Issue #12226: HTTPS is now used by default when connecting to PyPI.
diff --git a/Lib/distutils/config.py b/Lib/distutils/config.py
index 1fd5334..a97635f 100644
--- a/Lib/distutils/config.py
+++ b/Lib/distutils/config.py
@@ -21,7 +21,7 @@
class PyPIRCCommand(Command):
"""Base command that knows how to handle the .pypirc file
"""
- DEFAULT_REPOSITORY = 'http://pypi.python.org/pypi'
+ DEFAULT_REPOSITORY = 'https://pypi.python.org/pypi'
DEFAULT_REALM = 'pypi'
repository = None
realm = None
diff --git a/Lib/distutils/tests/test_config.py b/Lib/distutils/tests/test_config.py
index 525bee9..1259361 100644
--- a/Lib/distutils/tests/test_config.py
+++ b/Lib/distutils/tests/test_config.py
@@ -87,7 +87,7 @@
config = list(sorted(config.items()))
waited = [('password', 'secret'), ('realm', 'pypi'),
- ('repository', 'http://pypi.python.org/pypi'),
+ ('repository', 'https://pypi.python.org/pypi'),
('server', 'server1'), ('username', 'me')]
self.assertEqual(config, waited)
@@ -96,7 +96,7 @@
config = cmd._read_pypirc()
config = list(sorted(config.items()))
waited = [('password', 'secret'), ('realm', 'pypi'),
- ('repository', 'http://pypi.python.org/pypi'),
+ ('repository', 'https://pypi.python.org/pypi'),
('server', 'server-login'), ('username', 'tarek')]
self.assertEqual(config, waited)
diff --git a/Lib/distutils/tests/test_upload.py b/Lib/distutils/tests/test_upload.py
index 4c6464a..d269686 100644
--- a/Lib/distutils/tests/test_upload.py
+++ b/Lib/distutils/tests/test_upload.py
@@ -72,11 +72,11 @@
def setUp(self):
super(uploadTestCase, self).setUp()
- self.old_class = httpclient.HTTPConnection
- self.conn = httpclient.HTTPConnection = FakeConnection()
+ self.old_class = httpclient.HTTPSConnection
+ self.conn = httpclient.HTTPSConnection = FakeConnection()
def tearDown(self):
- httpclient.HTTPConnection = self.old_class
+ httpclient.HTTPSConnection = self.old_class
super(uploadTestCase, self).tearDown()
def test_finalize_options(self):
@@ -88,7 +88,7 @@
cmd.finalize_options()
for attr, waited in (('username', 'me'), ('password', 'secret'),
('realm', 'pypi'),
- ('repository', 'http://pypi.python.org/pypi')):
+ ('repository', 'https://pypi.python.org/pypi')):
self.assertEqual(getattr(cmd, attr), waited)
def test_saved_password(self):
diff --git a/Misc/NEWS b/Misc/NEWS
index e8054cf..430bec2 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,8 @@
Library
-------
+- Issue #12226: HTTPS is now used by default when connecting to PyPI.
+
- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler.
- Issue #14984: On POSIX systems, when netrc is called without a filename