Repository navigation
gh-154517: Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs - #154518
fedonman wants to merge 6 commits into
Conversation
Sorry, something went wrong.
…um groups for the ssl group API
Documentation build overview77 files changed · ± 77 modified ± Modified |
Sorry, something went wrong.
…gnature algorithm APIs
|
The wording differs from what this file uses elsewhere. For methods it says "This method will raise :exc:`NotImplementedError` if :data:`HAS_PSK` is ``False``", and for versions "This option is only available with OpenSSL 3.0.0 and later". Something like This method will raise :exc:`NotImplementedError` if the OpenSSL library
is older than 3.2.would fit better, and since the same sentence is repeated five times it is worth choosing one form. |
Sorry, something went wrong.
picnixz
left a comment
There was a problem hiding this comment.
There are unrelated changes that look AI generated. Remove them and please review your AI output before committing.
Sorry, something went wrong.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request. |
Sorry, something went wrong.
Use the phrasing already used in this file for the five version notes, as suggested by serhiy-storchaka. Remove the set_groups() example and post-quantum paragraph, which restate the OpenSSL documentation, and drop the redundant claim that OpenSSL 3.5 offers hybrid groups by default.
|
Thanks. All five now use the form already in this file: This method will raise :exc:`NotImplementedError` if the OpenSSL library
is older than 3.2.I have made the requested changes; please review again |
Sorry, something went wrong.
|
Thanks for making the requested changes! @picnixz: please review the changes made to this pull request. |
Sorry, something went wrong.
This fills a few gaps in the ssl module documentation around the key agreement group and signature algorithm APIs added in 3.15.
Five methods now state which OpenSSL version they need and that they raise NotImplementedError on older versions: SSLSocket.group() (3.2), SSLContext.get_groups() (3.5), ssl.get_sigalgs() (3.4), SSLSocket.client_sigalg() (3.5) and SSLSocket.server_sigalg() (3.5). Each requirement is already in the What's New in 3.15 entries and enforced in Modules/_ssl.c, so this just brings the reference pages in line.
On top of that, SSLContext.set_groups() gains a short example that prefers the post-quantum hybrid group X25519MLKEM768 and falls back to X25519, along with a note about the OpenSSL 3.5 requirement and the SSLError raised for an unknown group. set_ecdh_curve() now points at the more general set_groups(), and the TLS 1.3 section mentions post-quantum hybrid key agreement.
The signature algorithm part started as a separate PR (#154521). It is folded in here as requested, so this is now the single PR for both.
This is documentation only, so there is no news entry.