CLI-14/ssl-config #146

zfralish · 2025-10-22T20:22:43Z

https://anaconda.atlassian.net/browse/CLI-14

Some issues are bubbling up in the base conda client from the auth plugin http client not handling ssl contexts correctly.

I have ripped some of the ssl handling logic from the base client to attempt to remedy the issue.

FYI, I don't have much idea what im doing, be critical.

zfralish · 2025-10-22T20:24:12Z

Not clear on how versions are managed here, also don't see a changelog.

zfralish · 2025-10-22T20:24:52Z

src/anaconda_auth/client.py

+        try:
+            from conda.base.context import context
+            from conda.gateways.connection.adapters.http import HTTPAdapter


Not sure if this will be graceful or not, but was my best guess on how to handle environments where conda was not available.

zfralish · 2025-10-22T20:25:36Z

src/anaconda_auth/client.py

+            self.config.ssl_verify_policy = context.ssl_verify
+            self.config.proxy_servers = context.proxy_servers
+            self.config.ssl_verify = context.ssl_verify


Wanted to fall back on the config as the source of truth, that way we can handle any complicated logic with precedence if needed, or if we would like to overwrite.

zfralish · 2025-10-22T20:26:13Z

src/anaconda_auth/client.py

+
+            # We need an http adapter
+
+            http_adapter = HTTPAdapter(ssl_context=ssl_context)


This part is weird, and had to be imported from deep in the conda base module, so no idea how well this will play.

zfralish · 2025-10-22T20:26:46Z

src/anaconda_auth/client.py

+            if context.client_ssl_cert_key:
+                self.cert = (context.client_ssl_cert, context.client_ssl_cert_key)
+            elif context.client_ssl_cert:
+                self.cert = context.client_ssl_cert


Not sure if this is needed or not, but it was handled like this in the base conda, so figured why not?

…nda-auth into CLI-14/ssl-config

zfralish · 2025-10-22T20:28:45Z

I have no clue how to write tests to cover this, will need some help there.

…nda-auth into CLI-14/ssl-config

AlbertDeFusco · 2025-10-22T21:51:08Z

src/anaconda_auth/actions.py

-    api_key = get_api_key(access_token, config.ssl_verify)
+
+    api_key = get_api_key(
+        access_token, config.ssl_verify if isinstance(config.ssl_verify, bool) else True


Do we need to support trustore in the anaconda.com (and on-prem) routes?

This was meant to bring the config inline with the base conda config which differed in type.

auths was bool

whereas base conda config was Union[bool, str] so I thought matching the base config type wise made sense.

This type casting is just to control for that.

I think I mean should the get_api_key be adjusted to support the string values rather than just true/false? Or is getting an api key working correctly for these users?

AlbertDeFusco · 2025-10-22T22:05:39Z

src/anaconda_auth/client.py

+            from conda.base.context import context
+            from conda.gateways.connection.adapters.http import HTTPAdapter
+
+            # We need to decide which takes precedence, for now im assuming conda base config.


I need to read your code carefully, but the general precedence followed by unified cli is as follows (from low to high)

Coded default in source code

Config files (config.toml, condarc, etc)

Env variables

Direct kward override in init (like using this class in an ipython shell or jupyter notebook)

Is this ascending or descending?

Because if 4. is lowest priority it is never really an "override" correct? or am missing somethin?

it is ascending priority. 4 (init kwargs) is the absolute override of everything.

https://github.com/anaconda/anaconda-cli-base?tab=readme-ov-file#config-file

AlbertDeFusco · 2025-10-22T22:14:19Z

Versions are managed through the Releases tab on github.

