[issue32257] Support Disabling Renegotiation for SSLContext

Change by Christian Heimes : -- pull_requests: +5673 stage: -> patch review ___ Python tracker ___

[issue32257] Support Disabling Renegotiation for SSLContext

Christian Heimes added the comment: The OP_NO_RENEGOTIATION option prevents renegotiation in TLS 1.2 and lower. Renegotiation is a problematic TLS feature that has led to security issues like CVE-2009-3555. TLS 1.3 has removed renegotiation completely in favor of much more

[issue30141] If you forget to call do_handshake, then everything seems to work but hostname checking is disabled

Christian Heimes added the comment: The bug has been fixed in #31399. Since 3.7, Python uses OpenSSL's X509_VERIFY_PARAM_set1_host() to verify the host name during the handshake. Unfortunately the fix is in OpenSSL 1.0.2 only. Backport would break compatibility with OpenSSL

[issue21417] Compression level for zipfile

Serhiy Storchaka added the comment: I have a concern about the _compresslevel attribute of ZipInfo. Why is it underscored and not documented? -- nosy: +serhiy.storchaka ___ Python tracker

[issue19500] ftplib: Add client-side SSL session resumption

Christian Heimes added the comment: It's now an ftplib issue. It's too late to land a new feature in 3.7 because we have reached feature freeze. -- assignee: christian.heimes -> components: -Documentation, SSL priority: high -> low title: Add client-side SSL

[issue18617] AIA chasing for missing intermediate certificates on TLS connections

Change by Christian Heimes : -- assignee: docs@python -> christian.heimes stage: -> needs patch versions: +Python 3.8 -Python 3.7 ___ Python tracker

[issue31242] Add SSLContext.set_verify_callback()

Change by Christian Heimes : -- stage: -> needs patch versions: +Python 3.8 ___ Python tracker ___

[issue29334] ssl.SSLObject method getpeercert() is buggy, do_handshake() is strange

Christian Heimes added the comment: The fix hasn't been ported to 2.7 yet. -- assignee: christian.heimes -> status: -> open ___ Python tracker

[issue30525] Expose SCTs on TLS connections

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue31372] Add SSLSocket.get_verify_result()

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue31997] SSL lib does not handle trailing dot (period) in hostname or certificate

Christian Heimes added the comment: I'm closing this bug as "not a bug" because it works as intended. The trailing dot has to be handled in the application layer. -- resolution: -> not a bug stage: -> resolved status: open -> closed

[issue22365] SSLContext.load_verify_locations(cadata) does not accept CRLs

Change by Christian Heimes : -- assignee: christian.heimes -> components: -Extension Modules priority: normal -> low versions: +Python 3.8 -Python 3.7 ___ Python tracker

[issue32604] Expose the subinterpreters C-API in Python for testing use.

Nick Coghlan added the comment: _xxsubinterpreters has been added, and we'll use PEP 554 as the interim documentation while it's only exposed for testing purposes. -- resolution: -> fixed stage: patch review -> resolved status: open -> closed

[issue31892] ssl.get_server_certificate should allow specifying certificate / key type

Change by Christian Heimes : -- assignee: christian.heimes -> stage: -> needs patch versions: +Python 3.8 -Python 2.7, Python 3.6, Python 3.7 ___ Python tracker

[issue29406] asyncio SSL contexts leak sockets after calling close with certain Apache servers

Christian Heimes added the comment: Andrew, Yury, PR 4402 is still open. Should the fix land in 3.7? I have removed the SSL component because it's not a bug in the ssl module. -- components: -SSL nosy: +christian.heimes versions: +Python 3.8 -Python 3.5

[issue30141] If you forget to call do_handshake, then everything seems to work but hostname checking is disabled

Nathaniel Smith added the comment: Do you mean, the fix is in 3.7 only? -- status: pending -> open ___ Python tracker ___

[issue31399] Let OpenSSL verify hostname and IP address

Christian Heimes added the comment: The feature has been implemented. I'll take care of the failing tests in #32706. -- resolution: -> fixed stage: patch review -> resolved status: open -> closed versions: +Python 3.8 ___ Python

[issue32949] Simplify "with"-related opcodes

Serhiy Storchaka added the comment: Updated PR seems fixes issue29988 for synchronous "with". -- ___ Python tracker ___

[issue31727] FTP_TLS errors when use certain subcommands

Christian Heimes added the comment: Jonathan, are you able to provide a reproducer for this bug? I fear we cannot move forward without a way to test and reproduce the issue. -- assignee: christian.heimes -> status: open -> pending versions: +Python 3.8

[issue18233] SSLSocket.getpeercertchain()

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue32359] Add getters for all SSLContext internal configuration

Christian Heimes added the comment: Let's see how much we can fix in 3.8. Maybe I'll find enough free time to implement PEP 543 for Python 3.8. -- assignee: christian.heimes -> stage: -> needs patch type: -> enhancement versions: +Python 3.8

[issue17128] OS X system openssl deprecated - installer should build local libssl

Christian Heimes added the comment: Ned, is this issue still relevant? It targets 3.5 and hasn't seen much activity since 2016. -- status: open -> pending ___ Python tracker

[issue32706] test_check_hostname() of test_ftplib started to fail randomly

Christian Heimes added the comment: Ned, I'm going to rewrite part of the test infrastructure during beta phase. The ssl module now works according to specifications. When the client doesn't recognize a hostname, it aborts the TLS connection with a TLS ALERT message. The

[issue30141] If you forget to call do_handshake, then everything seems to work but hostname checking is disabled

Nathaniel Smith added the comment: ...huh, not sure why that shows me changing the status. I just typed something in the text box, didn't touch any of the dropdowns... -- status: open -> pending ___ Python tracker

[issue32883] Key agreement parameters not accessible

Change by Christian Heimes : -- stage: -> needs patch versions: +Python 3.8 ___ Python tracker ___

[issue30226] Modernize make_ssl_certs

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue28695] Add SSL_CTX_set_client_cert_engine

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue32947] Support OpenSSL 1.1.1

Christian Heimes added the comment: Ned, Benjamin OpenSSL 1.1.1 is scheduled to be released just before 3.7.0rc1 will come out. I'd rather address as many issues now instead of adding last minute patches to the release candidate. Once OpenSSL 1.1.1 is out and Python 3.7

[issue28453] SSLObject.selected_alpn_protocol() not documented

Change by Christian Heimes : -- stage: -> needs patch versions: +Python 3.8 ___ Python tracker ___

[issue15670] PEP 3121, 384 Refactoring applied to ssl module

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue32533] SSLSocket read/write thread-unsafety

Change by Christian Heimes : -- assignee: christian.heimes -> steve.dower stage: -> needs patch versions: +Python 3.8 ___ Python tracker

[issue31711] ssl.SSLSocket.send(b"") fails

Christian Heimes added the comment: It's a bit too late to change the behavior of send(). Let's document the issue instead. -- assignee: christian.heimes -> docs@python components: +Documentation nosy: +alex, docs@python, dstufft, janssen, njs stage: -> needs patch

[issue29612] TarFile.extract() suffers from hard links inside tarball

Joachim Trouverie added the comment: I created a PR for this issue for Python 2.7 (https://github.com/python/cpython/pull/5753/files). I just skip the link creation if the target path is equals to the link target. I don't see any corner case where this would be

[issue32932] better error message when __all__ contains non-str objects

Nick Coghlan added the comment: I +1'ed Serhiy's patch for issue 32946, so we'll have to take that micro-optimisation into account if we decide to rely on the Python level `_handle_fromlist` to cover the "*" import case. Given that optimisation, it's probably simpler to

[issue30141] If you forget to call do_handshake, then everything seems to work but hostname checking is disabled

Christian Heimes added the comment: Correct, the fix is in 3.7 and 3.8 only. I don't see a realistic way to address the problem in 3.6 and 2.7 without breaking people on old LTS releases and BSD. (The bug tracker changes status automatically when you reply to a pending

