Obey ARVADOS_API_HOST_INSECURE and use the debian trusted CA list if

[arvados.git] / sdk / python / arvados.py

diff --git a/sdk/python/arvados.py b/sdk/python/arvados.py
index 6e06f5a589983d5311d532d59ada4d8c15f93295..7d99d582a6cf10132d9ec61ad9faf1beba0313ed 100644 (file)
--- a/sdk/python/arvados.py
+++ b/sdk/python/arvados.py
@@ -43,9 +43,17 @@ class CredentialsFromEnv:
 url = ('https://%s/discovery/v1/apis/'
        '{api}/{apiVersion}/rest' % os.environ['ARVADOS_API_HOST'])
 credentials = CredentialsFromEnv()
-http = httplib2.Http()
+
+# Use system's CA certificates (if we find them) instead of httplib2's
+ca_certs = '/etc/ssl/certs/ca-certificates.crt'
+if not os.path.exists(ca_certs):
+    ca_certs = None             # use httplib2 default
+
+http = httplib2.Http(ca_certs=ca_certs)
 http = credentials.authorize(http)
-http.disable_ssl_certificate_validation=True
+if re.match(r'(?i)^(true|1|yes)$',
+            os.environ.get('ARVADOS_API_HOST_INSECURE', '')):
+    http.disable_ssl_certificate_validation=True
 service = build("arvados", "v1", http=http, discoveryServiceUrl=url)
 
 def task_set_output(self,s):
@@ -83,8 +91,8 @@ def api():
     return service
 
 class JobTask:
-    def __init__(self, parameters=dict(), resource_limits=dict()):
-        print "init jobtask %s %s" % (parameters, resource_limits)
+    def __init__(self, parameters=dict(), runtime_constraints=dict()):
+        print "init jobtask %s %s" % (parameters, runtime_constraints)
 
 class job_setup:
     @staticmethod