Commit Graph

362 Commits

Author SHA1 Message Date
Christian Heimes e983252b51
bpo-43998: Default to TLS 1.2 and increase cipher suite security (GH-25778)
The ssl module now has more secure default settings. Ciphers without forward
secrecy or SHA-1 MAC are disabled by default. Security level 2 prohibits
weak RSA, DH, and ECC keys with less than 112 bits of security.
:class:`~ssl.SSLContext` defaults to minimum protocol version TLS 1.2.
Settings are based on Hynek Schlawack's research.

```
$ openssl version
OpenSSL 1.1.1k  FIPS 25 Mar 2021
$ openssl ciphers -v '@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM'
TLS_AES_256_GCM_SHA384  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(256) Mac=AEAD
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any      Au=any  Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_128_GCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESGCM(128) Mac=AEAD
TLS_AES_128_CCM_SHA256  TLSv1.3 Kx=any      Au=any  Enc=AESCCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH     Au=RSA  Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
```

Signed-off-by: Christian Heimes <christian@python.org>
2021-05-01 20:53:10 +02:00
Victor Stinner abfd6388cd
bpo-43774: Enhance debug build documentation (GH-25712)
* Add also references to --with-trace-refs option.
* Move _ob_next and _ob_prev at the end, since they don't exist by
  default and are related to debug.
2021-04-29 13:06:59 +02:00
Victor Stinner 645ed62fb4
bpo-43774: Remove unused PYMALLOC_DEBUG macro (GH-25711)
Enhance also the documentation of debug hooks on memory allocators.
2021-04-29 10:47:47 +02:00
Andre Delfino d28b346953
Fix broken links and improve stand-alone tools list in FAQ GH-22124 2021-04-25 18:10:05 -07:00
Christian Heimes 39258d3595
bpo-43669: PEP 644: Require OpenSSL 1.1.1 or newer (GH-23014)
- Remove HAVE_X509_VERIFY_PARAM_SET1_HOST check
- Update hashopenssl to require OpenSSL 1.1.1
- multissltests only OpenSSL > 1.1.0
- ALPN is always supported
- SNI is always supported
- Remove deprecated NPN code. Python wrappers are no-op.
- ECDH is always supported
- Remove OPENSSL_VERSION_1_1 macro
- Remove locking callbacks
- Drop PY_OPENSSL_1_1_API macro
- Drop HAVE_SSL_CTX_CLEAR_OPTIONS macro
- SSL_CTRL_GET_MAX_PROTO_VERSION is always defined now
- security level is always available now
- get_num_tickets is available with TLS 1.3
- X509_V_ERR MISMATCH is always available now
- Always set SSL_MODE_RELEASE_BUFFERS
- X509_V_FLAG_TRUSTED_FIRST is always available
- get_ciphers is always supported
- SSL_CTX_set_keylog_callback is always available
- Update Modules/Setup with static link example
- Mention PEP in whatsnew
- Drop 1.0.2 and 1.1.0 from GHA tests
2021-04-17 11:36:35 +02:00
Victor Stinner 62ec638648
bpo-43862: Enhance -W cmdline option documentation (GH-25439)
The -W format is "action:message:category:module:lineno".

Update also the Python manual page.
2021-04-16 19:12:14 +02:00
Victor Stinner 85918e4ab6
bpo-43774: Add more links to configure options (GH-25363) 2021-04-12 23:27:35 +02:00
Victor Stinner bd88ccb943
bpo-43774: Document the Python Build System (GH-25302)
* Elaborate PGO and LTO documentaton.
* Document MAINCC, PURIFY and LINKCC variables.
2021-04-09 14:35:10 +02:00
Victor Stinner 5436695363
bpo-43774: Enhance configure documentation (GH-25293) 2021-04-09 01:58:20 +02:00
Victor Stinner a41782cc84
bpo-43774: Document configure options (GH-25283)
Add Doc/using/configure.rst documentation to document configure,
preprocessor, compiler and linker options.

Add a new section about the "Python debug build".
2021-04-08 22:32:21 +02:00
Inada Naoki 4827483f47
bpo-43510: Implement PEP 597 opt-in EncodingWarning. (GH-19481)
See [PEP 597](https://www.python.org/dev/peps/pep-0597/).

* Add `-X warn_default_encoding` and `PYTHONWARNDEFAULTENCODING`.
* Add EncodingWarning
* Add io.text_encoding()
* open(), TextIOWrapper() emits EncodingWarning when encoding is omitted and warn_default_encoding is enabled.
* _pyio.TextIOWrapper() uses UTF-8 as fallback default encoding used when failed to import locale module. (used during building Python)
* bz2, configparser, gzip, lzma, pathlib, tempfile modules use io.text_encoding().
* What's new entry
2021-03-29 12:28:14 +09:00
Christian Heimes 32eba61ea4
bpo-43466: Add --with-openssl-rpath configure option (GH-24820) 2021-03-19 10:29:25 +01:00
Jeremy Paige 743932d508
Remove all links to mingw.org (GH-24552)
This lease on this domain has lapsed. This not only makes these dead links, but a potential attack vector for readers of python.org as the domain can be obtained by an untrustworthy party.


I considered redirecting these links to http://mingw-w64.org/ which is a maintained fork of mingw, but beyond my unfamiliarity with the exact level of compatibility, at the time of this PR that site had an expired cert and so is not much of a vulnerability fix.

Automerge-Triggered-By: GH:Mariatta
2021-02-18 11:43:35 -08:00
Steve Dower 1ba08a121a
Add link to Microsoft docs for limitations in Windows Store package (GH-24422) 2021-02-03 01:13:43 +00:00
Zackery Spytz db68544122
bpo-42523: Fix supported versions in "Using Python on Windows" (GH-23603) 2020-12-03 17:22:04 +00:00
Victor Stinner 4b9aad4999
bpo-42236: Enhance init and encoding documentation (GH-23109)
Enhance the documentation of the Python startup, filesystem encoding
and error handling, locale encoding. Add a new "Python UTF-8 Mode"
section.

* Add "locale encoding" and "filesystem encoding and error handler"
  to the glossary
* Remove documentation from Include/cpython/initconfig.h: move it to
  Doc/c-api/init_config.rst.
* Doc/c-api/init_config.rst:

  * Document command line options and environment variables
  * Document default values.

* Add a new "Python UTF-8 Mode" section in Doc/library/os.rst.
* Add warnings to Py_DecodeLocale() and Py_EncodeLocale() docs.
* Document how Python selects the filesystem encoding and error
  handler at a single place: PyConfig.filesystem_encoding and
  PyConfig.filesystem_errors.
* PyConfig: move orig_argv member at the right place.
2020-11-02 16:49:54 +01:00
Zackery Spytz ff1ae3dd33
bpo-30612: Tweak Windows registry path syntax in the docs (GH-20281) 2020-10-20 13:01:12 +01:00
Saiyang Gou ebc8c38287
bpo-41192: Fix some broken anchors for audit event entries (#21310) 2020-10-19 10:52:42 -04:00
johnthagen 1264d0465a
Fix documented Python version for venv --upgrade-deps (GH-22113)
Fixes incorrect Python version added for `venv` `--upgrade-deps` in #13100. This feature was added in Python 3.9 not 3.8.

Relates to:

- 
- 1cba1c9aba

Automerge-Triggered-By: @vsajip
2020-09-05 13:53:47 -07:00
Andre Delfino 3584d4b64a
[doc] Document VIRTUAL_ENV environment variable (GH-21970) 2020-09-01 07:07:29 +01:00
native-api 2145c8c972
bpo-33944: site: Add site-packages tracing in verbose mode (GH-12110) 2020-06-12 15:20:11 +09:00
Pablo Galindo 1ed83adb0e
bpo-40939: Remove the old parser (GH-20768)
This commit removes the old parser, the deprecated parser module, the old parser compatibility flags and environment variables and all associated support code and documentation.
2020-06-11 17:30:46 +01:00
Victor Stinner 5edb83241f
bpo-40854: PYTHONPLATLIBDIR env var added to 3.9 (GH-20735) 2020-06-08 20:04:47 +02:00
Sandro Mani 8f023a2f66
bpo-40854: Allow overriding sys.platlibdir via PYTHONPLATLIBDIR env-var (GH-20605) 2020-06-08 17:28:11 +02:00
Zackery Spytz c8966667bb
bpo-40831: Remove an incorrect statement in the Windows docs (GH-20570) 2020-06-01 16:43:56 +01:00
Miro Hrončok ef16958d17
bpo-38972: Fix typos in PowerShell Execution Policies links (GH-20383) 2020-05-25 16:54:14 +02:00
Andre Delfino 7864f11cdf
[doc] Remove references to obsolete BuildApplet on macOS. (GH-20023) 2020-05-21 18:45:23 -04:00
Victor Stinner 1def7754b7
bpo-40334: Rename PyConfig.use_peg to _use_peg_parser (GH-19670)
* Rename PyConfig.use_peg to _use_peg_parser
* Document PyConfig._use_peg_parser and mark it a deprecated
* Mark -X oldparser option and PYTHONOLDPARSER env var as deprecated
  in the documentation.
* Add use_old_parser() and skip_if_new_parser() to test.support
* Remove sys.flags.use_peg: use_old_parser() uses
  _testinternalcapi.get_configs() instead.
* Enhance test_embed tests
* subprocess._args_from_interpreter_flags() copies -X oldparser
2020-04-23 03:03:24 +02:00
Pablo Galindo c5fc156852
bpo-40334: PEP 617 implementation: New PEG parser for CPython (GH-19503)
Co-authored-by: Guido van Rossum <guido@python.org>
Co-authored-by: Lysandros Nikolaou <lisandrosnik@gmail.com>
2020-04-22 23:29:27 +01:00
Derek Keeler 45217af29c
bpo-38972: Link to instructions to change PowerShell execution policy (GH-19131) 2020-04-02 12:00:21 -07:00
Julin S c580981ba0
fix typo: add space (GH-18853)
Fix typo in cmdline.rst
Add space between the `-m` option and the module name (`timeit`).
2020-03-08 10:52:15 -07:00
Victor Stinner c6e5c1123b
bpo-39489: Remove COUNT_ALLOCS special build (GH-18259)
Remove:

