spesmilo / electrum / 5007988488929280

61%

master: 63%

Build Type

push

CirrusCI

Committed by SomberNight

Commit Message

interface: disable ssl.VERIFY_X509_STRICT for self-signed certs

The "ssl.VERIFY_X509_STRICT" flag for openssl verification has been enabled by default in python 3.13+ (it was disabled before that).
see https://github.com/python/cpython/issues/107361
and https://discuss.python.org/t/ssl-changing-the-default-sslcontext-verify-flags/30230/16

We explicitly disable it for self-signed certs, thereby restoring the pre-3.13 defaults,
as it seems to break lots of servers.

For example, using python 3.13 (or setting `sslc.verify_flags |= ssl.VERIFY_X509_STRICT`),
- I can connect to `btc.electroncash.dk:60002:s`
- but not to `electrum.emzy.de:50002:s`
despite both using self-signed certs.

We should investigate more why exactly "strict" verification fails for some self-signed certs and not for others,
and make sure that at least newly generated certs adhere to the stricter requirements (e.g. update guide in e-x?).

Run Details

0 of 1 new or added line in 1 file covered. (0.0%)

408 existing lines in 19 files now uncovered.

19874 of 32819 relevant lines covered (60.56%)

3.63 hits per line