Adding Requests to the standard library [LWN.net]

Adding Requests to the standard library

Posted Apr 23, 2015 8:15 UTC (Thu) by bartavelle (guest, #56596)
Parent article: Adding Requests to the standard library

> To start with, it comes with its own "carefully curated" (and frequently updated) bundle of certificates from certificate authorities (CAs) for SSL/TLS verification, while Python relies on the system CA bundle. Relying on the system certificate bundle would likely reduce the security of the library, he said.

Looks to me like it will be the other way around (it seems unlikely developers will update their dependencies faster than my distribution), and it introduces an extra thing to take care of when you are not using public CAs, or using a mix of public and private ones. At first glance it looks like a terrible idea.

to post comments

Adding Requests to the standard library

Posted Apr 23, 2015 22:08 UTC (Thu) by debacle (subscriber, #7114) [Link] (3 responses)

I occasionally add self-signed or otherwise trusted certificates (i.e. I have more trust in them than in any others) to the system by copying them to /usr/local/share/ca-certificates and sudoing update-ca-certificates. Would requests need an additional step?

Adding Requests to the standard library

Posted Apr 27, 2015 6:18 UTC (Mon) by bernat (subscriber, #51658) [Link] (2 responses)

The documentation about that is here: http://docs.python-requests.org/en/latest/user/advanced/#...

Adding Requests to the standard library

Posted Apr 27, 2015 8:55 UTC (Mon) by debacle (subscriber, #7114) [Link] (1 responses)

Thanks for the link. I tried requests.get() with Debian Jessie. python3-requests works correctly without need for any special steps. update-ca-certificates just works.

Adding Requests to the standard library

Posted May 1, 2015 12:53 UTC (Fri) by mgedmin (guest, #34497) [Link]

I believe Debian unbundles all of Requests' bundled dependencies (like urllib3) and makes it work with system libraries. This includes the CA certificates.