delta/cpython-git.git, branch v2.7.16rc1

Set version to 2.7.16rc1.

2019-02-16T19:02:20+00:00

Collect 2.7.16rc1 release notes.

2019-02-16T19:01:44+00:00

Update IDLE.app plist copyright date. (GH-11890)

2019-02-16T07:03:48+00:00

[2.7] bpo-33570: Enable OpenSSL 1.1.1 testing within the multissltests (GH-11879)

2019-02-15T18:01:27+00:00

multissltests: fix _build_src(), add 'cwd' variable.

[2.7] bpo-32947: Fixes for TLS 1.3 and OpenSSL 1.1.1 (GH-8761) (GH-11876)

2019-02-15T17:27:44+00:00

Backport of TLS 1.3 related fixes from 3.7.

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1 from git
master and TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options

Signed-off-by: Christian Heimes 
(cherry picked from commit 2a4ee8aa01d61b6a9c8e9c65c211e61bdb471826)

Fixup from test_ssl test_default_ecdh_curve (GH-11877)

2019-02-15T16:18:58+00:00

Partial backport from cb5b68abdeb1b1d56c581d5b4d647018703d61e3

Co-authored-by: Christian Heimes

[2.7] bpo-28043: improved default settings for SSLContext (GH-10608)

2019-02-15T14:24:11+00:00

The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE,
OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2 (except
for PROTOCOL_SSLv2), and OP_NO_SSLv3 (except for PROTOCOL_SSLv3)
are set by default. The initial cipher suite list contains only
HIGH ciphers, no NULL ciphers and MD5 ciphers (except for PROTOCOL_SSLv2).

(cherry picked from commit 358cfd426ccc0fcd6a7940d306602138e76420ae)

[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) (GH-8760) (GH-10607)

2019-02-15T13:17:12+00:00

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes .
(cherry picked from commit 3e630c541b35c96bfe5619165255e559f577ee71)
Co-authored-by: Christian Heimes

bpo-35746: Credit Colin Read and Nicolas Edet (GH-11866)

2019-02-15T11:34:17+00:00

Add credit for the cert parser vulnerability. Mention also Cisco
TALOS-2018-0758 identifier.

Doc sidebar: 3.6 has moved to security-fix mode. (GH-11810)

2019-02-10T21:43:52+00:00

(cherry picked from commit 9db56fb8faaa3cd66e7fe82740a4ae4d786bb27f)

Co-authored-by: Julien Palard