Ryan Malloy
345838fe2d
Optional TLS via the ``tls`` parameter on connect() and IfxSocket. Three modes: tls=False (default) — plain TCP, current behavior unchanged tls=True — TLS w/ verification disabled (dev / self-signed) tls=ssl.SSLContext — caller-supplied context (production) Plus tls_server_hostname for SNI / cert verification. Architectural choice: Informix uses dedicated TLS-enabled listener ports (configured in server's sqlhosts), NOT STARTTLS upgrade. The SSL handshake runs immediately after TCP connect with no protocol- level negotiation. Wrapping happens inside IfxSocket.__init__ so the rest of the protocol layer (login PDU, SQ_BIND, fast-path, file transfer) is fully unaware of whether TLS is in use. Why tls=True defaults to insecure: most Informix dev installations use self-signed certs. tls=True produces a context with check_hostname=False and verify_mode=CERT_NONE. Minimum protocol is still TLSv1.2 (per ssl.PROTOCOL_TLS_CLIENT). Production users are expected to pass ssl.SSLContext explicitly. Tests: 5 unit tests in test_tls.py * tls=True dev context properties * default context uses TLSv1.2+ * real handshake against in-process TLS echo server (proves wrap_socket works end-to-end) * custom SSLContext honored verbatim * tls=True against non-TLS port raises OperationalError clearly Test certs are generated via openssl CLI subprocess instead of adding cryptography as a dev dep (saves ~5MB transitive deps for one phase). Total: 69 unit + 139 integration = 208 tests. Architectural milestone: with Phase 14 complete, the driver now implements EVERYTHING in the SQLI wire-protocol family that a Python application needs. Remaining backlog (async, pooling) is library- design work, not protocol work.
informix-db
Pure-Python driver for IBM Informix IDS, speaking the SQLI wire protocol over raw sockets. No IBM Client SDK. No JVM. No native libraries.
Status
🟢 Phase 1 complete. connect() / close() work end-to-end against a real Informix server. Cursor / execute / fetch land in Phase 2.
To our knowledge this is the first pure-socket Informix driver in any language — every other Informix driver (IfxPy, the legacy informixdb, ODBC bridges, Perl DBD::Informix) wraps either IBM's CSDK or the JDBC JAR.
Quick start
import informix_db
with informix_db.connect(
host="127.0.0.1", port=9088,
user="informix", password="in4mix",
database="sysmaster", server="informix",
) as conn:
# cursor() / execute() / fetchone() arrive in Phase 2
pass
Test against the official Informix dev container
docker compose -f tests/docker-compose.yml up -d # IBM Developer Edition, pinned by digest
uv sync --extra dev
uv run pytest # 34 unit tests (no Docker needed)
uv run pytest -m integration # 6 integration tests (needs the container)
Phase 0 artifacts (still useful — they ARE the public reference)
docs/PROTOCOL_NOTES.md— byte-level wire-format reference, derived from packet captures + JDBC decompilation, validated against a real serverdocs/JDBC_NOTES.md— index into the decompiled IBM JDBC driver's wire-protocol classesdocs/DECISION_LOG.md— running rationale for protocol / auth / type decisionsdocs/CAPTURES/— socat hex-dump captures of three reference scenarios (connect, SELECT, full DML cycle)tests/reference/RefClient.java— re-runnable JDBC ground-truth client for capturing fresh traces
License
MIT.