sdmxlib 0.28.1__tar.gz → 0.28.3__tar.gz

{sdmxlib-0.28.1 → sdmxlib-0.28.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: sdmxlib
-Version: 0.28.1
+Version: 0.28.3
 Summary: SDMX structural metadata library for Python
 Keywords: sdmx,statistics,metadata,datastructure
 Author: gabrielgellner

{sdmxlib-0.28.1 → sdmxlib-0.28.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sdmxlib"
-version = "0.28.1"
+version = "0.28.3"
 description = "SDMX structural metadata library for Python"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{sdmxlib-0.28.1 → sdmxlib-0.28.3}/src/sdmxlib/local/_data_store.py

@@ -195,6 +195,23 @@ class DuckDBDataStore:
             # Loading extensions can change the search_path; reset to
             # ``sdmx`` so any colocated Registry's internal queries stay clean.
             self._conn.execute("SET search_path = 'sdmx'")
+        if self._needs_azure():
+            # Force the named curl transport adapter. The Azure SDK's
+            # default transport on Linux uses a statically-linked HTTP
+            # stack that doesn't honour the standard ``SSL_CERT_FILE`` /
+            # ``CURL_CA_BUNDLE`` environment variables, so it fails on
+            # any image whose CA store is at a non-default path. The
+            # ``curl`` adapter delegates to libcurl, which reads those
+            # env vars at handshake time.
+            #
+            # ``SET GLOBAL`` (not bare ``SET``) is required because the
+            # data-plane uses per-thread cursors (Phase 5 of #75). A
+            # bare ``SET`` is session-scoped and bypassed by every cursor
+            # opened later, so the curl transport wouldn't take effect on
+            # the codepath where abfss reads actually happen — surfacing
+            # as "Problem with the SSL CA cert" on every data query. See
+            # issue #81.
+            self._conn.execute("SET GLOBAL azure_transport_option_type = 'curl'")
         if self._azure_credentials:
             sql = _azure_create_secret_sql(self._azure_credentials)
             self._conn.execute(sql)
@@ -208,13 +225,24 @@ class DuckDBDataStore:
             self._conn.execute("SET search_path = 'sdmx'")
 
     def _needs_azure(self) -> bool:
-        """True if Azure secret/extension setup is required for this session."""
+        """True if Azure secret/extension setup is required for this session.
+
+        Matches against ATTACH specs that either (a) name an ``abfss://``
+        path directly or (b) ATTACH a DuckLake catalog (``ducklake:``)
+        whose ``data_path`` is stored inside the lake metadata file —
+        invisible to the ATTACH SQL but routed through the Azure backend
+        on first read. Catching ``ducklake:`` here is over-broad for
+        purely local lakes, but the cost of a spurious curl-transport SET
+        is zero (DuckDB ignores it until something talks to Azure); the
+        cost of a false negative is a TLS handshake failure on every data
+        query. See issue #81.
+        """
         if self._azure_credentials:
             return True
         if self._attach:
             for spec in self._attach.values():
                 spec_text = spec if isinstance(spec, str) else " ".join(s for s in spec if s)
-                if "abfss://" in spec_text:
+                if "abfss://" in spec_text or "ducklake:" in spec_text:
                     return True
         return False