[issue31711] ssl.SSLSocket.send(b"") fails

Nathaniel Smith added the comment: If openssl says the behavior is undefined, then don't we have to first make it defined before we can document it? And if we're going to detect this case and guarantee some behavior, making it a no-op like it is on regular sockets seems the

[issue32932] better error message when __all__ contains non-str objects

Serhiy Storchaka added the comment: I was fooled by similarity of Python and C code, but actually Python and C code are not different implementations of the same algorithm, they have different purposes. The purpose of _bootstrap._handle_fromlist() is importing

[issue30141] If you forget to call do_handshake, then everything seems to work but hostname checking is disabled

Nathaniel Smith added the comment: I agree that backporting X509_VERIFY_PARAM_set1_host is unreasonable, at least until the openssl ecosystem has moved forward a bit. But in earlier versions, would it be easy to detect that do_handshake() hasn't been called and raise an

[issue32929] Change dataclasses hashing to use unsafe_hash boolean (default to False)

Eric V. Smith added the comment: New changeset 4cffe2f66b581fa7538f6de884d54a5c7364d8e0 by Eric V. Smith (Miss Islington (bot)) in branch '3.7': bpo-32929: Dataclasses: Change the tri-state hash parameter to the boolean unsafe_hash. (GH-5891) (GH-5902)

[issue32305] Namespace packages have inconsistent __file__ and __spec__.origin

Ned Deily added the comment: Note that this change was originally also backported to 3.6 in PR 5504 but, due to third-party package regressions discovered in pre-release testing, the 3.6 change was reverted in PR 5591 prior to release of 3.6.5rc1. -- nosy: +ned.deily

[issue32394] socket lib beahavior change in 3.6.4

Change by miss-islington : -- pull_requests: +5680 ___ Python tracker ___

[issue32394] socket lib beahavior change in 3.6.4

Steve Dower added the comment: New changeset 19e7d48ce89422091f9af93038b9fee075d46e9e by Steve Dower (animalize) in branch 'master': bpo-32394: Remove some TCP options on old version Windows. (GH-5523)

[issue32303] Namespace packages have inconsistent __loader__ and __spec__.loader

Change by Barry A. Warsaw : -- pull_requests: +5681 ___ Python tracker ___ ___

[issue32394] socket lib beahavior change in 3.6.4

Steve Dower added the comment: Agreed. I've merged these (and Miss Islington should get the 3.7 backport when CI completes) -- resolution: -> fixed stage: patch review -> backport needed ___ Python tracker

[issue32394] socket lib beahavior change in 3.6.4

Steve Dower added the comment: New changeset 1278c21f5234477aab21531773d65ca7ebd1b81f by Steve Dower (animalize) in branch '3.6': [3.6] bpo-32394: Remove some TCP options on older version Windows. (GH-5585)

[issue32394] socket lib beahavior change in 3.6.4

miss-islington added the comment: New changeset 53d3f8a89971bac3d2f454ff9f923066ecc3a6d9 by Miss Islington (bot) in branch '3.7': bpo-32394: Remove some TCP options on old version Windows. (GH-5523)

[issue17288] cannot jump from a 'return' or 'exception' trace event

Xavier de Gaye added the comment: Those are the changes with the current behavior from the behavior in 3.5 observed at the time of the initial bug report: python 3.7: return.pyUnchanged. exception.py After a jump from the 'exception' event into the previous

[issue32303] Namespace packages have inconsistent __loader__ and __spec__.loader

Barry A. Warsaw added the comment: New changeset 86ea85134645c75783936ca4b5c6269cb8ac4634 by Barry Warsaw in branch '3.6': Revert "[3.6] bpo-32303 - Consistency fixes for namespace loaders (GH-5481) (#5504)" (#5911)

[issue32872] backport of #32305 causes regressions in various packages

Change by Barry A. Warsaw : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue32647] Undefined references when compiling ctypes on binutils 2.29.1 with gcc -Wl, -z, undefs (Fedora 28)

Charalampos Stratakis added the comment: Tested the fix and ctypes is linked successfully with libdl when utilizing the strict symbol check. -- stage: patch review -> resolved status: open -> closed ___ Python tracker

