truststore 0.10.4: SSLContext, inject_into_ssl

# truststore SSLContext and inject_into_ssl API

This sample pins `truststore` 0.10.4 and verifies `truststore.SSLContext`, `truststore.inject_into_ssl`, and `truststore.extract_from_ssl` for native system certificate verification.

The contract verifies:
- `truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)` instantiates a client context with `check_hostname=True` and `verify_mode=ssl.CERT_REQUIRED`.
- Context configuration properties such as `minimum_version`, `maximum_version`, `check_hostname`, and `verify_mode` can be modified.
- `cert_store_stats()` and `get_ca_certs()` raise `NotImplementedError` as system trust stores are evaluated dynamically.
- `truststore.inject_into_ssl()` replaces `ssl.SSLContext` with `truststore.SSLContext` so that `ssl.create_default_context()` produces `truststore.SSLContext` instances.
- `truststore.extract_from_ssl()` restores the original `ssl.SSLContext` class.
- `wrap_bio()` constructs an `ssl.SSLObject` around standard `ssl.MemoryBIO` buffers.

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:pypi/truststore@0.10.4
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:pypi/truststore@0.10.4
Demonstrate these symbols/APIs:
  - truststore.SSLContext
  - truststore.inject_into_ssl

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:a22f9f6953011d86a68b4f9a4b3e064745c1b057ef51519f8a0aac6cded2ccd8","contract":["truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT) initializes an SSLContext configured with default client security settings (check_hostname=True, CERT_REQUIRED).","truststore.SSLContext allows configuring TLS versions and verification options including minimum_version, maximum_version, check_hostname, and verify_mode.","truststore.SSLContext raises NotImplementedError on cert_store_stats() and get_ca_certs() because system certificate stores are dynamic.","truststore.inject_into_ssl() replaces ssl.SSLContext so that ssl.create_default_context() creates truststore.SSLContext instances.","truststore.extract_from_ssl() restores ssl.SSLContext to the original standard library implementation.","truststore.SSLContext.wrap_bio() creates an ssl.SSLObject wrapping memory BIO streams."],"goal":"verify pkg:pypi/truststore@0.10.4","kind":"HOW","packages":["pkg:pypi/truststore@0.10.4"],"schemaVersion":1,"symbols":["truststore.SSLContext","truststore.inject_into_ssl"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"pypi","executionContext":"python","language":"python","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"pip","runtime":"python","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/truststore@0.10.4"],"schemaVersion":1,"subject":"pkg:pypi/truststore@0.10.4","symbols":["truststore.SSLContext","truststore.inject_into_ssl"],"verifierAdapter":"python@1"}

truststore==0.10.4

{
  "schemaVersion": 1,
  "goal": "verify pkg:pypi/truststore@0.10.4",
  "kind": "HOW",
  "packages": [
    "pkg:pypi/truststore@0.10.4"
  ],
  "symbols": [
    "truststore.SSLContext",
    "truststore.inject_into_ssl"
  ]
}

import ssl
import truststore

# 1. Verify truststore.SSLContext initializes with client defaults
ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
assert isinstance(ctx, truststore.SSLContext), f"Expected truststore.SSLContext, got {type(ctx)}"
assert ctx.check_hostname is True, "Expected check_hostname to be True by default"
assert ctx.verify_mode == ssl.CERT_REQUIRED, f"Expected CERT_REQUIRED, got {ctx.verify_mode}"

# 2. Verify setting configuration properties on SSLContext
ctx.minimum_version = ssl.TLSVersion.TLSv1_2
assert ctx.minimum_version == ssl.TLSVersion.TLSv1_2, "Expected minimum_version to be TLSv1_2"
ctx.maximum_version = ssl.TLSVersion.TLSv1_3
assert ctx.maximum_version == ssl.TLSVersion.TLSv1_3, "Expected maximum_version to be TLSv1_3"

ctx.check_hostname = False
assert ctx.check_hostname is False, "Expected check_hostname to be False after update"
ctx.verify_mode = ssl.CERT_NONE
assert ctx.verify_mode == ssl.CERT_NONE, "Expected verify_mode to be CERT_NONE after update"

# 3. Verify methods unsupported by dynamic system trust store raise NotImplementedError
try:
    ctx.cert_store_stats()
    raise AssertionError("Expected cert_store_stats to raise NotImplementedError")
except NotImplementedError:
    pass

try:
    ctx.get_ca_certs()
    raise AssertionError("Expected get_ca_certs to raise NotImplementedError")
except NotImplementedError:
    pass

# 4. Verify inject_into_ssl replaces ssl.SSLContext
original_ssl_context = ssl.SSLContext
try:
    truststore.inject_into_ssl()
    assert ssl.SSLContext is truststore.SSLContext, "Expected ssl.SSLContext to be truststore.SSLContext"

    injected_ctx = ssl.create_default_context()
    assert isinstance(injected_ctx, truststore.SSLContext), "Expected create_default_context to return truststore.SSLContext"
finally:
    # 5. Verify extract_from_ssl restores ssl.SSLContext
    truststore.extract_from_ssl()

assert ssl.SSLContext is original_ssl_context, "Expected ssl.SSLContext to be restored to original class"
restored_ctx = ssl.create_default_context()
assert not isinstance(restored_ctx, truststore.SSLContext), "Expected create_default_context to no longer return truststore.SSLContext"

# 6. Verify wrap_bio constructs an SSLObject
bio_in = ssl.MemoryBIO()
bio_out = ssl.MemoryBIO()
client_ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ssl_obj = client_ctx.wrap_bio(bio_in, bio_out, server_hostname="example.com")
assert isinstance(ssl_obj, ssl.SSLObject), f"Expected ssl.SSLObject, got {type(ssl_obj)}"

print("CONTRACT PASS: truststore.SSLContext and inject_into_ssl verified offline")