Live tests fail

[santiago-esubasta]

The majority of live environment tests fail with the error:

requests.exceptions.SSLError: HTTPSConnectionPool(host='servicios1.afip.gov.ar', port=443): Max retries exceeded with url: /wsfev1/service.asmx?WSDL (Caused by SSLError(SSLError(1, '[SSL: DH_KEY_TOO_SMALL] dh key too small (_ssl.c:1007)')))

I added django_afip to my project, It was working fine until 24/05/2024 when I tested it and failed for the first time. First I tought it was my project, but then cloned this repo and ran the tests to find that they fail too.

I have been looking for a cause, to no avail.

The command I executed was:

tox -e live

The output of pip freeze.

asgiref==3.8.1
attrs==23.2.0
Brotli==1.1.0
cachetools==5.3.3
certifi==2024.2.2
cffi==1.16.0
chardet==5.2.0
charset-normalizer==3.3.2
colorama==0.4.6
cryptography==38.0.4
cssselect2==0.7.0
distlib==0.3.8
Django==5.0.6
django-afip
django-renderpdf==4.0.0
filelock==3.14.0
fonttools==4.52.1
html5lib==1.1
idna==3.7
isodate==0.6.1
lxml==5.2.2
packaging==24.0
pillow==10.3.0
platformdirs==4.2.2
pluggy==1.5.0
pycparser==2.22
pydyf==0.10.0
pyOpenSSL==22.1.0
pyphen==0.15.0
pypng==0.20220715.0
pyproject-api==1.6.1
pytz==2024.1
PyYAML==6.0.1
qrcode==7.4.2
requests==2.32.2
requests-file==2.1.0
requests-toolbelt==1.0.0
setuptools-git==1.2
six==1.16.0
sqlparse==0.5.0
tinycss2==1.3.0
tomli==2.0.1
tox==4.15.0
typing_extensions==4.12.0
urllib3==2.2.0
virtualenv==20.26.2
weasyprint==62.1
webencodings==0.5.1
zeep==4.2.1
zopfli==0.2.3

[WhyNotHugo]

I can reproduce the issue locally on Python 3.12. I'll investigate further.

[WhyNotHugo]

I triggered a CI run with Python 3.11 and that also fails: https://builds.sr.ht/~whynothugo/job/1234581#task-tox-live with SSL: DH_KEY_TOO_SMALL.

This same commit passed CI a few weeks ago, so this problem isn't caused by a recent change in my code: https://builds.sr.ht/~whynothugo/job/1217332#task-tox-live

Maybe some dependency changed something...?

[WhyNotHugo]

Variation in dependencies between both runs:

--- pass
+++ fail
@@ -4,30 +4,30 @@
 certifi==2024.2.2
 cffi==1.16.0
 charset-normalizer==3.3.2
-coverage==7.5.1
+coverage==7.5.3
 cryptography==39.0.2
 cssselect2==0.7.0
-dj-database-url==2.1.0
+dj-database-url==2.2.0
 Django==5.0.6
 django-afip==12.0.0.post21+g3aa3c6e
 django-renderpdf==4.0.0
-django-stubs==5.0.0
-django-stubs-ext==5.0.0
+django-stubs==5.0.2
+django-stubs-ext==5.0.2
 factory-boy==3.3.0
-Faker==25.1.0
-fonttools==4.51.0
-freezegun==1.5.0
+Faker==25.3.0
+fonttools==4.52.4
+freezegun==1.5.1
 html5lib==1.1
 idna==3.7
 iniconfig==2.0.0
 isodate==0.6.1
-lxml==5.2.1
+lxml==5.2.2
 mypy==1.10.0
 mypy-extensions==1.0.0
 packaging==24.0
 pillow==10.3.0
 pip==23.3.1
-platformdirs==4.2.1
+platformdirs==4.2.2
 pluggy==1.5.0
 psycopg2==2.9.9
 pycparser==2.22
@@ -35,15 +35,15 @@
 pyOpenSSL==23.2.0
 pyphen==0.15.0
 pypng==0.20220715.0
-pytest==8.2.0
+pytest==8.2.1
 pytest-cov==5.0.0
 pytest-django==4.8.0
 python-dateutil==2.9.0.post0
 pytz==2024.1
 PyYAML==6.0.1
 qrcode==7.4.2
-requests==2.31.0
-requests-file==2.0.0
+requests==2.32.2
+requests-file==2.1.0
 requests-toolbelt==1.0.0
 setuptools==68.2.2
 setuptools-git==1.2
@@ -56,9 +56,9 @@
 types-pyOpenSSL==24.1.0.20240425
 types-pytz==2024.1.0.20240417
 types-PyYAML==6.0.12.20240311
-types-requests==2.31.0.20240406
-types-setuptools==69.5.0.20240423
-typing_extensions==4.11.0
+types-requests==2.32.0.20240523
+types-setuptools==70.0.0.20240524
+typing_extensions==4.12.0
 urllib3==2.2.1
 weasyprint==62.1
 webencodings==0.5.1

[WhyNotHugo]

Likely culprit: https://github.com/psf/requests/blob/6badbac6e0d6b5a53872f26401761ad37a9002b8/HISTORY.md#2322-2024-05-21

[WhyNotHugo]

Tests pass when using requests==2.31.0. The problem is confirmed to be the above change.

[WhyNotHugo]

I really don't understand why that change is producing this error. I've asked for some guidance in the relevant PR: psf/requests#6710 (comment)

@santiago-esubasta You should really pin dependencies for your application to avoid them suddenly upgrading without your intervention. Consider using pip-tools.

[santiago-esubasta]

I can confirm, changing to requests==2.31.0 solves the issue. Thank you!

[WhyNotHugo]

Leaving open; we still need to fix this for newer versions.