diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 68df63b13..7e3574f05 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -12,6 +12,8 @@ env:
       export DOCKER_BUILDKIT=1
       docker build --pull --build-arg BUILDKIT_INLINE_CACHE=1 --cache-from ghcr.io/commaai/panda:latest -t panda -f Dockerfile .
 
+  PYTHONWARNINGS: "error"
+
 jobs:
   docker_push:
     name: docker push
diff --git a/Dockerfile b/Dockerfile
index 8757c4fac..235476b5c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -83,7 +83,7 @@ RUN cd /tmp/openpilot && \
     git clone https://github.com/commaai/panda_jungle.git && \
     cd panda_jungle && \
     git fetch && \
-    git checkout 7b7197c605915ac34f3d62f314edd84e2e78a759 && \
+    git checkout 3a791be1f1877a69cf45de16a670992380622297 && \
     rm -rf .git/
 
 RUN cd /tmp/openpilot && \
diff --git a/Jenkinsfile b/Jenkinsfile
index 988b43c2f..3337ffd0d 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -2,6 +2,7 @@ def docker_run(String step_label, int timeout_mins, String cmd) {
   timeout(time: timeout_mins, unit: 'MINUTES') {
     sh script: "docker run --rm --privileged \
           --env PARTIAL_TESTS=${env.PARTIAL_TESTS} \
+          --env PYTHONWARNINGS=error \
           --volume /dev/bus/usb:/dev/bus/usb \
           --volume /var/run/dbus:/var/run/dbus \
           --workdir /tmp/openpilot/panda \
@@ -32,6 +33,7 @@ export SOURCE_DIR=${env.SOURCE_DIR}
 export GIT_BRANCH=${env.GIT_BRANCH}
 export GIT_COMMIT=${env.GIT_COMMIT}
 export PYTHONPATH=${env.TEST_DIR}/../
+export PYTHONWARNINGS=error
 
 cd ${env.TEST_DIR} || true
 ${cmd}
@@ -61,6 +63,7 @@ pipeline {
   environment {
     CI = "1"
     PARTIAL_TESTS = "${env.BRANCH_NAME == 'master' ? ' ' : '1'}"
+    PYTHONWARNINGS= "error"
     DOCKER_IMAGE_TAG = "panda:build-${env.GIT_COMMIT}"
 
     TEST_DIR = "/data/panda"
diff --git a/board/SConscript b/board/SConscript
index 7c9127904..dc095e712 100644
--- a/board/SConscript
+++ b/board/SConscript
@@ -102,7 +102,8 @@ def get_key_header(name):
   from Crypto.PublicKey import RSA
 
   public_fn = File(f'../certs/{name}.pub').srcnode().abspath
-  rsa = RSA.importKey(open(public_fn).read())
+  with open(public_fn) as f:
+    rsa = RSA.importKey(f.read())
   assert(rsa.size_in_bits() == 1024)
 
   rr = pow(2**1024, 2, rsa.n)
diff --git a/crypto/sign.py b/crypto/sign.py
index e199a6b14..daea38630 100755
--- a/crypto/sign.py
+++ b/crypto/sign.py
@@ -9,28 +9,30 @@ import binascii
 # increment this to make new hardware not run old versions
 VERSION = 2
 
-rsa = RSA.importKey(open(sys.argv[3]).read())
+if __name__ == "__main__":
+  with open(sys.argv[3]) as k:
+    rsa = RSA.importKey(k.read())
 
-with open(sys.argv[1], "rb") as f:
-  dat = f.read()
+  with open(sys.argv[1], "rb") as f:
+    dat = f.read()
 
-print("signing", len(dat), "bytes")
+  print("signing", len(dat), "bytes")
 
