From 51031984f304dee4b1d7edca967932db73f96343 Mon Sep 17 00:00:00 2001 From: Brian O'Kelley Date: Sat, 24 Oct 2026 13:08:38 +0000 Subject: [PATCH] test(signing): accept any HTTP status in the real TLS handshake check The test proves the pinned transport still validates the hostname; a certificate mismatch raises before any response. Asserting 200 made it fail whenever example.com answered 503, which happened twice this week on main and on #1557. Co-Authored-By: Claude Opus 5.5 (1M context) --- tests/conformance/signing/test_ip_pinned_transport.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/conformance/signing/test_ip_pinned_transport.py b/tests/conformance/signing/test_ip_pinned_transport.py index af47b1ad1..997d6d0f4 100644 --- a/tests/conformance/signing/test_ip_pinned_transport.py +++ b/tests/conformance/signing/test_ip_pinned_transport.py @@ -377,7 +377,10 @@ def test_real_tls_handshake_still_validates_hostname() -> None: # machines. The intent is "handshake didn't reject", not speed. with httpx.Client(transport=transport, timeout=60.0) as client: response = client.get("https://example.com/") - assert response.status_code == 200 + # Any HTTP response proves the handshake and hostname check passed (a + # certificate mismatch raises before a response exists). The origin's + # own status is not under test: example.com intermittently answers 503. + assert 100 <= response.status_code < 600 @pytest.mark.skipif(not _internet_ok(), reason="no outbound internet")