Merged revisions 57778-58052 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r57820 | georg.brandl | 2007-08-31 08:59:27 +0200 (Fri, 31 Aug 2007) | 2 lines
Document new shorthand notation for index entries.
........
r57827 | georg.brandl | 2007-08-31 10:47:51 +0200 (Fri, 31 Aug 2007) | 2 lines
Fix subitem markup.
........
r57833 | martin.v.loewis | 2007-08-31 12:01:07 +0200 (Fri, 31 Aug 2007) | 1 line
Mark registry components as 64-bit on Win64.
........
r57854 | bill.janssen | 2007-08-31 21:02:23 +0200 (Fri, 31 Aug 2007) | 1 line
deprecate use of FakeSocket
........
r57855 | bill.janssen | 2007-08-31 21:02:46 +0200 (Fri, 31 Aug 2007) | 1 line
remove mentions of socket.ssl in comments
........
r57856 | bill.janssen | 2007-08-31 21:03:31 +0200 (Fri, 31 Aug 2007) | 1 line
remove use of non-existent SSLFakeSocket in apparently untested code
........
r57859 | martin.v.loewis | 2007-09-01 08:36:03 +0200 (Sat, 01 Sep 2007) | 3 lines
Bug #1737210: Change Manufacturer of Windows installer to PSF.
Will backport to 2.5.
........
r57865 | georg.brandl | 2007-09-01 09:51:24 +0200 (Sat, 01 Sep 2007) | 2 lines
Fix RST link (backport from Py3k).
........
r57876 | georg.brandl | 2007-09-01 17:49:49 +0200 (Sat, 01 Sep 2007) | 2 lines
Document sets' ">" and "<" operations (backport from py3k).
........
r57878 | skip.montanaro | 2007-09-01 19:40:03 +0200 (Sat, 01 Sep 2007) | 4 lines
Added a note and examples to explain that re.split does not split on an
empty pattern match. (issue 852532).
........
r57879 | walter.doerwald | 2007-09-01 20:18:09 +0200 (Sat, 01 Sep 2007) | 2 lines
Fix wrong function names.
........
r57880 | walter.doerwald | 2007-09-01 20:34:05 +0200 (Sat, 01 Sep 2007) | 2 lines
Fix typo.
........
r57889 | andrew.kuchling | 2007-09-01 22:31:59 +0200 (Sat, 01 Sep 2007) | 1 line
Markup fix
........
r57892 | andrew.kuchling | 2007-09-01 22:43:36 +0200 (Sat, 01 Sep 2007) | 1 line
Add various items
........
r57895 | andrew.kuchling | 2007-09-01 23:17:58 +0200 (Sat, 01 Sep 2007) | 1 line
Wording change
........
r57896 | andrew.kuchling | 2007-09-01 23:18:31 +0200 (Sat, 01 Sep 2007) | 1 line
Add more items
........
r57904 | ronald.oussoren | 2007-09-02 11:46:07 +0200 (Sun, 02 Sep 2007) | 3 lines
Macosx: this patch ensures that the value of MACOSX_DEPLOYMENT_TARGET used
by the Makefile is also used at configure-time.
........
r57925 | georg.brandl | 2007-09-03 09:16:46 +0200 (Mon, 03 Sep 2007) | 2 lines
Fix #883466: don't allow Unicode as arguments to quopri and uu codecs.
........
r57936 | matthias.klose | 2007-09-04 01:33:04 +0200 (Tue, 04 Sep 2007) | 2 lines
- Added support for linking the bsddb module against BerkeleyDB 4.6.x.
........
r57954 | mark.summerfield | 2007-09-04 10:16:15 +0200 (Tue, 04 Sep 2007) | 3 lines
Added cross-references plus a note about dict & list shallow copying.
........
r57958 | martin.v.loewis | 2007-09-04 11:51:57 +0200 (Tue, 04 Sep 2007) | 3 lines
Document that we rely on the OS to release the crypto
context. Fixes #1626801.
........
r57960 | martin.v.loewis | 2007-09-04 15:13:14 +0200 (Tue, 04 Sep 2007) | 3 lines
Patch #1388440: Add set_completion_display_matches_hook and
get_completion_type to readline.
........
r57961 | martin.v.loewis | 2007-09-04 16:19:28 +0200 (Tue, 04 Sep 2007) | 3 lines
Patch #1031213: Decode source line in SyntaxErrors back to its original
source encoding. Will backport to 2.5.
........
r57972 | matthias.klose | 2007-09-04 20:17:36 +0200 (Tue, 04 Sep 2007) | 3 lines
- Makefile.pre.in(buildbottest): Run an optional script pybuildbot.identify
to include some information about the build environment.
........
r57973 | matthias.klose | 2007-09-04 21:05:38 +0200 (Tue, 04 Sep 2007) | 2 lines
- Makefile.pre.in(buildbottest): Remove whitespace at eol.
