certifi 2026.2.25: __all__, where, contents

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:pypi/certifi@2026.2.25
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:pypi/certifi@2026.2.25
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8cea9e9a6b2f88b74c630eeb8239450984cab94ce0c0a56911d776d209b9af34","contract":["certifi.__all__ explicitly exports where and contents as callable attributes","certifi.where returns a path to an existing readable PEM file with non-zero size","certifi.contents returns UTF-8 decodable PEM certificates starting with valid certificate headers","ssl.create_default_context with certifi.where enables SERVER_AUTH verification and loads valid certificates","PEM certificates extracted from certifi.contents can be parsed into binary DER certificates using ssl.PEM_cert_to_DER_cert"],"goal":"verify pkg:pypi/certifi@2026.2.25","kind":"HOW","packages":["pkg:pypi/certifi@2026.2.25"],"schemaVersion":1,"symbols":["certifi.__all__","certifi.where","certifi.contents"]},"contractCommand":["python3","test/contract.py"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"pypi","language":"python","libc":"glibc","libcVersion":"2.39","moduleSystem":"standard","os":"linux","osVersionBucket":"24","packageManager":"pip","packageManagerVersion":"24.0","runtime":"python","runtimeVersion":"3.12","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/certifi@2026.2.25"],"schemaVersion":1,"symbols":["certifi.__all__","certifi.where","certifi.contents"],"verifierAdapter":"python@1"}

[project]
name = "certifi-verification-sample"
version = "0.1.0"
description = "Clean-room verification sample for certifi CA bundle and certificate parsing"
requires-python = ">=3.9"
dependencies = [
    "certifi==2026.2.25"
]

certifi==2026.2.25

{
  "schemaVersion": 1,
  "goal": "verify pkg:pypi/certifi@2026.2.25",
  "kind": "HOW",
  "packages": [
    "pkg:pypi/certifi@2026.2.25"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

"""Certifi verification sample package."""

from .sample import (
    convert_pem_to_der,
    create_ssl_context_server_auth,
    extract_first_pem_certificate,
    get_ca_bundle_contents,
    get_ca_bundle_path,
    get_exported_symbols,
)

__all__ = [
    "convert_pem_to_der",
    "create_ssl_context_server_auth",
    "extract_first_pem_certificate",
    "get_ca_bundle_contents",
    "get_ca_bundle_path",
    "get_exported_symbols",
]

"""Sample demonstrating certifi module exports, CA bundle resolution, SSLContext creation, and PEM certificate decoding."""

import os
import ssl
from typing import List, Tuple
import certifi


def get_exported_symbols() -> List[str]:
    """Return the list of public symbols exported by certifi.__all__."""
    return list(certifi.__all__)


def get_ca_bundle_path() -> str:
    """Return the absolute filesystem path to the CA bundle provided by certifi.where()."""
    return certifi.where()


def get_ca_bundle_contents() -> str:
    """Return the decoded text contents of the CA certificate bundle provided by certifi.contents()."""
    return certifi.contents()


def create_ssl_context_server_auth(cafile_path: str) -> ssl.SSLContext:
    """Create a client SSLContext configured with SERVER_AUTH purpose and the given CA bundle file."""
    context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH, cafile=cafile_path)
    return context


def extract_first_pem_certificate(bundle_text: str) -> str:
    """Extract the first PEM-formatted certificate block from the bundle text."""
    begin_marker = "-----BEGIN CERTIFICATE-----"
    end_marker = "-----END CERTIFICATE-----"
    start_idx = bundle_text.find(begin_marker)
    if start_idx == -1:
        raise ValueError("No BEGIN CERTIFICATE marker found in bundle text")
    end_idx = bundle_text.find(end_marker, start_idx)
    if end_idx == -1:
        raise ValueError("No END CERTIFICATE marker found in bundle text")
    return bundle_text[start_idx : end_idx + len(end_marker)]


def convert_pem_to_der(pem_cert: str) -> bytes:
    """Convert a PEM certificate string into binary DER format using the standard ssl module."""
    return ssl.PEM_cert_to_DER_cert(pem_cert)


def inspect_ssl_context(context: ssl.SSLContext) -> Tuple[bool, bool, int]:
    """Inspect an SSLContext and return verify_mode requirement, check_hostname status, and loaded CA count."""
    verify_required = context.verify_mode == ssl.CERT_REQUIRED
    check_hostname = context.check_hostname
    ca_count = len(context.get_ca_certs())
    return verify_required, check_hostname, ca_count

"""Contract verification tests for certifi module exports, CA bundle resolution, SSLContext creation, and PEM decoding."""

import os
import ssl
import sys
from pathlib import Path

# Ensure src is in python path
src_dir = Path(__file__).resolve().parent.parent / "src"
if str(src_dir) not in sys.path:
    sys.path.insert(0, str(src_dir))

import certifi
from sample import (
    convert_pem_to_der,
    create_ssl_context_server_auth,
    extract_first_pem_certificate,
    get_ca_bundle_contents,
    get_ca_bundle_path,
    get_exported_symbols,
    inspect_ssl_context,
)


def test_assertion_1_exports():
    """Assertion 1: certifi.__all__ explicitly exports where and contents as callable attributes."""
    exported = get_exported_symbols()
    assert isinstance(exported, list), f"Expected list of exported symbols, got {type(exported)}"
    assert "where" in exported, "certifi.__all__ must export 'where'"
    assert "contents" in exported, "certifi.__all__ must export 'contents'"

    for name in exported:
        assert hasattr(certifi, name), f"certifi must have attribute '{name}'"
        attr = getattr(certifi, name)
        assert callable(attr), f"Exported attribute '{name}' must be callable"


def test_assertion_2_bundle_path():
    """Assertion 2: certifi.where returns a path to an existing readable PEM file with non-zero size."""
    path = get_ca_bundle_path()
    assert isinstance(path, str), f"Expected path to be str, got {type(path)}"
    assert len(path) > 0, "Expected non-empty path string"
    assert os.path.exists(path), f"CA bundle path does not exist: {path}"
    assert os.path.isfile(path), f"CA bundle path is not a file: {path}"
    assert os.access(path, os.R_OK), f"CA bundle path is not readable: {path}"
    assert os.path.getsize(path) > 0, f"CA bundle file must have non-zero size: {path}"


def test_assertion_3_bundle_contents():
    """Assertion 3: certifi.contents returns UTF-8 decodable PEM certificates starting with valid certificate headers."""
    contents = get_ca_bundle_contents()
    assert isinstance(contents, str), f"Expected contents to be str, got {type(contents)}"
    assert len(contents) > 0, "Expected non-empty bundle contents"
    assert "-----BEGIN CERTIFICATE-----" in contents, "Bundle contents must contain BEGIN CERTIFICATE marker"
    assert "-----END CERTIFICATE-----" in contents, "Bundle contents must contain END CERTIFICATE marker"
    # Verify UTF-8 encoding round-trip lossless
    encoded = contents.encode("utf-8")
    assert encoded.decode("utf-8") == contents, "Bundle contents must support lossless UTF-8 decode"


def test_assertion_4_ssl_context():
    """Assertion 4: ssl.create_default_context with certifi.where enables SERVER_AUTH verification and loads valid certificates."""
    cafile = get_ca_bundle_path()
    context = create_ssl_context_server_auth(cafile)
    assert isinstance(context, ssl.SSLContext), "Expected SSLContext instance"
    verify_required, check_hostname, ca_count = inspect_ssl_context(context)
    assert verify_required is True, "SSLContext must require certificate verification (CERT_REQUIRED)"
    assert check_hostname is True, "SSLContext must enable check_hostname"
    assert ca_count > 0, f"SSLContext must load at least one CA certificate, got {ca_count}"


def test_assertion_5_pem_to_der():
    """Assertion 5: PEM certificates extracted from certifi.contents can be parsed into binary DER certificates using ssl.PEM_cert_to_DER_cert."""
    contents = get_ca_bundle_contents()
    pem_cert = extract_first_pem_certificate(contents)
    assert pem_cert.startswith("-----BEGIN CERTIFICATE-----"), "Extracted PEM must begin with BEGIN marker"
    assert pem_cert.endswith("-----END CERTIFICATE-----"), "Extracted PEM must end with END marker"

    der_bytes = convert_pem_to_der(pem_cert)
    assert isinstance(der_bytes, bytes), f"Expected bytes output from PEM_cert_to_DER_cert, got {type(der_bytes)}"
    assert len(der_bytes) > 0, "DER certificate bytes must not be empty"


def main():
    print("Running contract verification tests for pkg:pypi/certifi@2026.2.25...")
    test_assertion_1_exports()
    test_assertion_2_bundle_path()
    test_assertion_3_bundle_contents()
    test_assertion_4_ssl_context()
    test_assertion_5_pem_to_der()
    print("All contract assertions passed successfully.")


if __name__ == "__main__":
    main()