Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.mixmin.net!newsreader4.netcologne.de!news.netcologne.de!novso.com!newsfeed.xs4all.nl!newsfeed4a.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path: <python-python-list@m.gmane.org>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.013
X-Spam-Evidence: '*H*': 0.97; '*S*': 0.00; 'subject:error': 0.03; 'anyway.': 0.05; 'dynamically': 0.07; 'pypi': 0.07; 'library?': 0.09; 'received:80.91': 0.09; 'received:80.91.229': 0.09; 'received:gmane.org': 0.09; 'received:list': 0.09; 'security.': 0.09; 'python': 0.11; 'libraries.': 0.16; 'rebuild': 0.16; 'received:80.91.229.3': 0.16; 'received:plane.gmane.org': 0.16; 'url:ftp': 0.16; 'usage,': 0.16; 'subject:python': 0.16; 'wrote:': 0.18; 'example': 0.22; 'install': 0.23; 'header:User-Agent:1': 0.23; 'paul': 0.24; 'versions': 0.24; 'file.': 0.24; '(or': 0.24; "i've": 0.25; 'extension': 0.26; 'downloaded': 0.26; 'header:X -Complaints-To:1': 0.27; 'idea': 0.28; 'thus': 0.29; "doesn't": 0.30; 'newer': 0.30; "i'm": 0.30; 'reduced': 0.31; 'sep': 0.31; 'workaround': 0.31; 'python.org': 0.32; 'option': 0.32; 'another': 0.32; 'url:python': 0.33; 'running': 0.33; 'guess': 0.33; 'mac': 0.33; 'updated': 0.34; 'subject:the': 0.34; 'subject:with': 0.35; 'there': 0.35; 'version': 0.36; 'next': 0.36; 'charset:us-ascii': 0.36; 'url:org': 0.36; 'skip:- 20': 0.37; 'expected': 0.38; 'problems': 0.38; 'e.g.': 0.38; 'handle': 0.38; 'to:addr:python- list': 0.38; 'issue': 0.38; 'does': 0.39; 'to:addr:python.org': 0.39; 'unable': 0.39; 'received:org': 0.40; 'release': 0.40; 'skip:u 10': 0.60; 'manually': 0.60; 'tell': 0.60; 'url:5': 0.61; 'new': 0.61; 'browser': 0.61; 'skip:6 10': 0.63; 'skip:n 10': 0.64; 'different': 0.65; 'linked': 0.65; 'latest': 0.67; 'received:204': 0.75; 'article': 0.77; 'bypasses': 0.84; 'installer': 0.84; 'itself?': 0.84; 'python-': 0.84; 'received:204.14': 0.84; 'source?': 0.84
X-Injected-Via-Gmane: http://gmane.org/
To: python-list@python.org
From: Ned Deily <nad@acm.org>
Subject: Re: ssl error with the python mac binary
Date: Mon, 10 Nov 2014 14:51:02 -0800
References: <CACgdh2iG9+cLjj7mZ7qeALQd==pCRknnv8i_EeRj6AHjvg3cRQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Gmane-NNTP-Posting-Host: 204.14.154.216
User-Agent: MT-NewsWatcher/3.5.3b3 (Intel Mac OS X)
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.15642.1415659878.18130.python-list@python.org>
Lines: 41
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1415659878 news.xs4all.nl 2921 [2001:888:2000:d::a6]:51439
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:80496

In article 
<CACgdh2iG9+cLjj7mZ7qeALQd==pCRknnv8i_EeRj6AHjvg3cRQ@mail.gmail.com>,
 Paul Wiseman <poalman@gmail.com> wrote:
> I've been using the latest mac ppc/i386 binaries from python.org
> (https://www.python.org/ftp/python/2.7.8/python-2.7.8-macosx10.5.dmg).
> From what I can tell this version is linked against a pretty old
> version of OpenSSL (OpenSSL 0.9.7l 28 Sep 2006) which doesn't seem to
> be able to handle new sha-256 certificates.
> 
> For example I'm unable to use pip (I guess the certificate was updated 
> recently)

Yes, the current python.org certificate does seem to cause problems for 
that version of OpenSSL, unfortunately.

> Am I right in thinking this is an issue with the build of python
> itself? Is there a way I can upgrade the version of OpenSSL linked
> with python- or force the python build to look elsewhere for the
> library? Or will I have to build my own from source?

In the Pythons from the python.org OS X installers, the Python _ssl and 
_hashlib extension modules are dynamically linked with the 
system-supplied OpenSSL libraries.  If actually running on OS X 10.5, 
one would have to rebuild _ssl.so and _hashlib.so, linking them with a 
locally-supplied version of a newer OpenSSL, since different versions of 
OpenSSL are not ABI-compatible, e.g. 0.9.7 vs 0.9.8 vs 1.0.1.  If 
running on OS X 10.6 or later, another option might be to install from 
the 64-bit/32-bit installer which is a good idea to do anyway.  For pip 
usage, a workaround would be to manually download distributions from 
PyPI (or elsewhere) using a web browser and then use pip to install from 
the downloaded file.   The next version of pip is expected to have a 
--no-check-certificate option that bypasses the certificate check at the 
cost of reduced security.  For the upcoming Python 2.7.9 release 
(planned for early December), I intend to have the Pythons in the 
python.org OS X installers use their own versions of OpenSSL and thus no 
longer depend on the now-deprecated system OpenSSL.

-- 
 Ned Deily,
 nad@acm.org