[issue15767] add ModuleNotFoundError

Guido van Rossum added the comment: Read Eric's message before mine. -- ___ Python tracker ___

[issue32394] socket lib beahavior change in 3.6.4

Change by Steve Dower : -- assignee: -> steve.dower stage: backport needed -> resolved status: open -> closed ___ Python tracker

[issue32958] Urllib proxy_bypass crashes for urls containing long basic auth strings

New submission from Aaron Black : While working on a custom conda channel with authentication, I ran into the following UnicodeError: Traceback (most recent call last): File "/Users/ablack/miniconda3/lib/python3.6/site-packages/conda/core/repodata.py", line 402,

[issue32872] backport of #32305 causes regressions in various packages

Change by Barry A. Warsaw : -- keywords: +patch pull_requests: +5682 stage: needs patch -> patch review ___ Python tracker ___

[issue32873] Pickling of typing types

Ivan Levkivskyi added the comment: I am sick now, so can't work on this. There is a small chance I will be able to work on this issue this week. Is it possible to fix this in 3.7b3? -- ___ Python tracker

[issue32873] Pickling of typing types

Ivan Levkivskyi added the comment: Thank you, Ned! -- ___ Python tracker ___ ___

[issue32873] Pickling of typing types

Ned Deily added the comment: > Is it possible to fix this in 3.7b3? Yes. Get well first! -- ___ Python tracker ___

[issue31961] subprocess._execute_child doesn't accept a single PathLike argument for args

Gregory P. Smith added the comment: I'm fine with undoing this for 3.7 in light of the many things we don't do "right" all over the place with path like objects. subprocess still presents as a mix of high and low level APIs so if we accept a path like object in a subset of

[issue31961] subprocess._execute_child doesn't accept a single PathLike argument for args

Ned Deily added the comment: We should either remove the entry in Misc/NEWS/3.7.0b1.rst or, perhaps better, add a line to it noting that it was removed in 3.7.0b2. -- ___ Python tracker

[issue29804] test_ctypes test_pass_by_value fails on arm64 (aarch64) architecture

Ned Deily added the comment: Vinay, should this backported to 3.6? Otherwise, can the issue be closed? -- versions: +Python 3.7 ___ Python tracker

[issue29804] test_ctypes test_pass_by_value fails on arm64 (aarch64) architecture

Charalampos Stratakis added the comment: The bug is still present on the 3.6 branch. -- ___ Python tracker ___

[issue31961] subprocess._execute_child doesn't accept a single PathLike argument for args

Gregory P. Smith added the comment: Ned: when removing a feature added in beta1, should we remove the original NEWS entry created for it? Or add a new NEWS entry that states that the previous feature has been reverted? -- ___

[issue32836] Symbol table for comprehensions (list, dict, set) still includes temporary _[1] variable

Change by miss-islington : -- pull_requests: +5684 ___ Python tracker ___

[issue21417] Compression level for zipfile

Gregory P. Smith added the comment: keeping the conversation in one place, the code review comment was: "I've prefixed this with an underscore because it's not exposed when reading back. ZipInfo has another "private" attribute, _raw_time" compresslevel is documented on the

[issue31961] subprocess._execute_child doesn't accept a single PathLike argument for args

Change by Serhiy Storchaka : -- pull_requests: +5685 ___ Python tracker ___ ___

[issue29334] ssl.SSLObject method getpeercert() is buggy, do_handshake() is strange

Change by Ned Deily : -- nosy: +benjamin.peterson -ned.deily ___ Python tracker ___ ___

[issue32222] pygettext doesn't extract docstrings for functions with type annotated params

Change by miss-islington : -- pull_requests: +5686 ___ Python tracker ___

[issue32222] pygettext doesn't extract docstrings for functions with type annotated params

Serhiy Storchaka added the comment: New changeset eee72d4778a5513038edd5236cdd87ccce2bc60a by Serhiy Storchaka (Tobotimus) in branch 'master': bpo-3: Fix pygettext skipping docstrings for funcs with arg typehints (GH-4745)

