[Jeel-Oza]

[patch] Move SSLError handling to python-devops/src/mas/devops/utils.py, simplify validateEntitlementKey in cli.py

Summary

Fixes entitlement key validation failing with an unhelpful error message when the CLI cannot reach cp.icr.io due to an SSL certificate verification error (e.g. corporate proxy or firewall performing TLS interception).

Previously, all failures — whether SSL errors or genuine authentication failures — were surfaced as the same generic error, leaving customers unable to determine whether their key was wrong or the network was blocking the connection.

Changes

python/src/mas/cli/cli.py

• Added RequestsException import to catch unexpected non-SSL network errors re-raised from utils.py
• Updated validateEntitlementKey() — now catches RequestsException (non-SSL network errors) and returns False; SSLError is handled in utils.py and arrives as None
• promptForEntitlementKey() — SSL-specific warning messages and interactive menu retained (unchanged)

python/tests/unit/test_entitlement_key_validation.py

• Updated test_validate_with_ssl_error — changed side_effect=SSLError to return_value=None to reflect that utils.py now absorbs SSLError internally and returns None
• Updated test_validate_with_network_error and test_validate_with_timeout — changed to side_effect=ConnectionError/Timeout to reflect that utils.py re-raises these and cli.py catches them and returns False
• Updated assertions accordingly

Testing

Reproduced both scenarios manually inside the MAS CLI container.

Case 1 — SSL error (corporate proxy / self-signed certificate)

# Generate a fake CA cert that Python will not trust for cp.icr.io
openssl req -x509 -newkey rsa:2048 -keyout /tmp/fake-ca.key \
  -out /tmp/fake-ca.crt -days 1 -nodes \
  -subj "/CN=FakeCA"

# Force requests to use the fake bundle
export REQUESTS_CA_BUNDLE=/tmp/fake-ca.crt

# Run the CLI and enter any entitlement key
mas install

Result: Warning: SSL certificate verification failed — could not reach cp.icr.io with explanation that the key may still be valid and options to try again / continue / quit

Case 2 — Wrong entitlement key

# Unset the fake CA bundle so the network is reachable
unset REQUESTS_CA_BUNDLE

# Run the CLI and enter a deliberately wrong entitlement key
mas install

Result: Warning: IBM entitlement key validation failed with options to try again / continue / quit

Case 3 — Network unreachable (proxy refuses connection)

unset REQUESTS_CA_BUNDLE
# Keep cluster access working, route only external traffic through a dead proxy
export NO_PROXY=.fyre.ibm.com,localhost,127.0.0.1
export HTTPS_PROXY=http://127.0.0.1:9    # nothing is listening on this port

# Run the CLI and enter any entitlement key
mas install

Result: Warning: IBM entitlement key validation failed with options to try again / continue / quit. No traceback and the CLI does not exit.
utils.py re-raises the ProxyError, cli.py catches it as RequestsException and returns False.

Case 4 — Connection timeout (non-routable proxy)

export HTTPS_PROXY=http://10.255.255.1:3128    # non-routable address, connection times out

# Run the CLI and enter any entitlement key
mas install

Result: after the timeout, Warning: IBM entitlement key validation failed with options to try again / continue / quit. No traceback and the CLI does not exit.

unset HTTPS_PROXY NO_PROXY REQUESTS_CA_BUNDLE

Linked issue

Fixes MASCORE-16263
Closes #2519

[terc1997]

The PR on python-devops will change the implementation in the CLI.

[terc1997]

LGTM. However, I didn't see tests for the new change. I'll hold ibm-mas/python-devops#497 until you add evidence of testing from your new changes.