runspec-webops-core 0.3.1__tar.gz → 0.3.2__tar.gz

{runspec_webops_core-0.3.1 → runspec_webops_core-0.3.2}/.gitignore

@@ -25,6 +25,8 @@ coverage.xml
 # Node
 node_modules/
 dist/
+# runspec manifest output (written at npm pack time)
+runspec-files.json
 *.js.map
 .npm
 

{runspec_webops_core-0.3.1 → runspec_webops_core-0.3.2}/CHANGELOG.md

@@ -1,5 +1,14 @@
 # runspec-webops-core Changelog
 
+## [0.3.2] — 2026-11-12
+
+### Fixed
+
+- `connect_peer` (behind `cert-check`, `cert-chain` and `tls-info`) failed on
+  Python 3.13+ with `'bytes' object has no attribute 'public_bytes'`: the public
+  `SSLSocket.get_unverified_chain()` returns DER bytes, not certificate objects.
+  Both shapes are read now.
+
 ## [0.3.1] — 2026-11-05
 
 ### Fixed

{runspec_webops_core-0.3.1 → runspec_webops_core-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-webops-core
-Version: 0.3.1
+Version: 0.3.2
 Summary: Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable core behind the runspec web runnables (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Provides-Extra: dev

{runspec_webops_core-0.3.1 → runspec_webops_core-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-webops-core"
-version = "0.3.1"
+version = "0.3.2"
 requires-python = ">=3.10"
 description = "Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable core behind the runspec web runnables (no runspec dependency, no runnables)"
 readme = "README.md"

{runspec_webops_core-0.3.1 → runspec_webops_core-0.3.2}/runspec_webops_core/tls.py

@@ -201,8 +201,8 @@ def client_ssl_context(insecure: bool = False, ca_bundle: str | None = None) ->
 def _peer_chain(ssock: ssl.SSLSocket) -> list[CertInfo]:
     """Return the server-presented certificate chain (leaf first).
 
-    Prefers the public ``SSLSocket.get_unverified_chain()`` (Python 3.13+),
-    falls back to the underlying ``_sslobj`` method (3.10–3.12), and finally to
+    Prefers the public ``SSLSocket.get_unverified_chain()`` (Python 3.13+,
+    which returns DER bytes), falls back to the underlying ``_sslobj`` method (3.10–3.12), and finally to
     the leaf-only certificate via ``getpeercert`` when neither is available.
     """
     getter = getattr(ssock, "get_unverified_chain", None)
@@ -218,8 +218,14 @@ def _peer_chain(ssock: ssl.SSLSocket) -> list[CertInfo]:
         if raw:
             out: list[CertInfo] = []
             for cert in raw:
-                der = ssl.PEM_cert_to_DER_cert(cert.public_bytes())
-                out.append(cert_info_from_ssl(cert.get_info(), der))
+                if isinstance(cert, (bytes, bytearray)):
+                    # Python 3.13+ public API: DER-encoded bytes.
+                    der = bytes(cert)
+                    out.append(cert_info_from_ssl(_decode_der(der), der))
+                else:
+                    # 3.10–3.12 ``_sslobj`` method: ``_ssl.Certificate`` objects.
+                    der = ssl.PEM_cert_to_DER_cert(cert.public_bytes())
+                    out.append(cert_info_from_ssl(cert.get_info(), der))
             return out
 
     # Fallback: only the leaf is recoverable on this interpreter.

{runspec_webops_core-0.3.1 → runspec_webops_core-0.3.2}/tests/test_tls.py

@@ -132,3 +132,30 @@ def test_chain_report_marks_root() -> None:
     rep = chain_report(peer, now=NOW)
     assert [link["self_signed"] for link in rep] == [False, True]
     assert rep[0]["days_remaining"] == 30
+
+
+def _a_der_cert() -> bytes:
+    """Any real DER certificate: the first system CA (no network needed)."""
+    certs = ssl.create_default_context().get_ca_certs(binary_form=True)
+    if not certs:
+        pytest.skip("no system CA certificates to use as a sample")
+    return certs[0]
+
+
+def test_peer_chain_reads_der_bytes_from_public_api() -> None:
+    # Python 3.13+ ``SSLSocket.get_unverified_chain()`` returns DER bytes, not
+    # ``_ssl.Certificate`` objects; this used to fail with
+    # "'bytes' object has no attribute 'public_bytes'".
+    from runspec_webops_core.tls import _peer_chain
+
+    der = _a_der_cert()
+
+    class FakeSocket:
+        def get_unverified_chain(self) -> list[bytes]:
+            return [der, der]
+
+    chain = _peer_chain(FakeSocket())  # type: ignore[arg-type]
+    assert len(chain) == 2
+    assert chain[0].subject
+    assert chain[0].valid_to
+    assert chain[0].fingerprint_sha256