[issue32147] improve performance of binascii.unhexlify() by using conversion table

Change by Ned Deily : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___ ___

[issue32873] Pickling of typing types

Ned Deily added the comment: So we need a decision on this about what, if anything, to do for 3.7. The 3.7.0 ABI freeze is in 3.7.0b3; it would be better to get it resolved for 3.7.0b2. -- nosy: +ned.deily priority: normal -> deferred blocker

[issue31961] subprocess._execute_child doesn't accept a single PathLike argument for args

Change by Serhiy Storchaka : -- pull_requests: +5683 stage: needs patch -> patch review ___ Python tracker ___

[issue23808] Symlink to directory on Windows 8

Alexey Izbyshev added the comment: This behavior is not specific to just Windows 8. Symlinks to directories are treated as directories on Windows, in particular, they should be removed with RemoveDirectory, not DeleteFile. Is there any reason this issue is still open?

[issue15767] add ModuleNotFoundError

Christoph Groth added the comment: > Read Eric's message before mine. Of course I read it, I wouldn't have asked otherwise. Eric mentions an older message ("see msg182332") that *predates* your judgment that "outside importlib there shouldn't be a need to

[issue32147] improve performance of binascii.unhexlify() by using conversion table

Serhiy Storchaka added the comment: New changeset 6b5df906afe113dbe421d044322254cfd4747c9c by Serhiy Storchaka (Sergey Fedoseev) in branch 'master': bpo-32147: Improved perfomance of binascii.unhexlify(). (GH-4586)

[issue15767] add ModuleNotFoundError

Guido van Rossum added the comment: I don't like the way you're asking questions here. If you're interested just as a historian of the language, it will have to wait. If you're questioning the decision, please come out and say so. --

[issue31961] subprocess._execute_child doesn't accept a single PathLike argument for args

Serhiy Storchaka added the comment: There are two alternate PRs. PR 5912 removes this feature. PR 5914 fixes it. -- ___ Python tracker

[issue21417] Compression level for zipfile

Serhiy Storchaka added the comment: This makes sense to me. Thank you for explanation. -- ___ Python tracker ___

[issue32222] pygettext doesn't extract docstrings for functions with type annotated params

Change by miss-islington : -- pull_requests: +5687 ___ Python tracker ___

[issue32836] Symbol table for comprehensions (list, dict, set) still includes temporary _[1] variable

Nick Coghlan added the comment: New changeset 3a087beddd9f0955eb9080a6fd1499ff89ca74bf by Nick Coghlan (Nitish Chandra) in branch 'master': bpo-32836: Remove obsolete code from symtable pass (GH-5680)

[issue32937] Multiprocessing worker functions not terminating with a large number of processes and a manager

EricG added the comment: Making some further observations, when I set processes = 12, for example, I can see 12 separate python processes + 4 additional processes also created which I assume are setup for the manager and, perhaps, other purposes. Now, what makes these 4

[issue31711] ssl.SSLSocket.send(b"") fails

Nathaniel Smith added the comment: My point is that SSL_write(3ssl) says "WARNING: When calling SSL_write() with num=0 bytes to be sent the behaviour is undefined." Apparently on the particular openssl you're looking at, it gives SSL_ERROR_SYSCALL with error code == 0 and len

[issue32959] zipimport fails when the ZIP archive contains more than 65535 files

New submission from Mariano M. Chouza : When trying to import a module from a ZIP archive containing more than 65535 files, the import process fails: $ python3 -VV Python 3.6.4 (default, Jan 6 2018, 11:49:38) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)] $ cat

[issue32947] Support OpenSSL 1.1.1

Change by miss-islington : -- pull_requests: +5694 ___ Python tracker ___

[issue32713] tarfile.itn breaks if n is a negative float

Change by miss-islington : -- pull_requests: +5688 ___ Python tracker ___

[issue32604] Expose the subinterpreters C-API in Python for testing use.

