Repository: docker/docker-py

Issue:
Certificate error in docker ci for test-docker-py
https://jenkins.dockerproject.org/job/Docker-PRs/24848/console for detail.
in docker-py, when checkout to the commit of 387db11009f4b4f64a4f2c6fd64d3eeb01828585,the error appears,if I remove the commit ,we will not have the error.

```

==================================== ERRORS ====================================
_________________ ERROR at setup of InformationTest.test_info __________________
/docker-py/tests/integration/conftest.py:17: in setup_test_session
    c = docker_client()
/docker-py/tests/helpers.py:61: in docker_client
    return docker.Client(**docker_client_kwargs(**kwargs))
/docker-py/tests/helpers.py:65: in docker_client_kwargs
    client_kwargs = docker.utils.kwargs_from_env(assert_hostname=False)
/docker-py/docker/utils/utils.py:486: in kwargs_from_env
    assert_fingerprint=tls_verify)
/docker-py/docker/tls.py:47: in __init__
    'Path to a certificate and key files must be provided'
E   TLSParameterError: Path to a certificate and key files must be provided through the client_config 
param. TLS configurations should map the Docker CLI client configurations. 
See https://docs.docker.com/engine/articles/https/ for API details.
________________ ERROR at setup of InformationTest.test_search _________________
...
```



Discussion:
I am also encountering this problem. It occurs when `DOCKER_CERT_PATH` and `DOCKER_TLS_VERIFY` are both set to empty string (i.e. the rather odd way of stating that the the connection to the Docker daemon should not be secure). This environment setup is not tested here: https://github.com/docker/docker-py/blob/387db11009f4b4f64a4f2c6fd64d3eeb01828585/tests/unit/utils_test.py#L159.

The issue is with the `kwargs_from_env` method in `docker/utils/util.py`. In release 1.7.0, a `TLSConfig` instance was only constructed if `tls_verify` and `cert_path` were `True`:
https://github.com/docker/docker-py/blob/release-1.7.0/docker/utils/utils.py#L460

This is no longer the case in release 1.7.1 onwards:
https://github.com/docker/docker-py/blob/1.7.1-release/docker/utils/utils.py#L485

Thank you for the report. Have you tried it with the fix 9ba0ddf267f853afe37441da7798987e199817dd ? We released 1.7.2 to try and address those TLS issues, but it's possible we might have missed a case.


Resolving patch:
diff --git a/docker/utils/utils.py b/docker/utils/utils.py
--- a/docker/utils/utils.py
+++ b/docker/utils/utils.py
@@ -460,16 +460,16 @@ def kwargs_from_env(ssl_version=None, assert_hostname=None):
     tls_verify = os.environ.get('DOCKER_TLS_VERIFY')
     if tls_verify == '':
         tls_verify = False
-        enable_tls = True
     else:
         tls_verify = tls_verify is not None
-        enable_tls = cert_path or tls_verify
+    enable_tls = cert_path or tls_verify
 
     params = {}
 
     if host:
-        params['base_url'] = (host.replace('tcp://', 'https://')
-                              if enable_tls else host)
+        params['base_url'] = (
+            host.replace('tcp://', 'https://') if enable_tls else host
+        )
 
     if not enable_tls:
         return params


Test patch:
diff --git a/tests/unit/utils_test.py b/tests/unit/utils_test.py
--- a/tests/unit/utils_test.py
+++ b/tests/unit/utils_test.py
@@ -228,19 +228,7 @@ def test_kwargs_from_env_tls_verify_false_no_cert(self):
                           DOCKER_TLS_VERIFY='')
         os.environ.pop('DOCKER_CERT_PATH', None)
         kwargs = kwargs_from_env(assert_hostname=True)
-        self.assertEqual('https://192.168.59.103:2376', kwargs['base_url'])
-        self.assertTrue('ca.pem' in kwargs['tls'].ca_cert)
-        self.assertTrue('cert.pem' in kwargs['tls'].cert[0])
-        self.assertTrue('key.pem' in kwargs['tls'].cert[1])
-        self.assertEqual(True, kwargs['tls'].assert_hostname)
-        self.assertEqual(False, kwargs['tls'].verify)
-        try:
-            client = Client(**kwargs)
-            self.assertEqual(kwargs['base_url'], client.base_url)
-            self.assertEqual(kwargs['tls'].cert, client.cert)
-            self.assertFalse(kwargs['tls'].verify)
-        except TypeError as e:
-            self.fail(e)
+        self.assertEqual('tcp://192.168.59.103:2376', kwargs['base_url'])
 
     def test_kwargs_from_env_no_cert_path(self):
         try: