Include ctime in the CA file signature

An in-place rewrite that keeps the size and mtime (cp -p, rsync -t)
left the key unchanged until the TTL expired; ctime cannot be preserved
that way.

Signed-off-by: Vu Anh Phung <vu.phung@databricks.com>
Co-authored-by: Isaac <no-reply@databricks.com>

Author: vuanhphung

src/databricks/sql/common/ssl_context_cache.py

@@ -35,7 +35,8 @@ def _file_signature(path) -> Optional[Tuple]:
         st = os.stat(path)
     except (OSError, TypeError, ValueError):
         return (path, None)
-    return (path, st.st_ino, st.st_size, st.st_mtime_ns)
+    # ctime too: in-place rewrites that preserve mtime (cp -p, rsync -t) still change it.
+    return (path, st.st_ino, st.st_size, st.st_mtime_ns, st.st_ctime_ns)
 
 
 def _cache_key(kind: str, ssl_options: "SSLOptions") -> tuple:

tests/unit/test_ssl_context_cache.py

@@ -1,5 +1,6 @@
 import os
 import ssl
+import sys
 import threading
 import time
 from types import SimpleNamespace
@@ -94,6 +95,29 @@ def test_rewritten_ca_file_gets_a_new_context(self, tmp_path):
         assert before is not after
         assert ssl_context_cache.get_ssl_context("k", options, build) is after
 
+    @pytest.mark.skipif(
+        sys.platform == "win32", reason="st_ctime is the creation time on Windows"
+    )
+    def test_in_place_rewrite_keeping_mtime_gets_a_new_context(self, tmp_path):
+        ca_file = tmp_path / "ca.pem"
+        ca_file.write_text("old")
+        original = ca_file.stat()
+        options = SSLOptions(tls_trusted_ca_file=str(ca_file))
+        build, built = counting_builder()
+        before = ssl_context_cache.get_ssl_context("k", options, build)
+
+        time.sleep(0.05)  # filesystem timestamps can be jiffy-granular
+        ca_file.write_text("new")  # same inode and size, like `cp -p`
+        os.utime(ca_file, ns=(original.st_atime_ns, original.st_mtime_ns))
+        rewritten = ca_file.stat()
+
+        assert (rewritten.st_ino, rewritten.st_size, rewritten.st_mtime_ns) == (
+            original.st_ino,
+            original.st_size,
+            original.st_mtime_ns,
+        )
+        assert ssl_context_cache.get_ssl_context("k", options, build) is not before
+
     def test_default_bundle_env_change_gets_a_new_context(self, tmp_path, monkeypatch):
         bundle = tmp_path / "bundle.pem"
         bundle.write_text("x")