aprf-reader 0.6.0__tar.gz → 0.6.1__tar.gz

{aprf_reader-0.6.0/src/aprf_reader.egg-info → aprf_reader-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aprf-reader
-Version: 0.6.0
+Version: 0.6.1
 Summary: Summarise APRF (Aggregate Performance Reporting) inbox placement reports.
 License: MIT
 Requires-Python: >=3.11
@@ -79,7 +79,7 @@ marked read, moved or deleted. It reads messages whose subject contains
 from the `APRF_IMAP_PASSWORD` environment variable, or it asks. Gmail and
 Outlook.com need an app password, not your account password, and a Gmail
 label is read as a folder of the same name. The connection uses TLS on port
-993; give another port as `--imap host:port`. Files it skips are listed
+993 and checks the server's certificate; give another port as `--imap host:port`. Files it skips are listed
 on stderr and at the end of the summary, each with a reason.
 
 Each stream (provider, signing domain, selector) gets a table with one row per

{aprf_reader-0.6.0 → aprf_reader-0.6.1}/README.md

@@ -66,7 +66,7 @@ marked read, moved or deleted. It reads messages whose subject contains
 from the `APRF_IMAP_PASSWORD` environment variable, or it asks. Gmail and
 Outlook.com need an app password, not your account password, and a Gmail
 label is read as a folder of the same name. The connection uses TLS on port
-993; give another port as `--imap host:port`. Files it skips are listed
+993 and checks the server's certificate; give another port as `--imap host:port`. Files it skips are listed
 on stderr and at the end of the summary, each with a reason.
 
 Each stream (provider, signing domain, selector) gets a table with one row per

{aprf_reader-0.6.0 → aprf_reader-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aprf-reader"
-version = "0.6.0"
+version = "0.6.1"
 description = "Summarise APRF (Aggregate Performance Reporting) inbox placement reports."
 readme = "README.md"
 license = { text = "MIT" }

{aprf_reader-0.6.0 → aprf_reader-0.6.1}/src/aprf_reader/__init__.py

@@ -1,3 +1,3 @@
 """Read APRF aggregate performance reports."""
 
-__version__ = "0.6.0"
+__version__ = "0.6.1"

{aprf_reader-0.6.0 → aprf_reader-0.6.1}/src/aprf_reader/imap.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import imaplib
 import re
+import ssl
 from collections.abc import Iterator
 from datetime import date
 
@@ -26,6 +27,12 @@ def _check(typ: str, data: list, what: str) -> list:
     return data
 
 
+def _text(e: Exception) -> str:
+    # imaplib puts the server's reply bytes in the exception as they came
+    a = e.args[0] if e.args else ""
+    return a.decode(errors="replace") if isinstance(a, bytes) else str(e)
+
+
 def _quote(s: str) -> str:
     return '"' + s.replace("\\", "\\\\").replace('"', '\\"') + '"'
 
@@ -43,16 +50,17 @@ def fetch(host: str, user: str, password: str, folder: str = "INBOX", port: int
 
     The folder is opened read-only and bodies are fetched with BODY.PEEK, so no
     message is marked read, moved or deleted."""
-    m = conn or imaplib.IMAP4_SSL(host, port, timeout=60)
+    # imaplib's own default context checks neither the certificate nor the host name
+    m = conn or imaplib.IMAP4_SSL(host, port, ssl_context=ssl.create_default_context(), timeout=60)
     try:
         try:
             _check(*m.login(user, password), "login")
         except imaplib.IMAP4.error as e:
-            raise ImapError(f"login failed: {e}") from None
+            raise ImapError(f"login failed: {_text(e)}") from None
         try:
             _check(*m.select(_quote(folder), readonly=True), f"opening folder {folder}")
         except imaplib.IMAP4.error as e:
-            raise ImapError(f"opening folder {folder} failed: {e}") from None
+            raise ImapError(f"opening folder {folder} failed: {_text(e)}") from None
         (ids,) = _check(*m.uid("SEARCH", *criteria(since, every)), "search")
         uids = (ids or b"").split()
         if len(uids) > MAX_MESSAGES:

{aprf_reader-0.6.0 → aprf_reader-0.6.1/src/aprf_reader.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aprf-reader
-Version: 0.6.0
+Version: 0.6.1
 Summary: Summarise APRF (Aggregate Performance Reporting) inbox placement reports.
 License: MIT
 Requires-Python: >=3.11
@@ -79,7 +79,7 @@ marked read, moved or deleted. It reads messages whose subject contains
 from the `APRF_IMAP_PASSWORD` environment variable, or it asks. Gmail and
 Outlook.com need an app password, not your account password, and a Gmail
 label is read as a folder of the same name. The connection uses TLS on port
-993; give another port as `--imap host:port`. Files it skips are listed
+993 and checks the server's certificate; give another port as `--imap host:port`. Files it skips are listed
 on stderr and at the end of the summary, each with a reason.
 
 Each stream (provider, signing domain, selector) gets a table with one row per

{aprf_reader-0.6.0 → aprf_reader-0.6.1}/tests/test_imap.py

@@ -1,6 +1,7 @@
 import gzip
 import imaplib
 import json
+import ssl
 from datetime import date
 
 import pytest
@@ -87,7 +88,7 @@ def test_fetched_mail_read_like_an_mbox():
 
 def test_cli_imap(monkeypatch, capsys):
     fake = FakeImap(mails(2))
-    monkeypatch.setattr(imaplib, "IMAP4_SSL", lambda host, port, timeout: fake)
+    monkeypatch.setattr(imaplib, "IMAP4_SSL", lambda host, port, ssl_context, timeout: fake)
     monkeypatch.setenv("APRF_IMAP_PASSWORD", "right")
     assert cli.main(["--imap", "imap.example.com", "--user", "u", "--folder", "APRF", "--json"]) == 0
     out, err = capsys.readouterr()
@@ -96,10 +97,22 @@ def test_cli_imap(monkeypatch, capsys):
 
 
 def test_cli_imap_failure_and_usage(monkeypatch, capsys):
-    monkeypatch.setattr(imaplib, "IMAP4_SSL", lambda host, port, timeout: FakeImap({}))
+    monkeypatch.setattr(imaplib, "IMAP4_SSL", lambda host, port, ssl_context, timeout: FakeImap({}))
     monkeypatch.setenv("APRF_IMAP_PASSWORD", "wrong")
     assert cli.main(["--imap", "h", "--user", "u"]) == 2
     assert "login failed" in capsys.readouterr().err
     for argv in ([], ["--imap", "h"], ["--imap", "h:x", "--user", "u"]):
         with pytest.raises(SystemExit):
             cli.main(argv)
+
+
+def test_certificate_is_checked(monkeypatch):
+    seen = {}
+
+    def connect(host, port, ssl_context, timeout):
+        seen["ctx"] = ssl_context
+        return FakeImap({})
+
+    monkeypatch.setattr(imaplib, "IMAP4_SSL", connect)
+    list(fetch("h", "u", "right"))
+    assert seen["ctx"].verify_mode == ssl.CERT_REQUIRED and seen["ctx"].check_hostname