maziggy 49c948d01a Pin the TLS floor on the cleartext-probe test's context ...

CodeQL reports the context as allowing TLS 1.0 and 1.1, and it is right
about the mechanism: create_default_context() leaves minimum_version at
MINIMUM_SUPPORTED, which is the build's floor rather than a guarantee.
That is the reason every context in backend/app pins it, the reason
bambu_ftp.py carries a comment saying so, and the reason this same file
already pins it for the TLS-1.3 case further down. Line 127 was the one
that did not.

The floor cannot change what the test measures. The fixture answers with
a plain FTP banner and speaks no TLS, so the handshake still fails as
WRONG_VERSION_NUMBER, which is the assertion this test exists to make.

2026-08-29 15:29:59 +02:00

..

app

Mark the failure-reason migration's table name for bandit too

2026-08-29 14:47:43 +02:00

tests

Pin the TLS floor on the cleartext-probe test's context

2026-08-29 15:29:59 +02:00

__init__.py

…