potiuk opened a new pull request, #65346: URL: https://github.com/apache/airflow/pull/65346
## Summary `smtplib.SMTP.starttls()` does not validate the server certificate unless an SSL context is passed. `airflow.utils.email.send_mime_email` and the SMTP provider's `SmtpHook` (both sync `get_conn` and async `aget_conn`) were calling `starttls()` without a context, so the STARTTLS upgrade skipped certificate validation. This PR passes the existing SSL-context machinery to `starttls()` at all three call sites: - **`airflow-core/src/airflow/utils/email.py`** — factored the SSL-context lookup out of `_get_smtp_connection` into a helper `_get_ssl_context()`, driven by the existing `email.ssl_context` config. The helper is now called by both the `SMTP_SSL` path and the new STARTTLS path. - **`providers/smtp/src/airflow/providers/smtp/hooks/smtp.py`** — factored the SSL-context lookup into `_build_ssl_context()`, driven by the existing `ssl_context` connection extra. The helper is called for `SMTP_SSL` (sync), for `aiosmtplib.SMTP` construction (async), and for the explicit `starttls()` calls in both `get_conn` and `aget_conn`. ### Default behaviour change The default SSL context is now `ssl.create_default_context()`, which validates against the system's trusted CAs. Environments that intentionally use self-signed or otherwise non-validating SMTP servers can opt out: - Core: set `email.ssl_context = "none"` in `airflow.cfg` - Provider: set `ssl_context: "none"` in the SMTP connection extras The opt-out already existed for the SMTP_SSL path; it now applies to the STARTTLS path too. ## Test plan - [x] `airflow-core/tests/unit/utils/test_email.py` — 25/25 pass - [x] `providers/smtp/tests/unit/smtp/hooks/test_smtp.py` — 34/34 pass (including sync `test_ehlo_called_after_starttls` and async `test_async_connection` updated to verify `starttls` is invoked with an `ssl.SSLContext`) ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 4.6 (1M context) Generated-by: Claude Opus 4.6 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
