Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-10-12 Thread Guido van Rossum
I see no reason to hold up this PEP's approval any longer, so I hereby approve PEP 476. It looks like a fair amount of work is still needed to backport this to Python 2.7 (and a smaller amount for 3.4) but I trust that this will all happen before the next releases of these two. Congrats Alex! On

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-10-12 Thread Nick Coghlan
On 13 Oct 2014 08:58, Guido van Rossum gu...@python.org wrote: I see no reason to hold up this PEP's approval any longer, so I hereby approve PEP 476. It looks like a fair amount of work is still needed to backport this to Python 2.7 (and a smaller amount for 3.4) but I trust that this will all

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-10-03 Thread Alex Gaynor
Guido van Rossum guido at python.org writes: OK, I'll hold off a bit on approving the PEP, but my intention is to approve it. Go Alex go! A patch for the environmental variable overrides on Windows has landed; thanks Benjamin! Alex ___

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-21 Thread Christian Heimes
On 21.09.2014 01:03, Nick Coghlan wrote: We may also need some clarification from Ned regarding the status of OpenSSL and the potential impact switching from dynamic linking to static linking of OpenSSL may have in terms of the OPENSSL_X509_TEA_DISABLE setting. You may want to ask Hynek, too.

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-21 Thread Larry Hastings
On 09/20/2014 11:05 PM, Nick Coghlan wrote: On 21 September 2014 03:05, Alex Gaynor alex.gay...@gmail.com wrote: That sounds reasonable to me -- at this point I don't expect this to make it into 3.4.2; Nick has some working code on the ticket: http://bugs.python.org/issue22417 it's mostly

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Christian Heimes
On 19.09.2014 18:53, Alex Gaynor wrote: Hi all, I've just updated the PEP to reflect the API suggestions from Nick, and the fact that the necessary changes to urllib were landed. I think this is ready for pronouncement, Guido? There is still the issue with SSL_CERT_DIR and SSL_CERT_FILE

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Alex Gaynor
Done and done. Alex On Fri, Sep 19, 2014 at 4:13 PM, Guido van Rossum gu...@python.org wrote: +1 on Nick's suggestion. (Might also mention that this is the reason why both functions should exist and have compatible signatures.) Also please, please, please add explicit mention of Python 2.7,

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Guido van Rossum
Nice. I just realized the release candidate for 3.4.2 is really close (RC1 Monday, final Oct 6, see PEP 429). What's your schedule for 3.4? I see no date for 2.7.9 yet (but that could just be that PEP 373 hasn't been updated). What about the Apple and Microsoft issues Christian pointed out?

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Alex Gaynor
That sounds reasonable to me -- at this point I don't expect this to make it into 3.4.2; Nick has some working code on the ticket: http://bugs.python.org/issue22417 it's mostly missing documentation. Alex On Sat, Sep 20, 2014 at 9:46 AM, Guido van Rossum gu...@python.org wrote: Nice. I just

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Nick Coghlan
On 21 September 2014 03:05, Alex Gaynor alex.gay...@gmail.com wrote: That sounds reasonable to me -- at this point I don't expect this to make it into 3.4.2; Nick has some working code on the ticket: http://bugs.python.org/issue22417 it's mostly missing documentation. I also think it's more

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Guido van Rossum
Sounds good. Maybe we should put the specifically targeted releases in PEP 476? Nick, do Christian's issues need to be mentioned in the PEP or should we just keep those in the corresponding tracker items? On Sat, Sep 20, 2014 at 3:05 PM, Nick Coghlan ncogh...@gmail.com wrote: On 21 September

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Nick Coghlan
On 21 September 2014 08:22, Guido van Rossum gu...@python.org wrote: Sounds good. Maybe we should put the specifically targeted releases in PEP 476? Nick, do Christian's issues need to be mentioned in the PEP or should we just keep those in the corresponding tracker items? They should be

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-20 Thread Guido van Rossum
OK, I'll hold off a bit on approving the PEP, but my intention is to approve it. Go Alex go! On Sat, Sep 20, 2014 at 4:03 PM, Nick Coghlan ncogh...@gmail.com wrote: On 21 September 2014 08:22, Guido van Rossum gu...@python.org wrote: Sounds good. Maybe we should put the specifically targeted

[Python-Dev] PEP476: Enabling certificate validation by default

2014-09-19 Thread Alex Gaynor
Hi all, I've just updated the PEP to reflect the API suggestions from Nick, and the fact that the necessary changes to urllib were landed. I think this is ready for pronouncement, Guido? Cheers, Alex ___ Python-Dev mailing list Python-Dev@python.org

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-19 Thread Guido van Rossum
The PEP doesn't specify any of the API changes for Python 2.7. I feel it is necessary for the PEP to show a few typical code snippets using urllib in Python 2.7 and how one would modify these in order to disable the cert checking. There are also a few typos; especially this paragraph puzzled me:

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-19 Thread Alex Gaynor
Pushed a new version which I believe adresses all of these. I added an example of opting-out with urllib.urlopen, let me know if there's any other APIs you think I should show an example with. On Fri, Sep 19, 2014 at 3:06 PM, Guido van Rossum gu...@python.org wrote: The PEP doesn't specify any

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-19 Thread Nick Coghlan
On 20 September 2014 08:34, Alex Gaynor alex.gay...@gmail.com wrote: Pushed a new version which I believe adresses all of these. I added an example of opting-out with urllib.urlopen, let me know if there's any other APIs you think I should show an example with. It would be worth explicitly

Re: [Python-Dev] PEP476: Enabling certificate validation by default

2014-09-19 Thread Guido van Rossum
+1 on Nick's suggestion. (Might also mention that this is the reason why both functions should exist and have compatible signatures.) Also please, please, please add explicit mention of Python 2.7, 3.4 and 3.5 in the Abstract (for example in the 3rd paragraph of the abstract). On Fri, Sep 19,