python-urllib3/urllib3-ssl-default-context.patch

Index: urllib3-1.25/src/urllib3/util/ssl_.py
===================================================================
--- urllib3-1.25.orig/src/urllib3/util/ssl_.py
+++ urllib3-1.25/src/urllib3/util/ssl_.py
@@ -333,6 +333,8 @@ def ssl_wrap_socket(sock, keyfile=None,
     elif ssl_context is None and hasattr(context, 'load_default_certs'):
         # try to load OS default certs; works well on Windows (require Python3.4+)
         context.load_default_certs()
+    elif cert_reqs != ssl.CERT_NONE and hasattr(context, 'set_default_verify_paths'):
+        context.set_default_verify_paths()
 
     # Attempt to detect if we get the goofy behavior of the
     # keyfile being encrypted and OpenSSL asking for the
- update to 1.25 (bsc#1132663, CVE-2019-11236): * Require and validate certificates by default when using HTTPS * Upgraded ``urllib3.utils.parse_url()`` to be RFC 3986 compliant. * Added support for ``key_password`` for ``HTTPSConnectionPool`` to use encrypted ``key_file`` without creating your own ``SSLContext`` object. * Add TLSv1.3 support to CPython, pyOpenSSL, and SecureTransport ``SSLContext`` implementations. (Pull #1496) * Switched the default multipart header encoder from RFC 2231 to HTML 5 working draft. * Fixed issue where OpenSSL would block if an encrypted client private key was given and no password was given. Instead an ``SSLError`` is raised. * Added support for Brotli content encoding. It is enabled automatically if ``brotlipy`` package is installed which can be requested with ``urllib3[brotli]`` extra. * Drop ciphers using DSS key exchange from default TLS cipher suites. Improve default ciphers when using SecureTransport. * Implemented a more efficient ``HTTPResponse.__iter__()`` method. - Drop urllib3-test-ssl-drop-sslv3.patch . No longer needed OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-urllib3?expand=0&rev=59 2019-04-23 04:14:26 +00:00			`Index: urllib3-1.25/src/urllib3/util/ssl_.py`
			`===================================================================`
			`--- urllib3-1.25.orig/src/urllib3/util/ssl_.py`
			`+++ urllib3-1.25/src/urllib3/util/ssl_.py`
Accepting request 695346 from home:mcepl:branches:devel:languages:python - Update to 1.24.2: - Implemented a more efficient HTTPResponse.__iter__() method. (Issue #1483) - Upgraded urllib3.utils.parse_url() to be RFC 3986 compliant. (Pull #1487) - Remove Authorization header regardless of case when redirecting to cross-site. (Issue #1510) - Added support for key_password for HTTPSConnectionPool to use encrypted key_file without creating your own SSLContext object. (Pull #1489) - Fixed issue where OpenSSL would block if an encrypted client private key was given and no password was given. Instead an SSLError is raised. (Pull #1489) - Require and validate certificates by default when using HTTPS (Pull #1507) - Added support for Brotli content encoding. It is enabled automatically if brotlipy package is installed which can be requested with urllib3[brotli] extra. (Pull #1532) - Add TLSv1.3 support to CPython, pyOpenSSL, and SecureTransport SSLContext implementations. (Pull #1496) - Drop ciphers using DSS key exchange from default TLS cipher suites. Improve default ciphers when using SecureTransport. (Pull #1496) - Add support for IPv6 addresses in subjectAltName section of certificates. (Issue #1269) - Switched the default multipart header encoder from RFC 2231 to HTML 5 working draft. (Issue #303, PR #1492) OBS-URL: https://build.opensuse.org/request/show/695346 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-urllib3?expand=0&rev=57 2019-04-17 22:10:22 +00:00			`@@ -333,6 +333,8 @@ def ssl_wrap_socket(sock, keyfile=None,`
			`elif ssl_context is None and hasattr(context, 'load_default_certs'):`
Accepting request 486170 from devel:languages:python:singlespec - merge python3 modifications - update for multipython build - update to 1.20: * Added support for waiting for I/O using selectors other than select, improving urllib3’s behaviour with large numbers of concurrent connections. (Pull #1001) * Updated the date for the system clock check. (Issue #1005) * ConnectionPools now correctly consider hostnames to be case-insensitive. (Issue #1032) * Outdated versions of PyOpenSSL now cause the PyOpenSSL contrib module to fail when it is injected, rather than at first use. (Pull #1063) * Outdated versions of cryptography now cause the PyOpenSSL contrib module to fail when it is injected, rather than at first use. (Issue #1044) * Automatically attempt to rewind a file-like body object when a request is retried or redirected. (Pull #1039) * Fix some bugs that occur when modules incautiously patch the queue module. (Pull #1061) * Prevent retries from occuring on read timeouts for which the request method was not in the method whitelist. (Issue #1059) * Changed the PyOpenSSL contrib module to lazily load idna to avoid unnecessarily bloating the memory of programs that don’t need it. (Pull #1076) * Add support for IPv6 literals with zone identifiers. (Pull #1013) * Added support for socks5h:// and socks4a:// schemes when working with SOCKS proxies, and controlled remote DNS appropriately. (Issue #1035) OBS-URL: https://build.opensuse.org/request/show/486170 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-urllib3?expand=0&rev=25 2017-04-06 15:11:12 +00:00			`# try to load OS default certs; works well on Windows (require Python3.4+)`
			`context.load_default_certs()`
			`+ elif cert_reqs != ssl.CERT_NONE and hasattr(context, 'set_default_verify_paths'):`
			`+ context.set_default_verify_paths()`
Accepting request 344244 from home:matejcik:branches:devel:languages:python - removed python-certifi dependency, we don't want to use it - drop 0001-Don-t-pin-dependency-to-exact-version.patch because it's not needed anymore - re-enable tests, re-add dependencies * don't exclude test_util.py * exclude proxy timeout tests that fail for spurious reasons - urllib3-ssl-default-context.patch - use set_default_verify_paths() if no certificate path specified and verification not explicitly disabled - urllib3-test-ssl-drop-sslv3.patch - don't use "SSLv3" constants as they are not supported in openssl (and conversely python) anymore - ready-event.patch - fix race conditions in timeout tests OBS-URL: https://build.opensuse.org/request/show/344244 OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-urllib3?expand=0&rev=12 2015-11-13 14:47:50 +00:00
- update to 1.25 (bsc#1132663, CVE-2019-11236): * Require and validate certificates by default when using HTTPS * Upgraded ``urllib3.utils.parse_url()`` to be RFC 3986 compliant. * Added support for ``key_password`` for ``HTTPSConnectionPool`` to use encrypted ``key_file`` without creating your own ``SSLContext`` object. * Add TLSv1.3 support to CPython, pyOpenSSL, and SecureTransport ``SSLContext`` implementations. (Pull #1496) * Switched the default multipart header encoder from RFC 2231 to HTML 5 working draft. * Fixed issue where OpenSSL would block if an encrypted client private key was given and no password was given. Instead an ``SSLError`` is raised. * Added support for Brotli content encoding. It is enabled automatically if ``brotlipy`` package is installed which can be requested with ``urllib3[brotli]`` extra. * Drop ciphers using DSS key exchange from default TLS cipher suites. Improve default ciphers when using SecureTransport. * Implemented a more efficient ``HTTPResponse.__iter__()`` method. - Drop urllib3-test-ssl-drop-sslv3.patch . No longer needed OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-urllib3?expand=0&rev=59 2019-04-23 04:14:26 +00:00			`# Attempt to detect if we get the goofy behavior of the`
			`# keyfile being encrypted and OpenSSL asking for the`