From 6f644a5e67c039b2837c08bbd894d81840929e20 Mon Sep 17 00:00:00 2001
From: Kazeo Hada <kahada@splunk.com>
Date: Mon, 9 Nov 2026 11:09:57 +0100
Subject: [PATCH 1/3] fallback to default ssl groups if setting ML-KEM groups
 fail

---
 splunklib/binding.py | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/splunklib/binding.py b/splunklib/binding.py
index 6a3ce299c..7e141ac72 100644
--- a/splunklib/binding.py
+++ b/splunklib/binding.py
@@ -1751,11 +1751,17 @@ def connect(scheme, host, port):
                 # with patched python that includes set_groups on 3.9 and 3.13, thus we
                 # check for the existence of set_groups, not the python version.
                 if hasattr(ctx, "set_groups"):
-                    ctx.set_groups(  # pyright: ignore[reportUnknownMemberType, reportAttributeAccessIssue]
-                        "X25519MLKEM768:SecP256r1MLKEM768:SecP384r1MLKEM1024:"
-                        + "MLKEM512:MLKEM768:MLKEM1024:"
-                        + "X25519:secp256r1:X448:secp384r1:secp521r1:ffdhe2048:ffdhe3072"
-                    )
+                    try:
+                        ctx.set_groups(  # pyright: ignore[reportUnknownMemberType, reportAttributeAccessIssue]
+                            "X25519MLKEM768:SecP256r1MLKEM768:SecP384r1MLKEM1024:"
+                            + "MLKEM512:MLKEM768:MLKEM1024:"
+                            + "X25519:secp256r1:X448:secp384r1:secp521r1:ffdhe2048:ffdhe3072"
+                        )
+                    except ssl.SSLError:
+                        # FIPS providers (and OpenSSL builds without ML-KEM) reject the
+                        # ML-KEM group names — fall back to the default groups rather
+                        # than failing every connection.
+                        pass
                 kwargs["context"] = ctx
             elif context:
                 # verify is True in elif branch and context is not None

From 783265d120b039c57c24931a307a9318c25d5ca8 Mon Sep 17 00:00:00 2001
From: Kazeo Hada <kahada@splunk.com>
Date: Mon, 9 Nov 2026 11:19:59 +0100
Subject: [PATCH 2/3] remove unnecessary reportUnknownMemberType pyright ignore

---
 splunklib/binding.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/splunklib/binding.py b/splunklib/binding.py
index 7e141ac72..e98a5266c 100644
--- a/splunklib/binding.py
+++ b/splunklib/binding.py
@@ -1752,7 +1752,7 @@ def connect(scheme, host, port):
                 # check for the existence of set_groups, not the python version.
                 if hasattr(ctx, "set_groups"):
                     try:
-                        ctx.set_groups(  # pyright: ignore[reportUnknownMemberType, reportAttributeAccessIssue]
+                        ctx.set_groups(  # pyright: ignore[reportAttributeAccessIssue]
                             "X25519MLKEM768:SecP256r1MLKEM768:SecP384r1MLKEM1024:"
                             + "MLKEM512:MLKEM768:MLKEM1024:"
                             + "X25519:secp256r1:X448:secp384r1:secp521r1:ffdhe2048:ffdhe3072"

From 760d940adf1eb177f289a2ab4c686d435e7e656a Mon Sep 17 00:00:00 2001
From: Kazeo Hada <kahada@splunk.com>
Date: Mon, 9 Nov 2026 14:01:54 +0100
Subject: [PATCH 3/3] update basepytright baseline

---
 .basedpyright/baseline.json | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/.basedpyright/baseline.json b/.basedpyright/baseline.json
index 500d6f38c..328250872 100644
--- a/.basedpyright/baseline.json
+++ b/.basedpyright/baseline.json
@@ -3769,14 +3769,6 @@
                     "lineCount": 1
                 }
             },
-            {
-                "code": "reportUnnecessaryTypeIgnoreComment",
-                "range": {
-                    "startColumn": 55,
-                    "endColumn": 78,
-                    "lineCount": 1
-                }
-            },
             {
                 "code": "reportUnknownArgumentType",
                 "range": {