A Changelog would be nice we could pobably convert that info to a changelog 🤔 to get it started

AlbertDeFusco · 2025-10-22T22:26:02Z

Let me see if I understand

conda has a sophisticated ssl config support true/false/'truststore'(/path-to-certs?) and proxies
the same request challenges extend to anaconda.com (and on-prem) for customers using the above capabilities for conda
we want to extend anaconda-auth to support more than true/false ssl configuration
in the abence of specific overrides in ~/.anaconda/config.toml, ANACONDA_AUTH_ env vars, or init kwargs we read the conda configs and apply matching configuration to anaconda-auth BaseClient

Is any of the above correct?

zfralish · 2025-10-23T17:28:58Z

Let me see if I understand

conda has a sophisticated ssl config support true/false/'truststore'(/path-to-certs?) and proxies

the same request challenges extend to anaconda.com (and on-prem) for customers using the above capabilities for conda

we want to extend anaconda-auth to support more than true/false ssl configuration

in the abence of specific overrides in ~/.anaconda/config.toml, ANACONDA_AUTH_ env vars, or init kwargs we read the conda configs and apply matching configuration to anaconda-auth BaseClient

Is any of the above correct?

There are some certificate issues bubbling up in the conda env-logger in some enterprise envs where this plugin is in use.

@mattkram speculated that it was because the plugin here used a different client for requests that lacked ssl config, so the idea is to port the ssl config from the base conda client into this plugin.

My current understanding of precedence after the latest push is as follows.

Any direct passed args to init will override anything else
Env vars will be respected and set in the AuthConfig object
If at the point of evaluation, ssl settings are None we will attempt to import settings from the base conda env if available, I believe this will respect condarc settings but I am not sure.

AlbertDeFusco · 2025-10-24T00:10:02Z

src/anaconda_auth/client.py

+            elif context.client_ssl_cert:
+                self.cert = context.client_ssl_cert
+
+        except Exception:


Could we catch something ImportError here?

AlbertDeFusco · 2025-10-24T00:11:04Z

src/anaconda_auth/client.py

        ssl_verify: Optional[bool] = None,
        extra_headers: Optional[Union[str, dict]] = None,
        hash_hostname: Optional[bool] = None,
+        proxy_servers: Optional[MutableMapping[str, str]] = None,


Should ssl_verify in this init support str?

zfralish and others added 2 commits October 22, 2025 15:21

Not entirely sure what im doing.

c76613e

chore(pre-commit): linting

c9dcfb0

zfralish commented Oct 22, 2025

View reviewed changes

zfralish added 2 commits October 22, 2025 15:28

conda import needs to be in try except

0122e39

Merge branch 'CLI-14/ssl-config' of https://github.com/anaconda/anaco…

3877078

…nda-auth into CLI-14/ssl-config

Anaconda Bot and others added 4 commits October 22, 2025 20:29

chore(pre-commit): linting

0c5fad9

fixing a mypy issue

c08c7b9

Merge branch 'CLI-14/ssl-config' of https://github.com/anaconda/anaco…

746736c

…nda-auth into CLI-14/ssl-config

removing uneeded var

27f4f55

zfralish requested review from AlbertDeFusco and mattkram October 22, 2025 20:42

zfralish added 2 commits October 22, 2025 15:47

does adding this dep work?

a50f64a

tsk tsk shouldnt do this

f5da00c

AlbertDeFusco reviewed Oct 22, 2025

View reviewed changes

cleaning up a bit

14f10ed

fixing types

a703eba

zfralish marked this pull request as ready for review October 23, 2025 17:40

AlbertDeFusco reviewed Oct 24, 2025

View reviewed changes

Merge branch 'main' into CLI-14/ssl-config

7d37ba1


		# We need an http adapter

		http_adapter = HTTPAdapter(ssl_context=ssl_context)

Uh oh!

CLI-14/ssl-config #146

Are you sure you want to change the base?

CLI-14/ssl-config #146

Uh oh!

Conversation

zfralish commented Oct 22, 2025

Uh oh!

zfralish commented Oct 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zfralish commented Oct 22, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AlbertDeFusco commented Oct 22, 2025

Uh oh!

AlbertDeFusco commented Oct 22, 2025

Uh oh!

zfralish commented Oct 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants