Imported Debian patch 1.3-3

4 files changed, 37 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 17e59e1..2ac55dd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+python-urllib3 (1.3-3) unstable; urgency=low
+
+  * debian/control
+    - Added ca-certificates to Recommends field
+  * debian/patches/02_require-cert-verification.patch
+    - require SSL certificate validation by default by using
+      CERT_REQUIRED and using the system
+      /etc/ssl/certs/ca-certificates.crt.
+      Thanks to Jamie Strandboge for report and patch
+      (Closes: #686872)
+
+ -- Daniele Tricoli <eriol@mornie.org>  Mon, 10 Sep 2012 14:33:35 +0200
+
 python-urllib3 (1.3-2) unstable; urgency=low
 
   * debian/control
diff --git a/debian/control b/debian/control
index fc30005..2e522c7 100644
--- a/debian/control
+++ b/debian/control
@@ -25,6 +25,8 @@ Depends:
  ${misc:Depends},
  ${python:Depends},
  python-six
+Recommends:
+ ca-certificates
 Description: HTTP library with thread-safe connection pooling for Python
  urllib3 supports features left out of urllib and urllib2 libraries.
  .
@@ -44,6 +46,8 @@ Depends:
  ${misc:Depends},
  ${python3:Depends},
  python3-six
+Recommends:
+ ca-certificates
 Description: HTTP library with thread-safe connection pooling for Python3
  urllib3 supports features left out of urllib and urllib2 libraries.
  .
diff --git a/debian/patches/02_require-cert-verification.patch b/debian/patches/02_require-cert-verification.patch
new file mode 100644
index 0000000..b4decd9
--- /dev/null
+++ b/debian/patches/02_require-cert-verification.patch
@@ -0,0 +1,19 @@
+Author: Jamie Strandboge <jamie@canonical.com>
+Description: require SSL certificate validation by default by using
+ CERT_REQUIRED and using the system /etc/ssl/certs/ca-certificates.crt
+Bug-Ubuntu: https://launchpad.net/bugs/1047054
+Bug-Debian: http://bugs.debian.org/686872
+
+Index: python-urllib3-1.3/urllib3/connectionpool.py
+===================================================================
+--- python-urllib3-1.3.orig/urllib3/connectionpool.py	2012-09-06 16:03:50.000000000 -0500
++++ python-urllib3-1.3/urllib3/connectionpool.py	2012-09-06 16:08:59.000000000 -0500
+@@ -463,7 +463,7 @@
+                  strict=False, timeout=None, maxsize=1,
+                  block=False, headers=None,
+                  key_file=None, cert_file=None,
+-                 cert_reqs='CERT_NONE', ca_certs=None):
++                 cert_reqs='CERT_REQUIRED', ca_certs='/etc/ssl/certs/ca-certificates.crt'):
+
+         super(HTTPSConnectionPool, self).__init__(host, port,
+                                                   strict, timeout, maxsize,
diff --git a/debian/patches/series b/debian/patches/series
index 64de581..cb492ff 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 01_do-not-use-embedded-python-six.patch
+02_require-cert-verification.patch