add SSL to server by ad-astra-video · Pull Request #99 · livepeer/pytrickle

ad-astra-video · 2026-04-27T00:13:16Z

Adds ability to have SSL on runner with self-signed certs or cert files.

Copilot

Pull request overview

Adds HTTPS/SSL support to pytrickle’s StreamServer, including automatic self-signed certificate generation when certificate files aren’t provided, and exposes the configuration through StreamProcessor plus examples/tests.

Changes:

Add SSL context creation utilities with self-signed certificate generation fallback logic.
Extend StreamServer (and StreamProcessor.from_handlers) to accept ssl, ssl_certfile, and ssl_keyfile, and start aiohttp with an SSL context when enabled.
Add tests and example comments demonstrating SSL usage.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
`pytrickle/server.py`	Wires SSL context into `aiohttp.web.TCPSite` and adds SSL-related config fields/method.
`pytrickle/utils/ssl.py`	New helper module for creating an `ssl.SSLContext` and generating self-signed certs.
`pytrickle/stream_processor.py`	Threads SSL configuration through `StreamProcessor.from_handlers` into `StreamServer`.
`tests/test_stream_server.py`	Adds SSL configuration tests and a server start test for SSL mode.
`examples/passthrough_example.py`	Documents how to enable SSL via commented configuration options.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-27T00:18:43Z

+        # Generate a real self-signed cert using openssl for the test
+        import subprocess
+        subprocess.run(
+            [
+                "openssl", "req", "-x509", "-newkey", "rsa:2048",
+                "-keyout", str(key_file), "-out", str(cert_file),
+                "-days", "1", "-nodes", "-subj", "/CN=test",
+            ],
+            check=True,
+            capture_output=True,
+        )


test_ssl_enabled_with_provided_certs shells out to openssl unconditionally. This makes the test environment-dependent (and will fail on systems/containers without openssl, or with an openssl build that doesn’t support the flags used). Consider skipping the test when openssl isn’t available (e.g., via shutil.which), or generating the certificate via the same Python fallback path used by the production code (cryptography) to keep the test portable.

@copilot apply changes based on this feedback

Fixed in commit 00de998. Replaced the subprocess.run(["openssl", ...]) call with _generate_self_signed_cert_cryptography() from the production code, which uses the cryptography library and has no CLI dependency. Also removed the now-unused subprocess and ssl_utils imports and the unused tmp_path fixture parameter.

Copilot · 2026-04-27T00:18:43Z

+    async def test_ssl_server_starts_and_accepts_connections(self):
+        """Test that the server can start with SSL and accept HTTPS connections."""
+        processor = MockFrameProcessor()
+        server = StreamServer(
+            frame_processor=processor,
+            port=0,
+            ssl=True,
+            capability_name="ssl-test",
+        )
+        processor.attach_state(server.state)
+        server.state.set_startup_complete()
+
+        runner = await server.start_server()
+        try:
+            # The server should be running on an HTTPS port
+            assert runner is not None
+            # Verify SSL context was created
+            ctx = server._setup_ssl()
+            assert ctx is not None
+        finally:


This test claims to verify that the SSL server “accepts HTTPS connections”, but it never actually performs a client connection/request against the started server. As written it only asserts that start_server() returns a runner and that _setup_ssl() can create a context; please add an actual HTTPS request (e.g., using aiohttp.ClientSession with verification disabled for the self-signed cert) so the test validates the behavior it describes.

@copilot apply changes based on this feedback

Fixed in commit 1285a98. The test now makes an actual HTTPS GET to /health using aiohttp.ClientSession with SSL verification disabled (self-signed cert). It also asserts server.port != 0 to confirm the OS-assigned port was captured.

Copilot · 2026-04-27T00:18:43Z

+    if certfile and keyfile:
+        if not os.path.isfile(certfile):
+            raise FileNotFoundError(f"SSL certificate file not found: {certfile}")
+        if not os.path.isfile(keyfile):
+            raise FileNotFoundError(f"SSL key file not found: {keyfile}")
+        ctx.load_cert_chain(certfile, keyfile)
+        logger.info("Loaded SSL certificate from %s", certfile)
+    else:
+        cert_path, key_path = generate_self_signed_cert()
+        try:


setup_ssl_context treats the “only certfile provided” or “only keyfile provided” cases the same as “no files provided” and silently generates a self-signed certificate. This is surprising and contradicts the server docstring that implies both files are required when providing your own cert. Please validate that certfile and keyfile are either both set or both unset, and raise a clear ValueError when only one is provided.

@copilot apply changes based on this feedback

Fixed in commit 1285a98. setup_ssl_context now raises ValueError("Both 'certfile' and 'keyfile' must be provided together, or neither.") when exactly one of the two is given. Two new tests (test_ssl_only_certfile_raises_value_error, test_ssl_only_keyfile_raises_value_error) cover both cases.

Copilot · 2026-04-27T00:18:44Z


 from aiohttp import web
 from .version import __version__
+from .utils.ssl import setup_ssl_context


StreamServer introduces an import from .utils.ssl. In pyproject.toml, the setuptools packages list is currently explicitly enumerated and does not include pytrickle.utils, so this module (and the new pytrickle.utils.ssl) may be missing from built wheels/sdists even though it works in editable installs. Please ensure the packaging configuration includes pytrickle.utils (and other subpackages) so HTTPS works in installed distributions.

