From 69160aae61b3dc00a31d5980919d665e02f4c417 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Sun, 4 Oct 2026 12:46:17 +0300 Subject: http-api-client: T8955: leave warning handling to the caller MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address the round-2 adversarial-review finding: warnings.catch_warnings() mutates the process-global filter list for the duration of the block (still the case on Python 3.13), so scoping suppression inside the library was not actually isolated. - http_api_client no longer touches warning filters at all. The _suppress_insecure_warning helper is removed and post() calls session.post directly again. The unused warnings, contextmanager and urllib3 imports are dropped. The class docstring now states that callers disabling verification own InsecureRequestWarning handling. The OSError wrapping and verify_tls validation are unchanged. - config_sync ignores InsecureRequestWarning in its __main__ block only, before opmode.run(). That one-shot op-mode process deliberately connects without verification (verify_tls=False) until T9396. Importing the module adds no filter. 🤖 Generated by [robots](https://vyos.io) --- src/op_mode/config_sync.py | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'src') diff --git a/src/op_mode/config_sync.py b/src/op_mode/config_sync.py index fe8e69cab..35ed7320c 100644 --- a/src/op_mode/config_sync.py +++ b/src/op_mode/config_sync.py @@ -16,6 +16,8 @@ import sys import typing +import warnings +import urllib3 from pathlib import Path from vyos import opmode @@ -293,6 +295,12 @@ def show_sync_diff( if __name__ == '__main__': + # This one-shot op-mode process deliberately connects to the secondary + # without TLS verification (verify_tls=False) until T9396. The filter is + # scoped to this process only; the library never touches warning filters. + warnings.filterwarnings( + 'ignore', category=urllib3.exceptions.InsecureRequestWarning + ) try: res = opmode.run(sys.modules[__name__]) if res: -- cgit v1.2.3