gh-154517: Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs - #154518
gh-154517: Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs#154518fedonman wants to merge 6 commits into
Conversation
…um groups for the ssl group API
Documentation build overview
77 files changed ·
|
…gnature algorithm APIs
|
The wording differs from what this file uses elsewhere. For methods it says "This method will raise :exc:`NotImplementedError` if :data:`HAS_PSK` is ``False``", and for versions "This option is only available with OpenSSL 3.0.0 and later". Something like This method will raise :exc:`NotImplementedError` if the OpenSSL library
is older than 3.2.would fit better, and since the same sentence is repeated five times it is worth choosing one form. |
| context. It should be a string in the `OpenSSL group list format | ||
| <https://docs.openssl.org/master/man3/SSL_CTX_set1_groups_list/>`_. | ||
|
|
||
| This is a more general replacement for :meth:`~SSLContext.set_ecdh_curve`: |
There was a problem hiding this comment.
Why are you extending this documentation? it's already spelled in the OpenSSL documentation.
There was a problem hiding this comment.
Dropped it. The group list format is documented by OpenSSL and the example did not add anything on top of that.
There was a problem hiding this comment.
Can you also avoid replying with an LLM reply please? I find it a bit annoying that you use your agents for a human conversation where you could have acknowledged this more simply.
There was a problem hiding this comment.
I am sorry. Using an LLM is simply faster for me, even for short replies. I understand that it can feel impersonal. I will change this in our conversations.
| and the method :meth:`SSLSocket.cipher` returns information about the | ||
| negotiated cipher for both TLS 1.3 and earlier versions once a connection | ||
| is established. | ||
| - Key agreement can use post-quantum hybrid groups such as |
There was a problem hiding this comment.
I would rather not say that OpenSSL 3.5 offers them by default. That looks like a tautology in this context (why would we mention 3.5 otherwise????)
There was a problem hiding this comment.
Removed that clause, the bullet now only says the groups are available with OpenSSL 3.5 or later.
picnixz
left a comment
There was a problem hiding this comment.
There are unrelated changes that look AI generated. Remove them and please review your AI output before committing.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase |
Use the phrasing already used in this file for the five version notes, as suggested by serhiy-storchaka. Remove the set_groups() example and post-quantum paragraph, which restate the OpenSSL documentation, and drop the redundant claim that OpenSSL 3.5 offers hybrid groups by default.
|
Thanks. All five now use the form already in this file: This method will raise :exc:`NotImplementedError` if the OpenSSL library
is older than 3.2.I have made the requested changes; please review again |
|
Thanks for making the requested changes! @picnixz: please review the changes made to this pull request. |
This fills a few gaps in the
sslmodule documentation around the key agreement group and signature algorithm APIs added in 3.15.Five methods now state which OpenSSL version they need and that they raise
NotImplementedErroron older versions:SSLSocket.group()(3.2),SSLContext.get_groups()(3.5),ssl.get_sigalgs()(3.4),SSLSocket.client_sigalg()(3.5) andSSLSocket.server_sigalg()(3.5). Each requirement is already in the What's New in 3.15 entries and enforced inModules/_ssl.c, so this just brings the reference pages in line.On top of that,
SSLContext.set_groups()gains a short example that prefers the post-quantum hybrid groupX25519MLKEM768and falls back toX25519, along with a note about the OpenSSL 3.5 requirement and theSSLErrorraised for an unknown group.set_ecdh_curve()now points at the more generalset_groups(), and the TLS 1.3 section mentions post-quantum hybrid key agreement.The signature algorithm part started as a separate PR (#154521). It is folded in here as requested, so this is now the single PR for both.
This is documentation only, so there is no news entry.