0876b921b28bb14e3fa61b188e52fc9b4c77cb1a - external/github.com/python/cpython

commit: 0876b921b28bb14e3fa61b188e52fc9b4c77cb1a
[log] [tgz]
author: William Woodruff <[email protected]>
Wed Mar 06 21:44:58 2024
committer: GitHub <[email protected]>
Wed Mar 06 21:44:58 2024
tree: 62bc49024ede52d872ea9a270390bb338709b653
parent: ea1803e608a7aaf9cf2c07e510d8540d46d3b9ad [diff]

gh-107361: strengthen default SSL context flags (#112389)

This adds `VERIFY_X509_STRICT` to make the default
SSL context perform stricter (per RFC 5280) validation, as well
as `VERIFY_X509_PARTIAL_CHAIN` to enforce more standards-compliant
path-building behavior.

As part of this changeset, I had to tweak `make_ssl_certs.py`
slightly to emit 5280-conforming CA certs. This changeset includes
the regenerated certificates after that change.

Signed-off-by: William Woodruff <[email protected]>
Co-authored-by: Victor Stinner <[email protected]>

.gitattributes[diff]
Doc/library/ssl.rst[diff]
Doc/whatsnew/3.13.rst[diff]
Lib/ssl.py[diff]
Lib/test/certdata/allsans.pem[diff]
Lib/test/certdata/capath/b1930218.0[diff]
Lib/test/certdata/capath/ceff1710.0[diff]
Lib/test/certdata/idnsans.pem[diff]
Lib/test/certdata/keycert.passwd.pem[diff]
Lib/test/certdata/keycert.pem[diff]
Lib/test/certdata/keycert2.pem[diff]
Lib/test/certdata/keycert3.pem[diff]
Lib/test/certdata/keycert4.pem[diff]
Lib/test/certdata/keycertecc.pem[diff]
Lib/test/certdata/leaf-missing-aki.ca.pem[Added - diff]
Lib/test/certdata/leaf-missing-aki.keycert.pem[Added - diff]
Lib/test/certdata/make_ssl_certs.py[diff]
Lib/test/certdata/nosan.pem[diff]
Lib/test/certdata/pycacert.pem[diff]
Lib/test/certdata/pycakey.pem[diff]
Lib/test/certdata/revocation.crl[diff]
Lib/test/certdata/ssl_cert.pem[diff]
Lib/test/certdata/ssl_key.passwd.pem[diff]
Lib/test/certdata/ssl_key.pem[diff]
Lib/test/test_ssl.py[diff]
Misc/NEWS.d/next/Library/2023-11-24-23-40-00.gh-issue-107361.v54gh46.rst[Added - diff]

26 files changed