certifi 2026.7.22: contents, where

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:pypi/certifi@2026.7.22
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:pypi/certifi@2026.7.22
Demonstrate these symbols/APIs:
  - certifi.contents
  - certifi.where

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:9d99a2a2121c3cb5c037385a367a3d65b4d7a8b0a8d7818f47cbb48cbe07af32","contract":["certifi.where returns an absolute path to an existing and readable CA bundle PEM file","certifi.contents returns a non-empty UTF-8 string containing PEM formatted root certificates","ssl.create_default_context accepts cadata from certifi.contents and successfully loads trusted CA certificates"],"goal":"verify pkg:pypi/certifi@2026.7.22","kind":"HOW","packages":["pkg:pypi/certifi@2026.7.22"],"schemaVersion":1,"symbols":["certifi.contents","certifi.where"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"pypi","language":"python","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"pip","runtime":"python","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/certifi@2026.7.22"],"schemaVersion":1,"subject":"pkg:pypi/certifi@2026.7.22","symbols":["certifi.contents","certifi.where"],"verifierAdapter":"python@1"}

certifi==2026.7.22

"""Sample demonstrating CA bundle path retrieval and in-memory SSLContext loading with certifi."""

import os
import ssl
from typing import List, Tuple
import certifi


def get_ca_bundle_path() -> str:
    """Return the filesystem path to the Mozilla CA certificate bundle."""
    return certifi.where()


def get_ca_bundle_contents() -> str:
    """Return the text content of the Mozilla CA certificate bundle."""
    return certifi.contents()


def create_ssl_context_with_cadata() -> ssl.SSLContext:
    """Create an SSL context and load root certificates from certifi.contents()."""
    ca_data = certifi.contents()
    ctx = ssl.create_default_context(cadata=ca_data)
    return ctx


def verify_bundle_file() -> Tuple[str, bool, int]:
    """Verify that the CA bundle path exists and return its path, existence, and size."""
    bundle_path = get_ca_bundle_path()
    exists = os.path.isfile(bundle_path)
    file_size = os.path.getsize(bundle_path) if exists else 0
    return bundle_path, exists, file_size


def get_loaded_ca_cert_count() -> int:
    """Return the number of loaded CA certificates in the SSLContext configured via certifi cadata."""
    ctx = create_ssl_context_with_cadata()
    return len(ctx.get_ca_certs())

{
  "schemaVersion": 1,
  "goal": "verify pkg:pypi/certifi@2026.7.22",
  "kind": "HOW",
  "packages": [
    "pkg:pypi/certifi@2026.7.22"
  ],
  "symbols": [
    "certifi.contents",
    "certifi.where"
  ]
}

"""Contract verification test for certifi where and contents APIs."""

import os
import ssl
import sys

# Ensure sample module can be imported
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

import certifi
from sample import (
    create_ssl_context_with_cadata,
    get_ca_bundle_contents,
    get_ca_bundle_path,
    get_loaded_ca_cert_count,
    verify_bundle_file,
)


def test_where_returns_valid_bundle_path():
    """Assertion 1: certifi.where returns an absolute path to an existing and readable CA bundle PEM file."""
    path = get_ca_bundle_path()
    assert isinstance(path, str), f"Expected str, got {type(path)}"
    assert os.path.isabs(path), f"Path is not absolute: {path}"
    assert os.path.isfile(path), f"Path is not a regular file: {path}"
    assert os.access(path, os.R_OK), f"Path is not readable: {path}"

    with open(path, "r", encoding="utf-8", errors="replace") as f:
        data = f.read()

    assert "-----BEGIN CERTIFICATE-----" in data
    assert "-----END CERTIFICATE-----" in data

    _, exists, size = verify_bundle_file()
    assert exists is True
    assert size > 0


def test_contents_returns_valid_pem_string():
    """Assertion 2: certifi.contents returns a non-empty UTF-8 string containing PEM formatted root certificates."""
    contents = get_ca_bundle_contents()
    assert isinstance(contents, str), f"Expected str, got {type(contents)}"
    assert len(contents) > 0
    assert "-----BEGIN CERTIFICATE-----" in contents
    assert "-----END CERTIFICATE-----" in contents


def test_ssl_context_cadata_loading():
    """Assertion 3: ssl.create_default_context accepts cadata from certifi.contents and successfully loads trusted CA certificates."""
    ctx = create_ssl_context_with_cadata()
    assert isinstance(ctx, ssl.SSLContext)
    assert ctx.verify_mode == ssl.CERT_REQUIRED

    ca_certs = ctx.get_ca_certs()
    assert isinstance(ca_certs, list)
    assert len(ca_certs) > 0

    count = get_loaded_ca_cert_count()
    assert count == len(ca_certs)
    assert count > 0

    first_cert = ca_certs[0]
    assert "subject" in first_cert
    assert "issuer" in first_cert


def main():
    test_where_returns_valid_bundle_path()
    test_contents_returns_valid_pem_string()
    test_ssl_context_cadata_loading()
    print("All contract assertions passed successfully.")


if __name__ == "__main__":
    main()