-with open(sys.argv[2], "wb") as f:
-  if os.getenv("SETLEN") is not None:
-    # add the version at the end
-    dat += b"VERS" + struct.pack("I", VERSION)
-    # add the length at the beginning
-    x = struct.pack("I", len(dat)) + dat[4:]
-    # mock signature of dat[4:]
-    dd = hashlib.sha1(dat[4:]).digest()
-  else:
-    x = dat
-    dd = hashlib.sha1(dat).digest()
+  with open(sys.argv[2], "wb") as f:
+    if os.getenv("SETLEN") is not None:
+      # add the version at the end
+      dat += b"VERS" + struct.pack("I", VERSION)
+      # add the length at the beginning
+      x = struct.pack("I", len(dat)) + dat[4:]
+      # mock signature of dat[4:]
+      dd = hashlib.sha1(dat[4:]).digest()
+    else:
+      x = dat
+      dd = hashlib.sha1(dat).digest()
 
-  print("hash:", str(binascii.hexlify(dd), "utf-8"))
-  dd = b"\x00\x01" + b"\xff" * 0x69 + b"\x00" + dd
-  rsa_out = pow(int.from_bytes(dd, byteorder='big', signed=False), rsa.d, rsa.n)
-  sig = (hex(rsa_out)[2:].rjust(0x100, '0'))
-  x += binascii.unhexlify(sig)
-  f.write(x)
+    print("hash:", str(binascii.hexlify(dd), "utf-8"))
+    dd = b"\x00\x01" + b"\xff" * 0x69 + b"\x00" + dd
+    rsa_out = pow(int.from_bytes(dd, byteorder='big', signed=False), rsa.d, rsa.n)
+    sig = (hex(rsa_out)[2:].rjust(0x100, '0'))
+    x += binascii.unhexlify(sig)
+    f.write(x)
diff --git a/python/__init__.py b/python/__init__.py
index e396fb36f..44e9d80d5 100644
--- a/python/__init__.py
+++ b/python/__init__.py
@@ -612,9 +612,9 @@ class Panda:
 
   @staticmethod
   def get_signature_from_firmware(fn) -> bytes:
-    f = open(fn, 'rb')
-    f.seek(-128, 2)  # Seek from end of file
-    return f.read(128)
+    with open(fn, 'rb') as f:
+      f.seek(-128, 2)  # Seek from end of file
+      return f.read(128)
 
   def get_signature(self) -> bytes:
     part_1 = self._handle.controlRead(Panda.REQUEST_IN, 0xd3, 0, 0, 0x40)
diff --git a/tests/libs/resetter.py b/tests/libs/resetter.py
index c9dead2e7..720ae9c21 100644
--- a/tests/libs/resetter.py
+++ b/tests/libs/resetter.py
@@ -9,31 +9,25 @@ class Resetter():
 
   def close(self):
     self._handle.close()
+    self._context.close()
     self._handle = None
 
   def connect(self):
     if self._handle:
       self.close()
 
-    context = usb1.USBContext()
     self._handle = None
 
-    while True:
-      try:
-        for device in context.getDeviceList(skip_on_error=True):
-          if device.getVendorID() == 0xbbaa and device.getProductID() == 0xddc0:
-            try:
-              self._handle = device.open()
-              self._handle.claimInterface(0)
-              break
-            except Exception as e:
-              print(e)
-              continue
-      except Exception as e:
-        print(e)
-      if self._handle:
-        break
-      context = usb1.USBContext()
+    self._context = usb1.USBContext()
+    self._context.open()
+    for device in self._context.getDeviceList(skip_on_error=True):
+      if device.getVendorID() == 0xbbaa and device.getProductID() == 0xddc0:
+        try:
+          self._handle = device.open()
+          self._handle.claimInterface(0)
+          break
+        except Exception as e:
+          print(e)
     assert self._handle
 
   def enable_power(self, port, enabled):
diff --git a/tests/pedal/test_pedal.py b/tests/pedal/test_pedal.py
index 652a90c03..05a051226 100755
--- a/tests/pedal/test_pedal.py
+++ b/tests/pedal/test_pedal.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python3
 import os
 import time
 import subprocess