Merged revisions 57778-58052 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r57820 | georg.brandl | 2007-08-31 08:59:27 +0200 (Fri, 31 Aug 2007) | 2 lines

  Document new shorthand notation for index entries.
........
  r57827 | georg.brandl | 2007-08-31 10:47:51 +0200 (Fri, 31 Aug 2007) | 2 lines

  Fix subitem markup.
........
  r57833 | martin.v.loewis | 2007-08-31 12:01:07 +0200 (Fri, 31 Aug 2007) | 1 line

  Mark registry components as 64-bit on Win64.
........
  r57854 | bill.janssen | 2007-08-31 21:02:23 +0200 (Fri, 31 Aug 2007) | 1 line

  deprecate use of FakeSocket
........
  r57855 | bill.janssen | 2007-08-31 21:02:46 +0200 (Fri, 31 Aug 2007) | 1 line

  remove mentions of socket.ssl in comments
........
  r57856 | bill.janssen | 2007-08-31 21:03:31 +0200 (Fri, 31 Aug 2007) | 1 line

  remove use of non-existent SSLFakeSocket in apparently untested code
........
  r57859 | martin.v.loewis | 2007-09-01 08:36:03 +0200 (Sat, 01 Sep 2007) | 3 lines

  Bug #1737210: Change Manufacturer of Windows installer to PSF.
  Will backport to 2.5.
........
  r57865 | georg.brandl | 2007-09-01 09:51:24 +0200 (Sat, 01 Sep 2007) | 2 lines

  Fix RST link (backport from Py3k).
........
  r57876 | georg.brandl | 2007-09-01 17:49:49 +0200 (Sat, 01 Sep 2007) | 2 lines

  Document sets' ">" and "<" operations (backport from py3k).
........
  r57878 | skip.montanaro | 2007-09-01 19:40:03 +0200 (Sat, 01 Sep 2007) | 4 lines

  Added a note and examples to explain that re.split does not split on an
  empty pattern match. (issue 852532).
........
  r57879 | walter.doerwald | 2007-09-01 20:18:09 +0200 (Sat, 01 Sep 2007) | 2 lines

  Fix wrong function names.
........
  r57880 | walter.doerwald | 2007-09-01 20:34:05 +0200 (Sat, 01 Sep 2007) | 2 lines

  Fix typo.
........
  r57889 | andrew.kuchling | 2007-09-01 22:31:59 +0200 (Sat, 01 Sep 2007) | 1 line

  Markup fix
........
  r57892 | andrew.kuchling | 2007-09-01 22:43:36 +0200 (Sat, 01 Sep 2007) | 1 line

  Add various items
........
  r57895 | andrew.kuchling | 2007-09-01 23:17:58 +0200 (Sat, 01 Sep 2007) | 1 line

  Wording change
........
  r57896 | andrew.kuchling | 2007-09-01 23:18:31 +0200 (Sat, 01 Sep 2007) | 1 line

  Add more items
........
  r57904 | ronald.oussoren | 2007-09-02 11:46:07 +0200 (Sun, 02 Sep 2007) | 3 lines

  Macosx: this patch ensures that the value of MACOSX_DEPLOYMENT_TARGET used
  by the Makefile is also used at configure-time.
........
  r57925 | georg.brandl | 2007-09-03 09:16:46 +0200 (Mon, 03 Sep 2007) | 2 lines

  Fix #883466: don't allow Unicode as arguments to quopri and uu codecs.
........
  r57936 | matthias.klose | 2007-09-04 01:33:04 +0200 (Tue, 04 Sep 2007) | 2 lines

  - Added support for linking the bsddb module against BerkeleyDB 4.6.x.
........
  r57954 | mark.summerfield | 2007-09-04 10:16:15 +0200 (Tue, 04 Sep 2007) | 3 lines

  Added cross-references plus a note about dict & list shallow copying.
........
  r57958 | martin.v.loewis | 2007-09-04 11:51:57 +0200 (Tue, 04 Sep 2007) | 3 lines

  Document that we rely on the OS to release the crypto
  context. Fixes #1626801.
........
  r57960 | martin.v.loewis | 2007-09-04 15:13:14 +0200 (Tue, 04 Sep 2007) | 3 lines

  Patch #1388440: Add set_completion_display_matches_hook and
  get_completion_type to readline.
........
  r57961 | martin.v.loewis | 2007-09-04 16:19:28 +0200 (Tue, 04 Sep 2007) | 3 lines

  Patch #1031213: Decode source line in SyntaxErrors back to its original
  source encoding. Will backport to 2.5.
........
  r57972 | matthias.klose | 2007-09-04 20:17:36 +0200 (Tue, 04 Sep 2007) | 3 lines

  - Makefile.pre.in(buildbottest): Run an optional script pybuildbot.identify
    to include some information about the build environment.
........
  r57973 | matthias.klose | 2007-09-04 21:05:38 +0200 (Tue, 04 Sep 2007) | 2 lines

  - Makefile.pre.in(buildbottest): Remove whitespace at eol.
........
  r57975 | matthias.klose | 2007-09-04 22:46:02 +0200 (Tue, 04 Sep 2007) | 2 lines

  - Fix libffi configure for hppa*-*-linux* | parisc*-*-linux*.
........
  r57980 | bill.janssen | 2007-09-05 02:46:27 +0200 (Wed, 05 Sep 2007) | 1 line

  SSL certificate distinguished names should be represented by tuples
........
  r57985 | martin.v.loewis | 2007-09-05 08:39:17 +0200 (Wed, 05 Sep 2007) | 3 lines

  Patch #1105: Explain that one needs to build the solution
  to get dependencies right.
........
  r57987 | armin.rigo | 2007-09-05 09:51:21 +0200 (Wed, 05 Sep 2007) | 4 lines

  PyDict_GetItem() returns a borrowed reference.
  There are probably a number of places that are open to attacks
  such as the following one, in bltinmodule.c:min_max().
........
  r57991 | martin.v.loewis | 2007-09-05 13:47:34 +0200 (Wed, 05 Sep 2007) | 3 lines

  Patch #786737: Allow building in a tree of symlinks pointing to
  a readonly source.
........
  r57993 | georg.brandl | 2007-09-05 15:36:44 +0200 (Wed, 05 Sep 2007) | 2 lines

  Backport from Py3k: Bug #1684991: explain lookup semantics for __special__ methods (new-style classes only).
........
  r58004 | armin.rigo | 2007-09-06 10:30:51 +0200 (Thu, 06 Sep 2007) | 4 lines

  Patch #1733973 by peaker:
  ptrace_enter_call() assumes no exception is currently set.
  This assumption is broken when throwing into a generator.
........
  r58006 | armin.rigo | 2007-09-06 11:30:38 +0200 (Thu, 06 Sep 2007) | 4 lines

  PyDict_GetItem() returns a borrowed reference.
  This attack is against ceval.c:IMPORT_NAME, which calls an
  object (__builtin__.__import__) without holding a reference to it.
........
  r58013 | georg.brandl | 2007-09-06 16:49:56 +0200 (Thu, 06 Sep 2007) | 2 lines

  Backport from 3k: #1116: fix reference to old filename.
........
  r58021 | thomas.heller | 2007-09-06 22:26:20 +0200 (Thu, 06 Sep 2007) | 1 line

  Fix typo:  c_float represents to C float type.
........
  r58022 | skip.montanaro | 2007-09-07 00:29:06 +0200 (Fri, 07 Sep 2007) | 3 lines

  If this is correct for py3k branch and it's already in the release25-maint
  branch, seems like it ought to be on the trunk as well.
........
  r58023 | gregory.p.smith | 2007-09-07 00:59:59 +0200 (Fri, 07 Sep 2007) | 4 lines

