rusackas opened a new pull request, #45576: URL: https://github.com/apache/superset/pull/45576
### SUMMARY `tests/testcontainers/db_engine_specs/test_mariadb.py` (added in #43502) covers pagination and column-type mapping against `MariaDBEngineSpec`, but had no coverage of `require_mysql_tls`'s fail-closed/verified-TLS behavior. #44910 added that coverage for `test_mysql.py`, but that suite only exercises `MySqlEngineSpec`, never `MariaDBEngineSpec` — so the TLS enforcement path specific to the `mariadb` dialect had no regression test at all. This PR mirrors #44910's pattern against `MariaDBEngineSpec`: - `test_require_mysql_tls_fails_closed_without_server_tls`: a server started with `--skip-ssl` must be refused a plaintext connection when `require_mysql_tls` is applied. - `test_require_mysql_tls_connects_with_verified_tls`: a server with TLS enabled and a trusted CA must connect and actually negotiate encryption (checked via `SHOW STATUS LIKE 'Ssl_cipher'`). One wrinkle versus the `mysql:8.0` image: it doesn't auto-generate a CA/cert pair the way `mysql:8.0` does, so there's nothing to extract via `container.exec()` for the verified-TLS happy path. Instead, `_write_self_signed_cert()` generates a throwaway self-signed CA + server cert/key with the `cryptography` library (already a base dependency) and mounts it into the container via `with_volume_mapping()`, booting the server with `--ssl-cert`/`--ssl-key`/`--ssl-ca` pointed at it. Also updated the module docstring to be explicit that neither this file nor `test_mysql.py` exercises the client library actually linked in CI against the vulnerable code path in question (CI's `mysqlclient` links Oracle's `libmysqlclient`, not MariaDB Connector/C) — this closes the `MariaDBEngineSpec`-specific coverage gap, not a gap in the underlying driver. ### TESTING INSTRUCTIONS ``` SUPERSET_TESTENV=true pytest tests/testcontainers/db_engine_specs/test_mariadb.py -m testcontainers ``` Requires Docker. Verified the new tests collect cleanly and pass pre-commit; also manually validated the cert-generation/mounting mechanism against real `mariadb:11` containers (couldn't run the full pytest suite end-to-end locally due to a pre-existing, already-documented `mysqlclient` import issue on this machine — same limitation noted in `test_mysql.py`'s own docstring). ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
