[patch] Catch SSLError and RequestException in validateIBMEntitlementKey, return None instead of raising

[Jeel-Oza]

Summary

Fixes validateIBMEntitlementKey() re-raising all network exceptions to its caller. Previously the function caught requests.exceptions.RequestException and re-raised it — now SSLError is caught specifically and returns None, while all other RequestException types are still re-raised so unexpected network failures remain visible and traceable.

Changes

src/mas/devops/utils.py

• validateIBMEntitlementKey() previously caught requests.exceptions.RequestException and re-raised it — now catches requests.exceptions.SSLError specifically and returns None, while all other requests.exceptions.RequestException are still re-raised
• Updated return type from bool to True/False/None in docstring
• Removed Raises: section from docstring — SSL errors are now absorbed; all other RequestException types are still raised

Return value contract:

Return	Meaning
True	Key is valid, access confirmed
False	Authentication failed — key is wrong or expired
None	SSL error — key status unknown, may still be valid

Testing

Reproduced both scenarios manually inside the MAS CLI container.

Case 1 — SSL error (corporate proxy / self-signed certificate)

# Generate a fake CA cert that Python will not trust for cp.icr.io
openssl req -x509 -newkey rsa:2048 -keyout /tmp/fake-ca.key \
  -out /tmp/fake-ca.crt -days 1 -nodes \
  -subj "/CN=FakeCA"

# Force requests to use the fake bundle
export REQUESTS_CA_BUNDLE=/tmp/fake-ca.crt

# Run the CLI and enter any entitlement key
mas install

Result: Warning: SSL certificate verification failed — could not reach cp.icr.io with explanation that the key may still be valid and options to try again / continue / quit

Case 2 — Wrong entitlement key

# Unset the fake CA bundle so the network is reachable
unset REQUESTS_CA_BUNDLE

# Run the CLI and enter a deliberately wrong entitlement key
mas install

Result: Warning: IBM entitlement key validation failed with options to try again / continue / quit

Linked issue

Fixes MASCORE-16263
ibm-mas/cli#2519

[terc1997]

I liked the approach, however return None for both exceptions can hide bugs since everything else in Requests also returns None. Instead of returning None I have two proposals:

• Unpack two returns. One to identify if it was valid or not and another to specify if the failure was due to SSL.
• Return None for SSL and raise for everything else in Requests. We're saying that the SSL error is acceptable and can be a warning and everything else needs to be checked, which complies with what we had before and add just the warning layer around SSL.