  Apply the fix from Issue1112 to make this test more robust and keep
  windows happy.
........
  r58031 | brett.cannon | 2007-09-07 05:17:50 +0200 (Fri, 07 Sep 2007) | 4 lines

  Make uuid1 and uuid4 tests conditional on whether ctypes can be imported;
  implementation of either function depends on ctypes but uuid as a whole does
  not.
........
  r58032 | brett.cannon | 2007-09-07 06:18:30 +0200 (Fri, 07 Sep 2007) | 6 lines

  Fix a crasher where Python code managed to infinitely recurse in C code without
  ever going back out to Python code in PyObject_Call().  Required introducing a
  static RuntimeError instance so that normalizing an exception there is no
  reliance on a recursive call that would put the exception system over the
  recursion check itself.
........
  r58034 | thomas.heller | 2007-09-07 08:32:17 +0200 (Fri, 07 Sep 2007) | 1 line

  Add a 'c_longdouble' type to the ctypes module.
........
  r58035 | thomas.heller | 2007-09-07 11:30:40 +0200 (Fri, 07 Sep 2007) | 1 line

  Remove unneeded #include.
........
  r58036 | thomas.heller | 2007-09-07 11:33:24 +0200 (Fri, 07 Sep 2007) | 6 lines

  Backport from py3k branch:

  Add a workaround for a strange bug on win64, when _ctypes is compiled
  with the SDK compiler.  This should fix the failing
  Lib\ctypes\test\test_as_parameter.py test.
........
  r58037 | georg.brandl | 2007-09-07 16:14:40 +0200 (Fri, 07 Sep 2007) | 2 lines

  Fix a wrong indentation for sublists.
........
  r58043 | georg.brandl | 2007-09-07 22:10:49 +0200 (Fri, 07 Sep 2007) | 2 lines

  #1095: ln -f doesn't work portably, fix in Makefile.
........
  r58049 | skip.montanaro | 2007-09-08 02:34:17 +0200 (Sat, 08 Sep 2007) | 1 line

  be explicit about the actual location of the missing file
........

1 files changed, 45 insertions, 36 deletions

diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 5072caf..852a905 100644
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -170,6 +170,8 @@ use the first chain it finds in the file which matches.
 Some "standard" root certificates are available at
 http://www.thawte.com/roots/  (for Thawte roots) and
 http://www.verisign.com/support/roots.html  (for Verisign roots).
+See also :rfc:`4158` for more discussion of the way in which 
+certification chains can be built.
 
 
 sslsocket Objects
@@ -239,23 +241,23 @@ sslsocket Objects
    the certificate), ``notBefore`` (the time before which the certificate should not be trusted),
    and ``notAfter`` (the time after which the certificate should not be trusted) filled in.
 
-   The "subject" and "issuer" fields are themselves dictionaries containing the fields given
-   in the certificate's data structure for each principal::
-
-      {'issuer': {'commonName': u'somemachine.python.org',
-                  'countryName': u'US',
-                  'localityName': u'Wilmington',
-                  'organizationName': u'Python Software Foundation',
-                  'organizationalUnitName': u'SSL',
-                  'stateOrProvinceName': u'Delaware'},
-       'subject': {'commonName': u'somemachine.python.org',
-                   'countryName': u'US',
-                   'localityName': u'Wilmington',
-                   'organizationName': u'Python Software Foundation',
-                   'organizationalUnitName': u'SSL',
-                   'stateOrProvinceName': u'Delaware'},
-       'notAfter': 'Sep  4 21:54:26 2007 GMT',
-       'notBefore': 'Aug 25 21:54:26 2007 GMT',
+   The "subject" and "issuer" fields are tuples containing the name-value fields
+   given in the certificate's data structure for each principal::
+
+      {'issuer': (('countryName', u'US'),
+                  ('stateOrProvinceName', u'Delaware'),
+                  ('localityName', u'Wilmington'),
+                  ('organizationName', u'Python Software Foundation'),
+                  ('organizationalUnitName', u'SSL'),
+                  ('commonName', u'somemachine.python.org')),
+       'notAfter': 'Feb 16 16:54:50 2013 GMT',
+       'notBefore': 'Aug 27 16:54:50 2007 GMT',
+       'subject': (('countryName', u'US'),
+                   ('stateOrProvinceName', u'Delaware'),
+                   ('localityName', u'Wilmington'),
+                   ('organizationName', u'Python Software Foundation'),
+                   ('organizationalUnitName', u'SSL'),
+                   ('commonName', u'somemachine.python.org')),
        'version': 2}
 
