urllib3 2.7.0: util.create_urllib3_context

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify urllib3.util.create_urllib3_context in pkg:pypi/urllib3@2.7.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:pypi/urllib3@2.7.0
Demonstrate these symbols/APIs:
  - urllib3.util.create_urllib3_context

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:902aa699439ad26c74d85bd7dac57b1566311f4e90e281c6fe00fd8e5e572e7b","contract":["urllib3.util.create_urllib3_context creates an ssl.SSLContext configured with TLSv1_2 minimum version and CERT_REQUIRED verification by default","urllib3.util.create_urllib3_context configures custom TLS minimum version such as TLSv1_3","urllib3.util.create_urllib3_context configures custom cert_reqs such as CERT_NONE and disables hostname verification","urllib3.util.create_urllib3_context raises ValueError when conflicting ssl_version and ssl_minimum_version or ssl_maximum_version are specified"],"goal":"verify urllib3.util.create_urllib3_context in pkg:pypi/urllib3@2.7.0","kind":"HOW","packages":["pkg:pypi/urllib3@2.7.0"],"schemaVersion":1,"symbols":["urllib3.util.create_urllib3_context"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"pypi","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"pip","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/urllib3@2.7.0"],"schemaVersion":1,"subject":"pkg:pypi/urllib3@2.7.0","symbols":["urllib3.util.create_urllib3_context"],"verifierAdapter":"python@1"}

urllib3==2.7.0

"""Sample demonstrating SSLContext configuration using urllib3.util.create_urllib3_context."""

from __future__ import annotations

import ssl
from typing import Optional
import urllib3.util


def create_default_context() -> ssl.SSLContext:
    """Create a default hardened SSLContext for TLS connections."""
    return urllib3.util.create_urllib3_context()


def create_custom_tls_context(
    ssl_minimum_version: Optional[int] = None,
    ssl_maximum_version: Optional[int] = None,
    cert_reqs: Optional[int] = None,
    options: Optional[int] = None,
    ciphers: Optional[str] = None,
) -> ssl.SSLContext:
    """Create a customized SSLContext with specified TLS protocol versions, verification, and ciphers."""
    return urllib3.util.create_urllib3_context(
        ssl_minimum_version=ssl_minimum_version,
        ssl_maximum_version=ssl_maximum_version,
        cert_reqs=cert_reqs,
        options=options,
        ciphers=ciphers,
    )

{
  "schemaVersion": 1,
  "goal": "verify urllib3.util.create_urllib3_context in pkg:pypi/urllib3@2.7.0",
  "kind": "HOW",
  "packages": [
    "pkg:pypi/urllib3@2.7.0"
  ],
  "symbols": [
    "urllib3.util.create_urllib3_context"
  ]
}

"""Contract verification test for urllib3.util.create_urllib3_context."""

from __future__ import annotations

import os
import ssl
import sys

# Ensure root directory is in sys.path
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

import urllib3.util
from sample import create_custom_tls_context, create_default_context


def test_default_context() -> None:
    """Assertion 1: urllib3.util.create_urllib3_context creates an ssl.SSLContext configured with TLSv1_2 minimum version and CERT_REQUIRED verification by default."""
    ctx = create_default_context()
    assert isinstance(ctx, ssl.SSLContext), "Default context must be an instance of ssl.SSLContext"
    assert ctx.verify_mode == ssl.CERT_REQUIRED, f"Expected CERT_REQUIRED (2), got {ctx.verify_mode}"
    assert ctx.check_hostname is True, "Expected check_hostname to be True by default"
    assert ctx.minimum_version == ssl.TLSVersion.TLSv1_2, (
        f"Expected minimum TLS version TLSv1_2, got {ctx.minimum_version}"
    )


def test_custom_tls_version() -> None:
    """Assertion 2: urllib3.util.create_urllib3_context configures custom TLS minimum version such as TLSv1_3."""
    ctx = create_custom_tls_context(ssl_minimum_version=ssl.TLSVersion.TLSv1_3)
    assert isinstance(ctx, ssl.SSLContext), "Context must be an instance of ssl.SSLContext"
    assert ctx.minimum_version == ssl.TLSVersion.TLSv1_3, (
        f"Expected minimum TLS version TLSv1_3, got {ctx.minimum_version}"
    )


def test_custom_cert_reqs() -> None:
    """Assertion 3: urllib3.util.create_urllib3_context configures custom cert_reqs such as CERT_NONE and disables hostname verification."""
    ctx = create_custom_tls_context(cert_reqs=ssl.CERT_NONE)
    assert isinstance(ctx, ssl.SSLContext), "Context must be an instance of ssl.SSLContext"
    assert ctx.verify_mode == ssl.CERT_NONE, f"Expected CERT_NONE (0), got {ctx.verify_mode}"
    assert ctx.check_hostname is False, "Expected check_hostname to be False when cert_reqs is CERT_NONE"


def test_conflicting_ssl_versions() -> None:
    """Assertion 4: urllib3.util.create_urllib3_context raises ValueError when conflicting ssl_version and ssl_minimum_version or ssl_maximum_version are specified."""
    raised = False
    try:
        urllib3.util.create_urllib3_context(
            ssl_version=ssl.PROTOCOL_TLSv1_2,
            ssl_minimum_version=ssl.TLSVersion.TLSv1_2,
        )
    except ValueError:
        raised = True

    assert raised, "Expected ValueError when specifying both ssl_version and ssl_minimum_version"


def main() -> None:
    test_default_context()
    test_custom_tls_version()
    test_custom_cert_reqs()
    test_conflicting_ssl_versions()
    print("All contract assertions passed successfully.")


if __name__ == "__main__":
    main()