UPGRADE TO PYTHON 2.7.9 HOW TO
UPGRADE TO PYTHON 2.7.9 PATCH
UPGRADE TO PYTHON 2.7.9 VERIFICATION

The opt out solution in PEP 476 works for the 'direct consumption of upstream' case, as the system administrator responsible for the machine can opt out globally in sitecustomize.py.

UPGRADE TO PYTHON 2.7.9 VERIFICATION

* System administrator responsible for the machine can easily opt in to global verification and have that setting persist through Python updates * Platform vendor configures Python to use legacy mode by default * CPython upstream verifies certificates by default The additional background here is that we started looking closely at what would be involved in applying PEP 476 to systems where there are 3 parties involved and the aim is to tweak the system Python to require explicitly opting in to certificate verification (at least for the time being): (capturing these details here for now, we should at least have a python-dev discussion before going ahead with any changes in this area) Anyway, did you read the discussion on the PEP 476? Options to disable SSL checks have been discussed there. It was also discussed to support an optional 'sslcustomize' module, but the idea was rejected if I remember correctly. You can hack site.py to disable SSL checks system-wide. > 2) It exists but it is not system wide, There are many of users who rely on python and not all of them are programmers.

UPGRADE TO PYTHON 2.7.9 PATCH

> 3) what downstream are you talking about?ДЎ) patch attached, dunno how I missed it, thank you.Дў) It exists but it is not system wide, I would like to provide users option to opt-in or opt-out without interfering with code. (Python 2.7.9 made SSL check mandatory by default, or is it only scheduled for Python 2.7.10? I don't remember :-() Robert wants something to keep the Python 2.7.8 behaviour on Python 2.7.9 and newer. > 2) certificate verification is optional already, is it not? That is, it can be turned off in your code, it is just on by default. But what about xmlrpclib? Should it follow the same policy? Maybe it's a stupid idea, for example urllib and httplib are both used for HTTPS. We may configure it per Python module (if we choose to accept the enhancement, I'm not convinced that it's good idea). I'm not sure that the configuration should be made on the protocol. > # each protocol affected by cert-verification got its own section I understand that Robert wants a finer grain.

UPGRADE TO PYTHON 2.7.9 HOW TO

The PEP contains a section to explain how to opt-out, but the solution is global: This issue is related to the PEP 476 which made the SSL certification checks mandatory by default. Supposing there is sufficient utility here, the level of change proposed would need to go through python-ideas first, IMO. David Murray (r.david.murray) *Дў) certificate verification is optional already, is it not? That is, it can be turned off in your code, it is just on by default.ДЈ) what downstream are you talking about? I've added some people to nosy list based on ДЄuthor: R. I open the RFE mainly to see if there is a will to implement optionable certificate verification in upstream as it is in downstream. This is how currently works patch attached, but I guess it would make more sense make this behave consistent within the same interpreter even when config is changed and the change will be propagated in the next interpreter run/service restart.ДЄlso the patch could be changed to instead of being protocol based to be module based, but this would need also patching the affected modules. > # config changed to verify=enable, still same interpreter In rpm we can set package to not replace user edited configs when rpm is updated, so if user change the default value of config the config will remain the same. This choice is for users who don't care about the security settings so they put the decision into their platform (distro) from which they get python. Platform_default - to use default (platform-specific) settings # each protocol affected by cert-verification got its own sectionД®nable - to enable certificate verificationДisable - to disable certificate verification This patch depends on existence of config file which holds information about the protocol settings. Proposed patch adds possibility to opt-out certificate verification.Дisclaimer: it is just proof of concept as the config value is hard-coded. Proposed implementation (with docs updates) Make default HTTPS certificate verification setting configurableДЄlex, barry, bkabrda, christian.heimes, doko, dstufft, janssen, lemburg, ncoghlan, pitrou, python-dev, r.david.murray, rkuska, vstinnerД¬reated on 10:38 by rkuska, last changed 12:51 by ncoghlan.

Upgrade to python 2.7.9