    This certificate is said to be *self-signed*, because the subject
@@ -311,27 +313,32 @@ sends some bytes, and reads part of the response::
    # note that closing the sslsocket will also close the underlying socket
    ssl_sock.close()
 
-As of August 25, 2007, the certificate printed by this program
+As of September 4, 2007, the certificate printed by this program
 looked like this::
 
-   {'issuer': {'commonName': u'VeriSign Class 3 Extended Validation SSL SGC CA',
-               'countryName': u'US',
-               'organizationName': u'VeriSign, Inc.',
-               'organizationalUnitName': u'Terms of use at https://www.verisign.com/rpa (c)06'},
-    'subject': {'1.3.6.1.4.1.311.60.2.1.2': u'Delaware',
-                '1.3.6.1.4.1.311.60.2.1.3': u'US',
-                'commonName': u'www.verisign.com',
-                'countryName': u'US',
-                'localityName': u'Mountain View',
-                'organizationName': u'VeriSign, Inc.',
-                'organizationalUnitName': u'Terms of use at www.verisign.com/rpa (c)06',
-                'postalCode': u'94043',
-                'serialNumber': u'2497886',
-                'stateOrProvinceName': u'California',
-                'streetAddress': u'487 East Middlefield Road'},
-    'notAfter': 'May  8 23:59:59 2009 GMT',
-    'notBefore': 'May  9 00:00:00 2007 GMT',
-    'version': 2}
+  {'issuer': (('countryName', u'US'),
+              ('organizationName', u'VeriSign, Inc.'),
+              ('organizationalUnitName', u'VeriSign Trust Network'),
+              ('organizationalUnitName',
+               u'Terms of use at https://www.verisign.com/rpa (c)06'),
+              ('commonName',
+               u'VeriSign Class 3 Extended Validation SSL SGC CA')),
+   'notAfter': 'May  8 23:59:59 2009 GMT',
+   'notBefore': 'May  9 00:00:00 2007 GMT',
+   'subject': (('serialNumber', u'2497886'),
+               ('1.3.6.1.4.1.311.60.2.1.3', u'US'),
+               ('1.3.6.1.4.1.311.60.2.1.2', u'Delaware'),
+               ('countryName', u'US'),
+               ('postalCode', u'94043'),
+               ('stateOrProvinceName', u'California'),
+               ('localityName', u'Mountain View'),
+               ('streetAddress', u'487 East Middlefield Road'),
+               ('organizationName', u'VeriSign, Inc.'),
+               ('organizationalUnitName', u'Production Security Services'),
+               ('organizationalUnitName',
+                u'Terms of use at www.verisign.com/rpa (c)06'),
+               ('commonName', u'www.verisign.com')),
+   'version': 2}
 
 Server-side operation
 ^^^^^^^^^^^^^^^^^^^^^
@@ -383,3 +390,5 @@ Class :class:`socket.socket`
 `Introducing SSL and Certificates using OpenSSL <http://old.pseudonym.org/ssl/wwwj-index.html>`_, by Frederick J. Hirsch
 
 `Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management`, :rfc:`1422`, by Steve Kent
+
+`Internet X.509 Public Key Infrastructure Certificate and CRL Profile`, :rfc:`3280`, Housley et. al.