[torben-hansen]

test_distrusted_spki fails on builds linked against AWS-LC.

AWS-LC maintains its own SPKI denylist and rejects a set of intermediates
during chain building, before _ssl's verify callback can see the certificate.
AWS-LC's error (X509_V_ERR_CERT_REVOKED, 23) is therefore
reported instead of _ssl's own X509_V_ERR_CERT_REJECTED (28).
The test assumes the latter error code.

Accept either code depending on the TLS library. Test-only change.

#160736

• Issue: ssl: test_distrusted_spki fails on AWS-LC builds #160736

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[bedevere-app]

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

[torben-hansen]

The AWS-LC test job fails because it uses an earlier version without the change. This is the earliest version with the AWS-LC intermediate distrust feature: https://github.com/aws/aws-lc/releases/tag/v5.12.0

[picnixz]

The AWS-LC test job fails because it uses an earlier version without the change

Can you first open a PR for bumping the AWS-LC version (or add more versions to it if there is a notion of LTS for AWS-LC?)

[torben-hansen]

The AWS-LC test job fails because it uses an earlier version without the change

Can you first open a PR for bumping the AWS-LC version (or add more versions to it if there is a notion of LTS for AWS-LC?)

I can do that for sure. But if done in a separate PR, it would fail the test case :)

[picnixz]

You can do it in ths PR actually. Add the new version to test in AWS-LC and skip the test depending on the version.