test_bundle: guard BasicConstraints query w/ try

Signed-off-by: Andrew Pan <a@tny.town>
sigstore · May 8, 2023 · 1f15a08 · 1f15a08
1 parent c2bb326
commit 1f15a08
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/test/test_bundle.py b/test/test_bundle.py
@@ -46,5 +46,10 @@ def test_sign_does_not_produce_root(
     certs = bundle.verification_material.x509_certificate_chain
     for cert in certs.certificates:
         cert = x509.load_der_x509_certificate(cert.raw_bytes)
-        constraints = cert.extensions.get_extension_for_class(x509.BasicConstraints)
-        assert not constraints.value.ca
+
+        try:
+            constraints = cert.extensions.get_extension_for_class(x509.BasicConstraints)
+            assert not constraints.value.ca
+        # BasicConstraints isn't required to appear in leaf certificates.
+        except x509.ExtensionNotFound:
+            pass