From f95184ca4ce9c2b827016bd0f5f852457d1ef5b9 Mon Sep 17 00:00:00 2001
From: Stefano Rivera <stefano@rivera.za.net>
Date: Wed, 18 Oct 2023 14:20:05 +0200
Subject: [PATCH] Mark tests as requiring Internet

So that we can self-contained tests, when offline.

The use-case here is packaging truststore in Debian.
We like to run tests during our package builds, where possible. These
build environments don't permit Internet access.
We do have CI test environments that can access the Internet, but those
happen after build. We'd run the full test suite there (inclnuding
mkcert, which messes with the system certificate store).

I see that the vast majority of the tests require Internet access, so I
understand if you're not interested in this patch, because you aren't
expecting much low-level test coverage.
---
 pyproject.toml           |  3 +++
 tests/conftest.py        | 10 +++++++++-
 tests/test_api.py        | 18 +++++++++++++-----
 tests/test_sslcontext.py |  3 +++
 4 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index dd6565c..1006a46 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -38,6 +38,9 @@ filterwarnings = [
   # See: aio-libs/aiohttp#7545
   "ignore:.*datetime.utcfromtimestamp().*:DeprecationWarning",
 ]
+markers = [
+  "internet: test reqires Internet access"
+]
 
 [tool.flit.sdist]
 include = ["docs", "tests"]
diff --git a/tests/conftest.py b/tests/conftest.py
index 938611c..b6e68a0 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -18,7 +18,15 @@
 original_SSLContext = ssl.SSLContext
 
 
-successful_hosts = pytest.mark.parametrize("host", ["example.com", "1.1.1.1"])
+def decorator_requires_internet(decorator):
+    """Mark a decorator with the "internet" mark"""
+    def wrapper(f):
+        return pytest.mark.internet(decorator(f))
+    return wrapper
+
+
+successful_hosts = decorator_requires_internet(
+    pytest.mark.parametrize("host", ["example.com", "1.1.1.1"]))
 
 logger = logging.getLogger("aiohttp.web")
 
diff --git a/tests/test_api.py b/tests/test_api.py
index c62903d..278e1fb 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -20,6 +20,7 @@
 
 import truststore
 from tests import SSLContextAdapter
+from tests.conftest import decorator_requires_internet
 
 pytestmark = pytest.mark.flaky
 
@@ -27,7 +28,9 @@
 # if the client drops the connection due to a cert verification error
 socket.setdefaulttimeout(10)
 
-successful_hosts = pytest.mark.parametrize("host", ["example.com", "1.1.1.1"])
+
+successful_hosts = decorator_requires_internet(
+    pytest.mark.parametrize("host", ["example.com", "1.1.1.1"]))
 
 
 @dataclass
@@ -118,8 +121,10 @@ class FailureHost:
     ),
 ]
 
-failure_hosts_no_revocation = pytest.mark.parametrize(
-    "failure", failure_hosts_list.copy(), ids=attrgetter("host")
+failure_hosts_no_revocation = decorator_requires_internet(
+    pytest.mark.parametrize(
+        "failure", failure_hosts_list.copy(), ids=attrgetter("host")
+    )
 )
 
 if platform.system() != "Linux":
@@ -139,8 +144,10 @@ class FailureHost:
         )
     )
 
-failure_hosts = pytest.mark.parametrize(
-    "failure", failure_hosts_list, ids=attrgetter("host")
+failure_hosts = decorator_requires_internet(
+    pytest.mark.parametrize(
+        "failure", failure_hosts_list, ids=attrgetter("host")
+    )
 )
 
 
@@ -318,6 +325,7 @@ def test_trustme_cert_loaded_via_capath(trustme_ca, httpserver):
         assert len(resp.data) > 0
 
 
+@pytest.mark.internet
 def test_trustme_cert_still_uses_system_certs(trustme_ca):
     ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     trustme_ca.configure_trust(ctx)
diff --git a/tests/test_sslcontext.py b/tests/test_sslcontext.py
index ea78d28..d7d25b0 100644
--- a/tests/test_sslcontext.py
+++ b/tests/test_sslcontext.py
@@ -8,6 +8,7 @@
 import truststore
 
 
+@pytest.mark.internet
 def test_minimum_maximum_version():
     ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     ctx.maximum_version = ssl.TLSVersion.TLSv1_2
@@ -24,6 +25,7 @@ def test_minimum_maximum_version():
     assert ctx.maximum_version == ssl.TLSVersion.TLSv1_2
 
 
+@pytest.mark.internet
 def test_check_hostname_false():
     ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     assert ctx.check_hostname is True
@@ -35,6 +37,7 @@ def test_check_hostname_false():
         assert "match" in str(e.value)
 
 
+@pytest.mark.internet
 def test_verify_mode_cert_none():
     ctx = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     assert ctx.check_hostname is True