`gj dZddlmZddlZddlZddlZddlmZddlm Z eje Z dZ hdZddZdd Zdd Zd d dd ZddZddZy)zPreventive SSL CA certificate checks for Hermes Agent. This module catches broken CA bundle paths before OpenAI/httpx turns them into opaque ``FileNotFoundError: [Errno 2] No such file or directory`` failures. ) annotationsN)Path)SSLConfigurationError)HERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLECURL_CA_BUNDLE>1onyestruecrtjddjjtvS)NHERMES_SKIP_SSL_GUARD)osgetenvstriplower _SKIP_VALUESB/root/.hermes/venv/lib/python3.12/site-packages/agent/ssl_guard.py_skip_ssl_guard_enabledrs+ 99,b 1 7 7 9 ? ? A\ QQrc y)NzRepair: python -m pip install --force-reinstall certifi openai httpx If you configured a custom corporate CA bundle, fix or unset the broken CA bundle environment variable.rrrr _repair_hintr s  1rc2t|dtS)z=Create a consistent, user-actionable SSL configuration error. )rr)messages r_ssl_errr(s G9B|~.>!? @@rFrequire_substantialct|j}|jst|d||j st|d||r.|j j dkrt|d|d tjt|}|jst|d|d y#t$r}t|d|d||d}~wwxYw) Nz points to a missing CA bundle: z% does not point to a CA bundle file: iz at z appears corrupted (too small))cafilez CA bundle at z cannot be loaded: z did not load any certificates) r expanduserexistsris_filestatst_sizesslcreate_default_contextstr Exception get_ca_certs)labelvaluer!pathctxexcs r_validate_bundle_pathr3-s ; ! ! #D ;;=% @HII <<>% EeWMNNtyy{22T9%UG+IJKKY((D :    %ug5STUU  Y%ug5HNOUXXYs C C.C))C.c:trtjdytD]&}t j |}|st ||( ddl}t|j}t d|dy#t$r}td||d}~wwxYw)aVerify configured and bundled CA certificates are present and loadable. Raises: SSLConfigurationError: If an explicit CA-bundle environment variable points at a bad path, or if certifi's bundled ``cacert.pem`` is missing/corrupt. z5SSL CA bundle guard skipped via HERMES_SKIP_SSL_GUARDNrzcertifi is not importable: certifiTr ) rloggerdebug_CA_BUNDLE_ENV_VARSrrr3r5r,rr+where)env_varr/r5r2 ca_bundles rverify_ca_bundler<=s  LM&2 '"  !'5 12 EGMMO$I)YDI E4SE:;DEsA== BBBcty)aBackward-compatible wrapper for older call sites. The old PR name mentioned a platform fallback, but allowing startup with a broken certifi bundle still leaves httpx/OpenAI and requests call sites failing later. Keep the wrapper name but enforce the same check. N)r<rrrverify_ca_bundle_with_fallbackr>Ws r)returnbool)r?r+)rr+r?r)r.r+r/r+r!r@r?None)r?rA)__doc__ __future__rloggingrr)pathlibr agent.errorsr getLogger__name__r6r8rrrrr3r<r>rrrrIsh # .   8 $* RA RW V J4r