From 2615e9e29309bae509d70039f08b452cd3281700 Mon Sep 17 00:00:00 2001
From: Benjamin Peterson <benjamin@python.org>
Date: Tue, 25 Nov 2014 15:16:55 -0600
Subject: don't fail tests when www.python.org can't be validated by the system

---
 Lib/test/support/__init__.py | 12 ++++++++++++
 Lib/test/test_httplib.py     |  1 +
 2 files changed, 13 insertions(+)

diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py
index e6db70f..253f319 100644
--- a/Lib/test/support/__init__.py
+++ b/Lib/test/support/__init__.py
@@ -691,6 +691,18 @@ def _is_ipv6_enabled():
 
 IPV6_ENABLED = _is_ipv6_enabled()
 
+def system_must_validate_cert(f):
+    """Skip the test on TLS certificate validation failures."""
+    @functools.wraps(f)
+    def dec(*args, **kwargs):
+        try:
+            f(*args, **kwargs)
+        except IOError as e:
+            if e.reason == "CERTIFICATE_VERIFY_FAILED":
+                raise unittest.SkipTest("system does not contain "
+                                        "necessary certificates")
+            raise
+    return dec
 
 # A constant likely larger than the underlying OS pipe buffer size, to
 # make writes blocking.
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index d259fb2..3b57d09 100644
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -794,6 +794,7 @@ class HTTPSTest(TestCase):
             resp = h.getresponse()
             self.assertIn('nginx', resp.getheader('server'))
 
+    @support.system_must_validate_cert
     def test_networked_trusted_by_default_cert(self):
         # Default settings: requires a valid cert from a trusted CA
         support.requires('network')
-- 
cgit v0.12