Refresh ssl.py and test_ssl.py through update_lib from CPython d220409a13b77de7a6c30abe16ea90db01528edc without local test changes. Implement rustls cipher-suite, group and signature policy, negotiated-group reporting, EOF and session-policy behavior.
Keep OpenSSL and wasm API imports compatible, with genuine version-gated queries and honest unsupported capabilities. Repair OpenSSL callback ownership and traversal, callback exceptions, EOF and shutdown, PHA, session destruction, and system-error decoding exposed by canonical coverage. Preserve existing I/O locking; the inherited optional-backend full-duplex hang remains a separate driver prerequisite.
Assisted-by: OpenAI Codex:model version unavailable
* ssl: fire msg callbacks and compute tls-unique
Observe TLS records to invoke _msg_callback, and derive TLS 1.2
tls-unique from the KeyLog master secret plus rustls PRF.
Restore CHANNEL_BINDING_TYPES and drop the remaining test_ssl
RUSTPYTHON skips.
Assisted-by: Claude
* lzma: build the xz-core engine on wasm32
Expose `_lzma` on wasm32 and Android by compiling the xz-core
engine on those targets instead of gating it out.
Assisted-by: Claude
* ssl: move the rustls engine into rustpython-common
Extract the VM-independent rustls helpers (MemoryBio, certificate
decode, cipher strings, OID table, chain builder, providers, and
TLS record observation) so stdlib _ssl wraps a shared engine.
Assisted-by: Claude
* ssl: keep the rustls engine in host_env
TLS helpers share the host trust store and default verify paths, so
they belong next to native_certs rather than in rustpython-common.
Assisted-by: Claude
* stdlib: drop unused jiff after moving cert decode
Assisted-by: Claude
* ssl: accept ClientHello before selecting the SNI context
Replace the provisional server connection and replay flags with explicit handshake states. Retain fatal alerts across nonblocking retries and preserve fragmented input on timeout. Enable the three SNI alert regressions.
Assisted-by: Codex:GPT-5
* ssl: share socket and MemoryBIO transport progress
Queue drained TLS records before fallible output and use one handshake record loop for both transports.
Assisted-by: Codex:GPT-5
* ssl: unify shutdown and fatal alert lifecycle
Track close-notify progress in TlsState, preserve pending alerts across retries, and share record-boundary shutdown for sockets and MemoryBIO. Retain rustls errors until Python exception conversion.
Assisted-by: Codex:GPT-5
* ssl: emit the full peer certificate dict
Use the same certificate dict helper for getpeercert() and
Certificate.get_info() so OCSP, caIssuers, and CRL URLs are present.
Clear CHANNEL_BINDING_TYPES on the rustls backend, and add a MemoryBIO
leftover-plaintext snippet.
Assisted-by: Claude
youknowdot