pathwaycom/pathway · error · ValueError

invalid ssl mode '{ssl_mode}', expected one of disable, allo

Error message

invalid ssl mode '{ssl_mode}', expected one of disable, allow, prefer, require, verify-ca, verify-full

What it means

pw.io.chroma.write requires column arguments (e.g. row_id, metadata) to be ColumnReference objects from the exact table passed as the first argument. _check_belongs compares column._table identity with the target table and raises ValueError on mismatch, since column identity is table-scoped.

Source

Thrown at python/pathway/internals/_io_helpers.py:78

        )


def _parse_ssl_mode(ssl_mode: str) -> api.SslMode:
    match ssl_mode.lower():
        case "disable":
            return api.SslMode.DISABLE
        case "allow":
            return api.SslMode.ALLOW
        case "prefer":
            return api.SslMode.PREFER
        case "require":
            return api.SslMode.REQUIRE
        case "verify-ca" | "verify_ca":
            return api.SslMode.VERIFY_CA
        case "verify-full" | "verify_full":
            return api.SslMode.VERIFY_FULL
        case _:
            raise ValueError(
                f"invalid ssl mode '{ssl_mode}', expected one of "
                "disable, allow, prefer, require, verify-ca, verify-full"
            )


class AwsS3Settings:
    """Stores Amazon S3 connection settings. You may also use this class to store
    configuration settings for any custom S3 installation, however you will need to
    specify the region and the endpoint.

    Args:
        bucket_name: Name of S3 bucket.
        access_key: Access key for the bucket.
        secret_access_key: Secret access key for the bucket.
        with_path_style: Whether to use path-style requests.
        region: Region of the bucket.
        endpoint: Custom endpoint in case of self-hosted storage.
        session_token: Session token, an alternative way to authenticate to S3.

View on GitHub (pinned to fa2f74a464)

Solutions

Reference columns from the table passed to write, e.g. pw.io.chroma.write(t, ..., row_id=t.id).
If the needed column lives on another table, join it into t first so all passed references share t.
Follow the hint in the message: pass role=table.<column> form.

Example fix

# before
embedded = documents + embeddings
pw.io.chroma.write(embedded, ..., row_id=documents.id)

# after
embedded = documents + embeddings
pw.io.chroma.write(embedded, ..., row_id=embedded.id)

Defensive patterns

Strategy: validation

Validate before calling

def check_chroma_columns(table: pw.Table, **cols: pw.ColumnReference | None) -> None:
    for role, c in cols.items():
        if c is not None and c._table is not table:
            raise ValueError(f"{role} column {c._name!r} not from {table}")

check_chroma_columns(t, row_id=row_id, metadata=metadata)
pw.io.chroma.write(t, ..., row_id=row_id, metadata=metadata)

Type guard

def from_table(column: pw.ColumnReference, table: pw.Table) -> bool:
    return column._table is table

Prevention

Write connector calls with inline table.column references (e.g. row_id=t.id), not pre-bound variables.
After with_columns/rename refactorings, re-point every column argument at the final table.

When it happens

Trigger: Calling pw.io.chroma.write(table, ..., row_id=other_table.id) or metadata_column=other_table.some_col where the reference's table differs from the written table.

Common situations: Embedding pipelines where documents are embedded into a new table (t = raw_table + embeddings) but the id column is still referenced from raw_table; refactor renames leaving stale references.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of pathwaycom/pathway@fa2f74a464 (2026-08-15). Data as JSON: /api/errors/09af67855b098034. Report an issue: GitHub.