tree a9df16cdf788980f62f6ec04c010ece4d85bf822
parent d951157268b2122109098c792562b71ccc41920b
author Christian Heimes <christian@python.org> 1517231418 +0100
committer GitHub <noreply@github.com> 1517231418 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJabx06CRBK7hj4Ov3rIwAAdHIIAEOkpSOZqen11DJBr5X79K6H
 yIE/jrO3j8/PNCPWgWMviu0onNHswlq3X3atLuv3Q79QjOflcWPf93uhBKIOsNLM
 p35AJ6hJOUfhtymb3AVifXpFq+e/eK0o/Bf98Wt6k5mZr96x86pls5lz8lL1WLyv
 tV3NY8/54XWfJLnLnGdtP2B91gOHhnCc6ahf6DT85RUrRSgNlEgEzBic6tXLqjWn
 pFWSh78lRcaFG1ObS27uUZ7w1lIy6942aKvLgAX5ry1PG995WarJ5tIRA7IuIiry
 MTgTbeMeWcAUUafAsHkLRbznDJKcb3i9S8aI1YX7E3ZbbONJeCCsMBpMuYkpjqE=
 =zYNa
 -----END PGP SIGNATURE-----
 

bpo-31429: Define TLS cipher suite on build time (#3532)

Until now Python used a hard coded white list of default TLS cipher
suites. The old approach has multiple downsides. OpenSSL's default
selection was completely overruled. Python did neither benefit from new
cipher suites (ChaCha20, TLS 1.3 suites) nor blacklisted cipher suites.
For example we used to re-enable 3DES.

Python now defaults to OpenSSL DEFAULT cipher suite selection and black
lists all unwanted ciphers. Downstream vendors can override the default
cipher list with --with-ssl-default-suites.

Signed-off-by: Christian Heimes <christian@python.org>