lekss361/gendesign
1
0
Fork 0
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions

fix(cadastre): NSPDBulkClient verify=False for NSPD SSL chain (#168 hotfix) (#175)

Browse source 
Pilot run #1 failed on all 50 quarters with:
  NspdBulkError: [SSL: CERTIFICATE_VERIFY_FAILED] self-signed certificate
  in certificate chain

NSPD prod chain on Beget VPS contains an internal/self-signed CA →
httpx default verify=True trips. Reuse pattern from legacy
app.services.scrapers.nspd_lite (uses ssl._create_unverified_context()
for same reason since April 2026).

Risk profile: NSPD public gov data, no sensitive payload outbound,
admin token не уходит к NSPD endpoints. MITM risk minimal.

Co-authored-by: lekss361 <claudestars@proton.me>
This commit is contained in:
lekss361 2026-05-15 14:50:21 +03:00 • committed by GitHub
parent 37e4f854c5
commit 8dee9546ae
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
backend/app/scrapers/nspd_bulk_client.py
View file

@ -114,10 +114,16 @@ class NSPDBulkClient:
self._client: httpx.AsyncClient | None = None self._client: httpx.AsyncClient | None = None
async def __aenter__(self) -> NSPDBulkClient: async def __aenter__(self) -> NSPDBulkClient:
# NSPD prod chain contains a self-signed/internal CA on Beget VPS →
# default verify trips CERTIFICATE_VERIFY_FAILED. Existing legacy
# client (app.services.scrapers.nspd_lite) uses unverified context
# for the same reason — reuse pattern. Risk OK: public gov data,
# no sensitive payload, X-Admin-Token не уходит к NSPD.
self._client = httpx.AsyncClient( self._client = httpx.AsyncClient(
headers=self._headers, headers=self._headers,
timeout=self._timeout, timeout=self._timeout,
follow_redirects=True, follow_redirects=True,
verify=False,
) )
return self return self