Eric Snow added the comment: As far as I know, everything related to this issue is in a stable state. I have not been able to determine any way in which the reported memory leak (in test_multiprocessing_fork) could be related. Sorry, I didn't notice the release

[issue32922] dbm.open() encodes filename with default encoding rather than the filesystem encoding

Serhiy Storchaka added the comment: New changeset 5bf74859fe253f0e8ff73ba699cd1a7e2dfbcea3 by Serhiy Storchaka in branch '3.6': [3.6] bpo-32922: dbm.open() now encodes filename with the filesystem encoding. (GH-5832). (GH-5906)

[issue32604] Expose the subinterpreters C-API in Python for testing use.

Ned Deily added the comment: > Still planned for 3.7: [...] Eric, please try to get everything you want done and into master as soon as possible, then produce a PR for 3.7, and then we can review it and make a decision if it is appropriate for 3.7. As I've mentioned in

[issue15767] add ModuleNotFoundError

Christoph Groth added the comment: My curiosity was piqued when I saw ModuleNotFoundError, so I decided to look it up. This led me to this page and I read the complete discussion. I still did not understand the decision, so I allowed myself to ask, also because I

[issue32222] pygettext doesn't extract docstrings for functions with type annotated params

miss-islington added the comment: New changeset 51d95ffc2fb3337dc87277c9af25ecc9a01f991b by Miss Islington (bot) in branch '3.7': bpo-3: Fix pygettext skipping docstrings for funcs with arg typehints (GH-4745)

[issue32960] dataclasses: disallow inheritance between frozen and non-frozen classes

New submission from Eric V. Smith : This is a temporary measure until we can better define how frozen inheritance should work. In the meantime, disallow: - frozen inherited from non-frozen - non-frozen inherited from frozen -- assignee: eric.smith components:

[issue32960] dataclasses: disallow inheritance between frozen and non-frozen classes

Eric V. Smith added the comment: See issue 32953 for a larger discussion and the ultimate resolution of this. -- ___ Python tracker

[issue32960] dataclasses: disallow inheritance between frozen and non-frozen classes

Change by Eric V. Smith : -- keywords: +patch pull_requests: +5690 stage: -> patch review ___ Python tracker ___

[issue32604] Expose the subinterpreters C-API in Python for testing use.

Eric Snow added the comment: Still planned for 3.7: 1. add more tests in Lib/test/test__xxsubinterpreters.py 2. add test.support.interpreters (high-level module) 3. add more tests in Lib/test/test_interpreters.py At that point I'll start using the high-level

[issue32960] dataclasses: disallow inheritance between frozen and non-frozen classes

Eric V. Smith added the comment: New changeset a93e3dc236279692eaf50b91d358da5983983b14 by Eric V. Smith (Miss Islington (bot)) in branch '3.7': bpo-32960: For dataclasses, disallow inheriting frozen from non-frozen classes and vice-versa, (GH-5919) (GH-5920)

[issue26792] docstrings of runpy.run_{module,path} are rather sparse

Andrew Brezovsky added the comment: I'll update these based on the information in the HTML docs. -- nosy: +abrezovsky ___ Python tracker

[issue32713] tarfile.itn breaks if n is a negative float

Change by miss-islington : -- pull_requests: +5689 ___ Python tracker ___

[issue15767] add ModuleNotFoundError

Christoph Groth added the comment: In the above, please replace "understand the decision" by "understand the usefulness of it". In the above discussion, as an alternative to a new exception, it was proposed to add an attribute to ImportError ('reason'), but then

[issue32713] tarfile.itn breaks if n is a negative float

miss-islington added the comment: New changeset a9a8a9814a52b3c92b3680f0b3a356116510ee18 by Miss Islington (bot) in branch '3.7': bpo-32713: Fix tarfile.itn for large/negative float values. (GH-5434)

[issue32960] dataclasses: disallow inheritance between frozen and non-frozen classes

Change by miss-islington : -- pull_requests: +5691 ___ Python tracker ___

[issue32604] Expose the subinterpreters C-API in Python for testing use.

Change by Ned Deily : -- priority: normal -> deferred blocker ___ Python tracker ___ ___

  1   2   >