........
r57975 | matthias.klose | 2007-09-04 22:46:02 +0200 (Tue, 04 Sep 2007) | 2 lines
- Fix libffi configure for hppa*-*-linux* | parisc*-*-linux*.
........
r57980 | bill.janssen | 2007-09-05 02:46:27 +0200 (Wed, 05 Sep 2007) | 1 line
SSL certificate distinguished names should be represented by tuples
........
r57985 | martin.v.loewis | 2007-09-05 08:39:17 +0200 (Wed, 05 Sep 2007) | 3 lines
Patch #1105: Explain that one needs to build the solution
to get dependencies right.
........
r57987 | armin.rigo | 2007-09-05 09:51:21 +0200 (Wed, 05 Sep 2007) | 4 lines
PyDict_GetItem() returns a borrowed reference.
There are probably a number of places that are open to attacks
such as the following one, in bltinmodule.c:min_max().
........
r57991 | martin.v.loewis | 2007-09-05 13:47:34 +0200 (Wed, 05 Sep 2007) | 3 lines
Patch #786737: Allow building in a tree of symlinks pointing to
a readonly source.
........
r57993 | georg.brandl | 2007-09-05 15:36:44 +0200 (Wed, 05 Sep 2007) | 2 lines
Backport from Py3k: Bug #1684991: explain lookup semantics for __special__ methods (new-style classes only).
........
r58004 | armin.rigo | 2007-09-06 10:30:51 +0200 (Thu, 06 Sep 2007) | 4 lines
Patch #1733973 by peaker:
ptrace_enter_call() assumes no exception is currently set.
This assumption is broken when throwing into a generator.
........
r58006 | armin.rigo | 2007-09-06 11:30:38 +0200 (Thu, 06 Sep 2007) | 4 lines
PyDict_GetItem() returns a borrowed reference.
This attack is against ceval.c:IMPORT_NAME, which calls an
object (__builtin__.__import__) without holding a reference to it.
........
r58013 | georg.brandl | 2007-09-06 16:49:56 +0200 (Thu, 06 Sep 2007) | 2 lines
Backport from 3k: #1116: fix reference to old filename.
........
r58021 | thomas.heller | 2007-09-06 22:26:20 +0200 (Thu, 06 Sep 2007) | 1 line
Fix typo: c_float represents to C float type.
........
r58022 | skip.montanaro | 2007-09-07 00:29:06 +0200 (Fri, 07 Sep 2007) | 3 lines
If this is correct for py3k branch and it's already in the release25-maint
branch, seems like it ought to be on the trunk as well.
........
r58023 | gregory.p.smith | 2007-09-07 00:59:59 +0200 (Fri, 07 Sep 2007) | 4 lines
Apply the fix from Issue1112 to make this test more robust and keep
windows happy.
........
r58031 | brett.cannon | 2007-09-07 05:17:50 +0200 (Fri, 07 Sep 2007) | 4 lines
Make uuid1 and uuid4 tests conditional on whether ctypes can be imported;
implementation of either function depends on ctypes but uuid as a whole does
not.
........
r58032 | brett.cannon | 2007-09-07 06:18:30 +0200 (Fri, 07 Sep 2007) | 6 lines
Fix a crasher where Python code managed to infinitely recurse in C code without
ever going back out to Python code in PyObject_Call(). Required introducing a
static RuntimeError instance so that normalizing an exception there is no
reliance on a recursive call that would put the exception system over the
recursion check itself.
........
r58034 | thomas.heller | 2007-09-07 08:32:17 +0200 (Fri, 07 Sep 2007) | 1 line
Add a 'c_longdouble' type to the ctypes module.
........
r58035 | thomas.heller | 2007-09-07 11:30:40 +0200 (Fri, 07 Sep 2007) | 1 line
Remove unneeded #include.
........
r58036 | thomas.heller | 2007-09-07 11:33:24 +0200 (Fri, 07 Sep 2007) | 6 lines
Backport from py3k branch:
Add a workaround for a strange bug on win64, when _ctypes is compiled
with the SDK compiler. This should fix the failing
Lib\ctypes\test\test_as_parameter.py test.
........
r58037 | georg.brandl | 2007-09-07 16:14:40 +0200 (Fri, 07 Sep 2007) | 2 lines
Fix a wrong indentation for sublists.
........
r58043 | georg.brandl | 2007-09-07 22:10:49 +0200 (Fri, 07 Sep 2007) | 2 lines
#1095: ln -f doesn't work portably, fix in Makefile.
........
r58049 | skip.montanaro | 2007-09-08 02:34:17 +0200 (Sat, 08 Sep 2007) | 1 line
be explicit about the actual location of the missing file
........
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 5072caf..852a905 100644
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -170,6 +170,8 @@
Some "standard" root certificates are available at
http://www.thawte.com/roots/ (for Thawte roots) and
http://www.verisign.com/support/roots.html (for Verisign roots).
+See also :rfc:`4158` for more discussion of the way in which
+certification chains can be built.
sslsocket Objects
@@ -239,23 +241,23 @@
the certificate), ``notBefore`` (the time before which the certificate should not be trusted),
and ``notAfter`` (the time after which the certificate should not be trusted) filled in.
