jaraco/setuptools — pull request #2 by abadger (2013-10-28 17:52:40+00:00)
Title: Feature/ssl match hostname 17997

There's apparently another security issue in the python3 match_hostname code. No CVE has been issued for it yet:

http://bugs.python.org/issue17997#msg194950

Here's a pull request in two commits. The first updates the included match_hostname code to reflect what's in the python-3.3.3 and python-3.4 stdlib (with a minor change to preserve python2 compat). The second commit adds a check for the backports.ssl_match_hostname module from pypi: https://pypi.python.org/pypi/backports.ssl_match_hostname

If the stdlib doesn't have ssl_match_hostname but backports.ssl_match_hostname exists it uses that code. If neither one are present, then it uses the code included in setuptools.

I added the fallback in a second commit because I wasn't certain how you'd feel about that. It certainly helps us out as system packagers and system admins to have a single place to change rather than every package that's copying the match_hostname code. On the other hand, it means that users won't get any fixes before they go into the backports.ssl_match_hostname module. brandon rhodes is the owner of that module and I've done the last several releases to make sure we're current with the match_hostname security issues.