[patch] Move SSLError handling to python-devops/src/mas/devops/utils.py, simplify validateEntitlementKey in cli.py

[Jeel-Oza]

[patch] Move SSLError handling to python-devops/src/mas/devops/utils.py, simplify validateEntitlementKey in cli.py

Summary

Fixes entitlement key validation failing with an unhelpful error message when the CLI cannot reach cp.icr.io due to an SSL certificate verification error (e.g. corporate proxy or firewall performing TLS interception).

Previously, all failures — whether SSL errors or genuine authentication failures — were surfaced as the same generic error, leaving customers unable to determine whether their key was wrong or the network was blocking the connection.

Changes

python/src/mas/cli/cli.py

• Added RequestsException import to catch unexpected non-SSL network errors re-raised from utils.py
• Updated validateEntitlementKey() — now catches RequestsException (non-SSL network errors) and returns False; SSLError is handled in utils.py and arrives as None
• promptForEntitlementKey() — SSL-specific warning messages and interactive menu retained (unchanged)

python/tests/unit/test_entitlement_key_validation.py

• Updated test_validate_with_ssl_error — changed side_effect=SSLError to return_value=None to reflect that utils.py now absorbs SSLError internally and returns None
• Updated test_validate_with_network_error and test_validate_with_timeout — changed to side_effect=ConnectionError/Timeout to reflect that utils.py re-raises these and cli.py catches them and returns False
• Updated assertions accordingly

Testing

Reproduced both scenarios manually inside the MAS CLI container.

Case 1 — SSL error (corporate proxy / self-signed certificate)

# Generate a fake CA cert that Python will not trust for cp.icr.io
openssl req -x509 -newkey rsa:2048 -keyout /tmp/fake-ca.key \
  -out /tmp/fake-ca.crt -days 1 -nodes \
  -subj "/CN=FakeCA"

# Force requests to use the fake bundle
export REQUESTS_CA_BUNDLE=/tmp/fake-ca.crt

# Run the CLI and enter any entitlement key
mas install

Result: Warning: SSL certificate verification failed — could not reach cp.icr.io with explanation that the key may still be valid and options to try again / continue / quit

Case 2 — Wrong entitlement key

# Unset the fake CA bundle so the network is reachable
unset REQUESTS_CA_BUNDLE

# Run the CLI and enter a deliberately wrong entitlement key
mas install

Result: Warning: IBM entitlement key validation failed with options to try again / continue / quit

Linked issue

Fixes MASCORE-16263
Closes #2519

[terc1997]

The PR on python-devops will change the implementation in the CLI.