certifi 2026.2.25: contents, where

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:pypi/certifi@2026.2.25
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:pypi/certifi@2026.2.25
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:1317c02c4634a0362959d76a27522aa8cc486272ab4c7263bca0463cfa33c4fd","contract":["certifi.contents returns CA bundle text containing PEM certificates that initialize an SSLContext using cadata in-memory loading","certifi.where returns an absolute file path pointing to an existing CA certificate bundle file containing valid PEM root certificates","SSLContext initialized with certifi.contents via cadata populates CA trust certificates with valid subject and issuer metadata"],"goal":"verify pkg:pypi/certifi@2026.2.25","kind":"HOW","packages":["pkg:pypi/certifi@2026.2.25"],"schemaVersion":1,"symbols":["certifi.contents","certifi.where"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"pypi","language":"python","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"pip","runtime":"python","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/certifi@2026.2.25"],"schemaVersion":1,"symbols":["certifi.contents","certifi.where"],"verifierAdapter":"python@1"}

certifi==2026.2.25

"""Sample demonstrating in-memory SSLContext initialization and certificate validation using certifi."""

import os
import ssl
from typing import Any, Dict, List, Tuple
import certifi


def get_ca_bundle_path() -> str:
    """Return the filesystem path to the Mozilla CA certificate bundle."""
    return certifi.where()


def get_ca_bundle_contents() -> str:
    """Return the text content of the Mozilla CA certificate bundle."""
    return certifi.contents()


def create_ssl_context_from_cadata() -> ssl.SSLContext:
    """Create an SSLContext and load CA bundle into memory using cadata parameter."""
    contents = certifi.contents()
    ctx = ssl.create_default_context(cadata=contents)
    return ctx


def get_trusted_ca_subjects() -> List[Dict[str, Any]]:
    """Return list of subject dictionaries for all CA certificates loaded via cadata."""
    ctx = create_ssl_context_from_cadata()
    ca_certs = ctx.get_ca_certs()
    return [cert.get("subject", ()) for cert in ca_certs]


def inspect_cadata_context() -> Tuple[str, bool, int, int]:
    """Inspect bundle path, existence, in-memory content length, and loaded CA certificate count."""
    path = get_ca_bundle_path()
    exists = os.path.isfile(path)
    contents = get_ca_bundle_contents()
    ctx = create_ssl_context_from_cadata()
    ca_count = len(ctx.get_ca_certs())
    return path, exists, len(contents), ca_count

{
  "schemaVersion": 1,
  "goal": "verify pkg:pypi/certifi@2026.2.25",
  "kind": "HOW",
  "packages": [
    "pkg:pypi/certifi@2026.2.25"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

"""Contract verification test for certifi in-memory cadata loading and CA bundle verification."""

import os
import ssl
import sys

# Ensure project root is on sys.path for local module imports
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

import certifi
from sample import (
    create_ssl_context_from_cadata,
    get_ca_bundle_contents,
    get_ca_bundle_path,
    get_trusted_ca_subjects,
    inspect_cadata_context,
)


def test_contents_initializes_ssl_context_via_cadata():
    """Assertion 1: certifi.contents returns CA bundle text containing PEM certificates that initialize an SSLContext using cadata in-memory loading."""
    contents = get_ca_bundle_contents()
    assert isinstance(contents, str)
    assert len(contents) > 0
    assert "-----BEGIN CERTIFICATE-----" in contents
    assert "-----END CERTIFICATE-----" in contents

    ctx = create_ssl_context_from_cadata()
    assert isinstance(ctx, ssl.SSLContext)
    assert ctx.verify_mode == ssl.CERT_REQUIRED
    ca_certs = ctx.get_ca_certs()
    assert isinstance(ca_certs, list)
    assert len(ca_certs) > 0


def test_where_returns_existing_ca_bundle():
    """Assertion 2: certifi.where returns an absolute file path pointing to an existing CA certificate bundle file containing valid PEM root certificates."""
    bundle_path = get_ca_bundle_path()
    assert isinstance(bundle_path, str)
    assert len(bundle_path) > 0
    assert os.path.isabs(bundle_path), f"Bundle path is not absolute: {bundle_path}"
    assert os.path.exists(bundle_path), f"Bundle path does not exist: {bundle_path}"
    assert os.path.isfile(bundle_path), f"Bundle path is not a regular file: {bundle_path}"

    with open(bundle_path, "r", encoding="utf-8", errors="replace") as f:
        file_content = f.read()

    assert "-----BEGIN CERTIFICATE-----" in file_content
    assert "-----END CERTIFICATE-----" in file_content


def test_cadata_populates_valid_ca_metadata():
    """Assertion 3: SSLContext initialized with certifi.contents via cadata populates CA trust certificates with valid subject and issuer metadata."""
    ctx = create_ssl_context_from_cadata()
    ca_certs = ctx.get_ca_certs()
    assert len(ca_certs) > 0

    first_cert = ca_certs[0]
    assert "subject" in first_cert
    assert "issuer" in first_cert
    assert len(first_cert["subject"]) > 0
    assert len(first_cert["issuer"]) > 0

    subjects = get_trusted_ca_subjects()
    assert len(subjects) == len(ca_certs)

    bundle_path, exists, content_len, ca_count = inspect_cadata_context()
    assert exists is True
    assert content_len > 0
    assert ca_count == len(ca_certs)


def main():
    test_contents_initializes_ssl_context_via_cadata()
    test_where_returns_existing_ca_bundle()
    test_cadata_populates_valid_ca_metadata()
    print("All contract assertions passed successfully.")


if __name__ == "__main__":
    main()