[mohamed-hashi-db]

Changes

certifi 2026.10.19 removes the distrusted eMudhra "emSign ECC Root CA - G3" root from its CA bundle. Earlier versions still trust certificates chained to that root.

• Add a runtime floor certifi>=2026.10.19 in pyproject.toml. certifi is not imported directly (it arrives via databricks-sdk -> requests), but the floor makes pip upgrade an older certifi that is already installed in the target environment.
• Update uv.lock for certifi (2026.6.17 -> 2026.10.19) only.

The floor reaches installs with the next release.

Tests

• manually tested
• added unit tests
• updated integration tests
• verified on staging environment (screenshot attached)

make test with uv 0.11.33. This environment cannot reach files.pythonhosted.org, so it ran on a copy of this branch whose uv.lock URLs point at an internal PyPI mirror:

$ make test
uv run --exact --all-extras pytest -n 4 --timeout 30 --durations 20 --cov src --cov-report=xml tests/unit
…
============================== 65 passed in 1.95s ==============================

CA bundle in that test environment:

$ .venv/bin/python -I -c 'import certifi; print("  certifi", certifi.__version__, "G3 present:", "emSign ECC Root CA - G3" in open(certifi.where()).read())'
  certifi 2026.10.19 G3 present: False

Old vs. new wheels (searching each wheel's cacert.pem for the root's name):

Wheel	emSign ECC Root CA - G3
certifi 2026.6.17 (old lock)	present
certifi 2026.10.19	absent

The lock was produced with uv lock --upgrade-package certifi (uv 0.11.33), then the lock-dependencies URL scrub. The , size = N fields were also stripped to match the committed lock. uv lock --check exits 1 in this environment on both main and this branch (error: The lockfile at uv.lock needs to be updated, but --check was provided.), because the lock records pypi.org URLs and resolution here goes through the mirror. So I have not verified it here; CI will.

---

Additional updates for broken integration tests:

• make_user(): Failed because creating a user doesn't automatically create the home directory. Fixed. Resolves Test failure: test_new_user #301
• test_external_delta_table_in_new_schema(): Failing because of an upstream issue: sharing.delta.io fails resolve. Marked with xfail(). Resolves Test failure: test_external_delta_table_in_new_schema #303

[github-actions]

✅ 39/39 passed, 7 skipped, 14m23s total

_{Running from acceptance #333}

[github-actions]

❌ 39/40 passed, 1 failed, 6 skipped, 19m19s total

❌ test_new_user: databricks.sdk.errors.platform.ResourceDoesNotExist: Path (/Users/dummy-fw5yfshq-ra78c3e082@example.com) doesn't exist. (3.819s)

databricks.sdk.errors.platform.ResourceDoesNotExist: Path (/Users/dummy-fw5yfshq-ra78c3e082@example.com) doesn't exist.
[gw9] linux -- Python 3.10.20 /home/runner/work/pytester/pytester/.venv/bin/python
12:38 INFO [databricks.labs.pytester.fixtures.baseline] Created dummy-fw5yfshq-ra78c3e082@example.com: https://DATABRICKS_HOST/#settings/workspace/identity-and-access/users/145404566894915
12:38 DEBUG [databricks.labs.pytester.fixtures.baseline] added workspace user fixture: User(active=True, display_name='dummy-fw5yfshq-ra78c3e082@example.com', emails=[ComplexValue(display=None, primary=True, ref=None, type='work', value='dummy-fw5yfshq-ra78c3e082@example.com')], entitlements=[ComplexValue(display=None, primary=None, ref=None, type=None, value='workspace-access'), ComplexValue(display=None, primary=None, ref=None, type=None, value='databricks-sql-access')], external_id=None, groups=[], id='145404566894915', name=Name(family_name=None, given_name='dummy-fw5yfshq-ra78c3e082@example.com'), roles=[], schemas=[<UserSchema.URN_IETF_PARAMS_SCIM_SCHEMAS_CORE_2_0_USER: 'urn:ietf:params:scim:schemas:core:2.0:User'>, <UserSchema.URN_IETF_PARAMS_SCIM_SCHEMAS_EXTENSION_WORKSPACE_2_0_USER: 'urn:ietf:params:scim:schemas:extension:workspace:2.0:User'>], user_name='dummy-fw5yfshq-ra78c3e082@example.com')
12:38 INFO [databricks.labs.pytester.fixtures.baseline] Created dummy-fw5yfshq-ra78c3e082@example.com: https://DATABRICKS_HOST/#settings/workspace/identity-and-access/users/145404566894915
12:38 DEBUG [databricks.labs.pytester.fixtures.baseline] added workspace user fixture: User(active=True, display_name='dummy-fw5yfshq-ra78c3e082@example.com', emails=[ComplexValue(display=None, primary=True, ref=None, type='work', value='dummy-fw5yfshq-ra78c3e082@example.com')], entitlements=[ComplexValue(display=None, primary=None, ref=None, type=None, value='workspace-access'), ComplexValue(display=None, primary=None, ref=None, type=None, value='databricks-sql-access')], external_id=None, groups=[], id='145404566894915', name=Name(family_name=None, given_name='dummy-fw5yfshq-ra78c3e082@example.com'), roles=[], schemas=[<UserSchema.URN_IETF_PARAMS_SCIM_SCHEMAS_CORE_2_0_USER: 'urn:ietf:params:scim:schemas:core:2.0:User'>, <UserSchema.URN_IETF_PARAMS_SCIM_SCHEMAS_EXTENSION_WORKSPACE_2_0_USER: 'urn:ietf:params:scim:schemas:extension:workspace:2.0:User'>], user_name='dummy-fw5yfshq-ra78c3e082@example.com')
12:38 DEBUG [databricks.labs.pytester.fixtures.baseline] clearing 1 workspace user fixtures
12:38 DEBUG [databricks.labs.pytester.fixtures.baseline] removing workspace user fixture: User(active=True, display_name='dummy-fw5yfshq-ra78c3e082@example.com', emails=[ComplexValue(display=None, primary=True, ref=None, type='work', value='dummy-fw5yfshq-ra78c3e082@example.com')], entitlements=[ComplexValue(display=None, primary=None, ref=None, type=None, value='workspace-access'), ComplexValue(display=None, primary=None, ref=None, type=None, value='databricks-sql-access')], external_id=None, groups=[], id='145404566894915', name=Name(family_name=None, given_name='dummy-fw5yfshq-ra78c3e082@example.com'), roles=[], schemas=[<UserSchema.URN_IETF_PARAMS_SCIM_SCHEMAS_CORE_2_0_USER: 'urn:ietf:params:scim:schemas:core:2.0:User'>, <UserSchema.URN_IETF_PARAMS_SCIM_SCHEMAS_EXTENSION_WORKSPACE_2_0_USER: 'urn:ietf:params:scim:schemas:extension:workspace:2.0:User'>], user_name='dummy-fw5yfshq-ra78c3e082@example.com')
[gw9] linux -- Python 3.10.20 /home/runner/work/pytester/pytester/.venv/bin/python

_{Running from acceptance #329}