayati · Pull Request #16976 · googleapis/google-cloud-python

refactor(auth): replace pyOpenSSL with standard ssl and cryptography

nbayati

committed

fix: resolve mypy and lint issues

nbayati

committed

fix: suppress interactive OpenSSL stdin passphrase prompts during mTLS cert loading fallbacks

nbayati

committed

add unit tests to mtls_helper

nbayati

committed

refactor(auth): use os.fdopen for writing to memfd in mtls helper and update tests accordingly

nbayati

committed

test(auth): fix failing test by updating mock_mds_mtls_config assertion to include empty password for client_combined_cert_path

nbayati

committed

fix nox failures

nbayati

committed

test: add edge case and error handling tests for _mtls_helper functions

nbayati

committed

fix lint error, again!

nbayati

committed

refactor(auth): address PR comments on imports, exit call, and safety checks

nbayati

committed

docs/refactor(auth): improve secure_cert_key_paths docstrings and refactor file writing into loops

nbayati

committed

refactor(auth): simplify fallback logic using custom exception and clean standard with block

nbayati

committed

refactor: add type annotations to paths variable in _mtls_helper.py

nbayati

committed

fix: unpack cryptography_base_require in DEPENDENCIES

nbayati

committed

fix(auth): wrap callback, certificate load and trust chain read errors in RefreshError

nbayati

committed

verify certificate path readability to prevent AppArmor/LSM crashes

nbayati

committed

wrap secure_cert_key_paths inside transport exception handlers

nbayati

committed

fix: catch ConnectionError in MDS client to allow HTTP fallback on connection resets

nbayati

committed

raise MutualTLSChannelError if custom TLS signer is used on unsupported runtimes

nbayati

committed

fix lint and mypy failre

nbayati

committed

fix(auth): handle FileNotFoundError for trust chain and mock os.access in tests

nbayati

committed

refactor(auth): remove redundant import and passphrase type fallback in transport adapters

nbayati

committed

docs(auth): document plaintext fallback behavior in mtls helper key encryption

nbayati

committed

fix(auth): call leaf cert callback outside of parse try block

nbayati

committed

refactor: extract _encode_cert to module level in identity_pool

nbayati

committed

refactor(auth): improve mTLS helper resource cleanup and test isolation

nbayati

committed

refactor: harden SSLContext pointer extraction to prevent crashes in unsupported runtimes

nbayati

committed

fix(auth): harden mTLS cryptography handling, tempfile cleanups, and async password formats

nbayati

committed

fix(auth): resolve mTLS connection pooling leaks, handle timeouts during fallback, and harden tests

nbayati

committed

test(auth): harden fallback and c-pointer tests, and update transport docstrings

nbayati

committed

build(auth): restore pyopenssl extra for backward compatibility and clean nox dependencies

nbayati

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor(auth): replace pyOpenSSL with standard ssl and cryptography#16976

refactor(auth): replace pyOpenSSL with standard ssl and cryptography#16976
nbayati wants to merge 31 commits into
googleapis:mainfrom
nbayati:remove-pyopenssl-dependency

Commits on Jul 1, 2026

refactor(auth): replace pyOpenSSL with standard ssl and cryptography

fix: resolve mypy and lint issues

fix: suppress interactive OpenSSL stdin passphrase prompts during mTLS cert loading fallbacks

add unit tests to mtls_helper

refactor(auth): use os.fdopen for writing to memfd in mtls helper and update tests accordingly

test(auth): fix failing test by updating mock_mds_mtls_config assertion to include empty password for client_combined_cert_path

fix nox failures

test: add edge case and error handling tests for _mtls_helper functions

fix lint error, again!

refactor(auth): address PR comments on imports, exit call, and safety checks

docs/refactor(auth): improve secure_cert_key_paths docstrings and refactor file writing into loops

refactor(auth): simplify fallback logic using custom exception and clean standard with block

refactor: add type annotations to paths variable in _mtls_helper.py

fix: unpack cryptography_base_require in DEPENDENCIES

fix(auth): wrap callback, certificate load and trust chain read errors in RefreshError

verify certificate path readability to prevent AppArmor/LSM crashes

wrap secure_cert_key_paths inside transport exception handlers

fix: catch ConnectionError in MDS client to allow HTTP fallback on connection resets

raise MutualTLSChannelError if custom TLS signer is used on unsupported runtimes

fix lint and mypy failre

fix(auth): handle FileNotFoundError for trust chain and mock os.access in tests

refactor(auth): remove redundant import and passphrase type fallback in transport adapters

docs(auth): document plaintext fallback behavior in mtls helper key encryption

fix(auth): call leaf cert callback outside of parse try block

refactor: extract _encode_cert to module level in identity_pool

refactor(auth): improve mTLS helper resource cleanup and test isolation

refactor: harden SSLContext pointer extraction to prevent crashes in unsupported runtimes

fix(auth): harden mTLS cryptography handling, tempfile cleanups, and async password formats

fix(auth): resolve mTLS connection pooling leaks, handle timeouts during fallback, and harden tests

test(auth): harden fallback and c-pointer tests, and update transport docstrings

build(auth): restore pyopenssl extra for backward compatibility and clean nox dependencies