* COUNT_ALLOCS macro
* sys.getcounts() function
* SHOW_ALLOC_COUNT code in listobject.c
* SHOW_TRACK_COUNT code in tupleobject.c
* PyConfig.show_alloc_count field
* -X showalloccount command line option
* @test.support.requires_type_collecting decorator
2020-02-03 15:17:15 +01:00
Inada Naoki 148610d88a
bpo-39287: Doc: Add UTF-8 mode section in using/windows. (GH-17935)
Co-Authored-By: Kyle Stanley <aeros167@gmail.com>
2020-01-28 19:12:31 +09:00
Victor Stinner b9783d2e03
bpo-39429: Add a new "Python Development Mode" doc page (GH-18132) 2020-01-24 10:22:18 +01:00
Brett Cannon 84b1ff6560 bpo-38899: virtual environment activation for fish should use `source` (GH-17359)
The previously documented use of `.` is considered deprecated (https://fishshell.com/docs/current/commands.html#source).


https://bugs.python.org/issue38899



Automerge-Triggered-By: @brettcannon
2019-11-22 23:32:27 -08:00
Jules Lasne (jlasne) 0fe0b88d6e Updated missing periods in cmdline.rst (GH-17173) 2019-11-15 23:18:17 +01:00
Steve Dower 4d202281c1
bpo-38133: Update docs to reflect fixes to py.exe launcher (GH-16791) 2019-10-14 15:45:43 -07:00
Xtreak bdd6945d4d bpo-33095: Add reference to isolated mode in -m and script option (GH-7764)
Attempt to make isolated mode easier to discover via additional inline documentation.

Co-Authored-By: Julien Palard <julien@palard.fr>
2019-09-14 10:35:44 +10:00
Serhiy Storchaka e9c90aa431
bpo-29535: Remove promize about hash randomization of datetime objects. (GH-15269) 2019-08-24 12:49:27 +03:00
Steve Dower cf9360e524
Remove 'unstable' warning for Windows Store package in docs (GH-15334) 2019-08-19 10:07:25 -07:00
Derek Keeler 91e4957509 bpo-32910: Remove implementation detail in venv documentation. (GH-14968) 2019-07-26 14:57:11 -07:00
Steve Dower 9d9893a1c8
bpo-35524: Update Windows installer image in docs (GH-14966) 2019-07-26 13:03:58 -07:00
aldwinaldwin 8f040b7a9f bpo-37610: improve Using Python doc wrt Editors & IDE (GH-14850)
Move the Editors and IDE section out of the Unix section, to its own section.


https://bugs.python.org/issue37610
2019-07-18 18:23:17 -07:00
Steve Dower e226e83d36
bpo-37363: Add audit events on startup for the run commands (GH-14524) 2019-07-01 16:03:53 -07:00
Brett Cannon f9f8e3ce70
bpo-37403: Touch up venv docs (GH-14458)
Add a versionadded for PS Core and note that `.venv` is a common virtual environment name.
2019-06-28 12:14:31 -07:00
Steve Dower 7a177c08ab
Improve Windows commands in tutorial (GH-14379) 2019-06-26 08:55:57 -07:00
Victor Stinner 22eb689cf3
bpo-37388: Development mode check encoding and errors (GH-14341)
In development mode and in debug build, encoding and errors arguments
are now checked on string encoding and decoding operations. Examples:
open(), str.encode() and bytes.decode().

By default, for best performances, the errors argument is only
checked at the first encoding/decoding error, and the encoding
argument is sometimes ignored for empty strings.
2019-06-26 00:51:05 +02:00
Cooper Lees 4acdbf11b1 bpo-34556: Add --upgrade-deps to venv module (#13100)
Add --upgrade-deps to venv module
- This allows for pip + setuptools to be automatically upgraded to the latest version on PyPI
- Update documentation to represent this change

bpo-34556: Add --upgrade to venv module
2019-06-17 19:18:13 +01:00
Makdon 905e19a9bf bpo-37216: update version to 3.9 in mac using document (GH-13966) 2019-06-13 01:04:13 -04:00
Xtreak 0d70227e41 Fix typos in docs and docstrings (GH-13745) 2019-06-03 01:12:33 +02:00