- The "subject" and "issuer" fields are themselves dictionaries containing the fields given
- in the certificate's data structure for each principal::
+ The "subject" and "issuer" fields are tuples containing the name-value fields
+ given in the certificate's data structure for each principal::
- {'issuer': {'commonName': u'somemachine.python.org',
- 'countryName': u'US',
- 'localityName': u'Wilmington',
- 'organizationName': u'Python Software Foundation',
- 'organizationalUnitName': u'SSL',
- 'stateOrProvinceName': u'Delaware'},
- 'subject': {'commonName': u'somemachine.python.org',
- 'countryName': u'US',
- 'localityName': u'Wilmington',
- 'organizationName': u'Python Software Foundation',
- 'organizationalUnitName': u'SSL',
- 'stateOrProvinceName': u'Delaware'},
- 'notAfter': 'Sep 4 21:54:26 2007 GMT',
- 'notBefore': 'Aug 25 21:54:26 2007 GMT',
+ {'issuer': (('countryName', u'US'),
+ ('stateOrProvinceName', u'Delaware'),
+ ('localityName', u'Wilmington'),
+ ('organizationName', u'Python Software Foundation'),
+ ('organizationalUnitName', u'SSL'),
+ ('commonName', u'somemachine.python.org')),
+ 'notAfter': 'Feb 16 16:54:50 2013 GMT',
+ 'notBefore': 'Aug 27 16:54:50 2007 GMT',
+ 'subject': (('countryName', u'US'),
+ ('stateOrProvinceName', u'Delaware'),
+ ('localityName', u'Wilmington'),
+ ('organizationName', u'Python Software Foundation'),
+ ('organizationalUnitName', u'SSL'),
+ ('commonName', u'somemachine.python.org')),
'version': 2}
This certificate is said to be *self-signed*, because the subject
@@ -311,27 +313,32 @@
# note that closing the sslsocket will also close the underlying socket
ssl_sock.close()
-As of August 25, 2007, the certificate printed by this program
+As of September 4, 2007, the certificate printed by this program
looked like this::
- {'issuer': {'commonName': u'VeriSign Class 3 Extended Validation SSL SGC CA',
- 'countryName': u'US',
- 'organizationName': u'VeriSign, Inc.',
- 'organizationalUnitName': u'Terms of use at https://www.verisign.com/rpa (c)06'},
- 'subject': {'1.3.6.1.4.1.311.60.2.1.2': u'Delaware',
- '1.3.6.1.4.1.311.60.2.1.3': u'US',
- 'commonName': u'www.verisign.com',
- 'countryName': u'US',
- 'localityName': u'Mountain View',
- 'organizationName': u'VeriSign, Inc.',
- 'organizationalUnitName': u'Terms of use at www.verisign.com/rpa (c)06',
- 'postalCode': u'94043',
- 'serialNumber': u'2497886',
- 'stateOrProvinceName': u'California',
- 'streetAddress': u'487 East Middlefield Road'},
- 'notAfter': 'May 8 23:59:59 2009 GMT',
- 'notBefore': 'May 9 00:00:00 2007 GMT',
- 'version': 2}
+ {'issuer': (('countryName', u'US'),
+ ('organizationName', u'VeriSign, Inc.'),
+ ('organizationalUnitName', u'VeriSign Trust Network'),
+ ('organizationalUnitName',
+ u'Terms of use at https://www.verisign.com/rpa (c)06'),
+ ('commonName',
+ u'VeriSign Class 3 Extended Validation SSL SGC CA')),
+ 'notAfter': 'May 8 23:59:59 2009 GMT',
+ 'notBefore': 'May 9 00:00:00 2007 GMT',
+ 'subject': (('serialNumber', u'2497886'),
+ ('1.3.6.1.4.1.311.60.2.1.3', u'US'),
+ ('1.3.6.1.4.1.311.60.2.1.2', u'Delaware'),
+ ('countryName', u'US'),
+ ('postalCode', u'94043'),
+ ('stateOrProvinceName', u'California'),
+ ('localityName', u'Mountain View'),
+ ('streetAddress', u'487 East Middlefield Road'),
+ ('organizationName', u'VeriSign, Inc.'),
+ ('organizationalUnitName', u'Production Security Services'),
+ ('organizationalUnitName',
+ u'Terms of use at www.verisign.com/rpa (c)06'),
+ ('commonName', u'www.verisign.com')),
+ 'version': 2}
Server-side operation
^^^^^^^^^^^^^^^^^^^^^
@@ -383,3 +390,5 @@
`Introducing SSL and Certificates using OpenSSL <http://old.pseudonym.org/ssl/wwwj-index.html>`_, by Frederick J. Hirsch
`Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management`, :rfc:`1422`, by Steve Kent
+
+`Internet X.509 Public Key Infrastructure Certificate and CRL Profile`, :rfc:`3280`, Housley et. al.