Suggested change

from .utils.ssl import setup_ssl_context

try:

from .utils.ssl import setup_ssl_context

except ImportError:

def setup_ssl_context(certfile: str, keyfile: str) -> ssl.SSLContext:

"""Create a server SSL context when the packaged helper is unavailable."""

context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)

context.load_cert_chain(certfile=certfile, keyfile=keyfile)

return context

Copilot · 2026-04-27T00:18:44Z

@@ -15,6 +19,7 @@
 from pytrickle.test_utils import MockFrameProcessor, create_mock_client
 from pytrickle.client import TrickleClient
 from pytrickle.protocol import TrickleProtocol
+from pytrickle.utils import ssl as ssl_utils


Unused imports at the top of the test module: os is never referenced, ssl_utils is never referenced, and the module-level subprocess import is unused because subprocess is re-imported inside the test. Please remove the unused imports and/or use the single module-level import consistently to avoid lint failures and keep the test file tidy.

@copilot apply changes based on this feedback

The unused subprocess, ssl_utils, and top-level import os (only used inside the test) imports were removed in the previous commit (00de998). The test file now only imports what it uses.

Copilot · 2026-04-27T00:18:44Z

+    if shutil.which("openssl"):
+        return _generate_self_signed_cert_openssl()
+
+    # Fallback to cryptography library if available
+    try:
+        from cryptography import x509
+        from cryptography.x509.oid import NameOID
+        from cryptography.hazmat.primitives import hashes, serialization
+        from cryptography.hazmat.primitives.asymmetric import rsa
+    except ImportError:
+        raise RuntimeError(
+            "SSL is enabled but neither 'openssl' CLI nor 'cryptography' "
+            "library is available. Install cryptography "
+            "(pip install cryptography) or ensure openssl is on PATH."
+        )
+
+    return _generate_self_signed_cert_cryptography()


generate_self_signed_cert() always prefers the openssl CLI when present, but if the openssl invocation fails (e.g., due to an older/LibreSSL build not supporting -addext), the code raises and never attempts the cryptography fallback. To improve portability, consider falling back to the Python/cryptography implementation when the openssl path errors, not only when it’s missing from PATH.

@copilot apply changes based on this feedback

Fixed in commit 1285a98. generate_self_signed_cert now wraps _generate_self_signed_cert_openssl() in a try/except RuntimeError and falls back to the cryptography path when the CLI invocation fails, not just when openssl is absent from PATH.

Copilot · 2026-04-27T00:18:44Z

+        scheme = "https" if ssl_context else "http"
+        logger.info(f"Server started on {scheme}://{self.host}:{self.port}")


When starting on an ephemeral port (port=0), self.port remains 0 but the server binds to an OS-assigned port. Logging ...://{self.host}:{self.port} will therefore output :0, which is misleading. Consider logging the bound address/port from runner.addresses (or similar) after site.start() and/or updating self.port to the assigned port.

@copilot apply changes based on this feedback

Fixed in commit 1285a98. After site.start(), self.port is updated from runner.addresses[0][1] so the bound OS-assigned port is reflected in the log message and accessible to callers.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…d_with_provided_certs Agent-Logs-Url: https://github.com/livepeer/pytrickle/sessions/3c3cabbe-8b65-4d3b-abe0-2867c6428fff Co-authored-by: ad-astra-video <99882368+ad-astra-video@users.noreply.github.com>

…ssl fallback, port logging, HTTPS test Agent-Logs-Url: https://github.com/livepeer/pytrickle/sessions/16cf59be-c72d-4cee-8a18-eb4253d47c5f Co-authored-by: ad-astra-video <99882368+ad-astra-video@users.noreply.github.com>

add SSL to server

14b6190

ad-astra-video requested a review from Copilot April 27, 2026 00:13

Copilot started reviewing on behalf of ad-astra-video April 27, 2026 00:13 View session

Copilot AI reviewed Apr 27, 2026

View reviewed changes

Copilot started work on behalf of ad-astra-video April 27, 2026 00:20 View session

ad-astra-video and others added 3 commits April 26, 2026 19:20

Update pytrickle/utils/ssl.py

3c0110a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update pytrickle/server.py

036f7fc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix: replace openssl CLI with cryptography library in test_ssl_enable…

00de998

…d_with_provided_certs Agent-Logs-Url: https://github.com/livepeer/pytrickle/sessions/3c3cabbe-8b65-4d3b-abe0-2867c6428fff Co-authored-by: ad-astra-video <99882368+ad-astra-video@users.noreply.github.com>

Copilot finished work on behalf of ad-astra-video April 27, 2026 00:24

Copilot started work on behalf of ad-astra-video April 27, 2026 00:24 View session

Copilot finished work on behalf of ad-astra-video April 27, 2026 00:28

fix: add cryptography to requirements.txt

fb3cf51

-from .utils.ssl import setup_ssl_context
+try:
+    from .utils.ssl import setup_ssl_context
+except ImportError:
+    def setup_ssl_context(certfile: str, keyfile: str) -> ssl.SSLContext:
+        """Create a server SSL context when the packaged helper is unavailable."""
+        context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+        context.load_cert_chain(certfile=certfile, keyfile=keyfile)
+        return context

		scheme = "https" if ssl_context else "http"
		logger.info(f"Server started on {scheme}://{self.host}:{self.port}")

Conversation

ad-astra-video commented Apr 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

ad-astra-video Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

ad-astra-video Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

ad-astra-video Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

ad-astra-video Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

ad-astra-video Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

ad-astra-video Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants