First of all, thanks for the hard work all the maintainers have put into this package!
I'd like the maintainers to reconsider a change that went in v0.48.0, namely #415.
I work on the slackclient python package, which depends on this package. Since 0.48.0 has shipped, a few of our users have run into SSL problems that originate from this package.
I understand that the issue with shipping a CA bundle from this package is that its likely to go stale, and nobody wants to maintain that. I believe the solution that requests uses for this problem is rather elegant. They simply depend on the certifi package, which has an aggregated community of maintainers to keep it up to date.
I propose that this package also take the same approach. If you all are in favor of this, I can contribute a PR ❤️.
There's two problems I think this will solve:
-
A non-zero number of systems are not configured correctly to offer a CA bundle from a location on disk. This has happened to at least two of the users of our package, but I'm sure there's many more. Being resilient to system configuration issues seems like a win.
-
The current approach is untested for Python 2. While we'd all like to move beyond these versions, I don't think its in anyone's best interest to needlessly leave these developers, apps, and companies behind.
Thanks again!
First of all, thanks for the hard work all the maintainers have put into this package!
I'd like the maintainers to reconsider a change that went in v0.48.0, namely #415.
I work on the
slackclientpython package, which depends on this package. Since 0.48.0 has shipped, a few of our users have run into SSL problems that originate from this package.I understand that the issue with shipping a CA bundle from this package is that its likely to go stale, and nobody wants to maintain that. I believe the solution that
requestsuses for this problem is rather elegant. They simply depend on the certifi package, which has an aggregated community of maintainers to keep it up to date.I propose that this package also take the same approach. If you all are in favor of this, I can contribute a PR ❤️.
There's two problems I think this will solve:
A non-zero number of systems are not configured correctly to offer a CA bundle from a location on disk. This has happened to at least two of the users of our package, but I'm sure there's many more. Being resilient to system configuration issues seems like a win.
The current approach is untested for Python 2. While we'd all like to move beyond these versions, I don't think its in anyone's best interest to needlessly leave these developers, apps, and companies behind.
Thanks again!