3.2.4

* Explicitly load default certificates when creating SSL context (#1583)

Requests prior to 2.32.3 always loaded the default (system-wide)
set of trusted certificates into custom SSL contexts. 2.32.3 no
longer does. This has broken a lot of users, but the fix is
moving slowly upstream due to security considerations - see
https://github.com/psf/requests/issues/6730 and
https://github.com/psf/requests/pull/6731 .

As suggested at
https://github.com/psf/requests/pull/6710#issuecomment-2137802782
this can be worked around by explicitly loading the default
certificates into the context. We check the method exists before
calling it just to be safe, it was added in Python 3.4.

Signed-off-by: Adam Williamson <awilliam@redhat.com>

* Drop the upper bound on the requests dependency again

As we can now work with requests 2.32.3+, we no longer need this
pin.

Signed-off-by: Adam Williamson <awilliam@redhat.com>

---------

Signed-off-by: Adam Williamson <awilliam@redhat.com>

.github/workflows/tests.yml

@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: [ubuntu-latest, macos-13, windows-latest]
         python-version:
           - '3.12'
           - '3.11'

CHANGELOG.md

@@ -3,9 +3,13 @@
 This document records all notable changes to [HTTPie](https://httpie.io).
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## [3.2.4](https://github.com/httpie/cli/compare/3.2.3...3.2.4) (2024-11-01)
+
+- Fix default certs loading and unpin `requests`. ([#1596](https://github.com/httpie/cli/issues/1596))
+
 ## [3.2.3](https://github.com/httpie/cli/compare/3.2.2...3.2.3) (2024-07-10)
 
-- Fix SSL connections by pinning the `requests` version to `2.31.0`. ([#1583], [#1581])
+- Fix SSL connections by pinning the `requests` version to `2.31.0`. (#1583, #1581)
 - Make it possible to [unset](https://httpie.io/docs/cli/default-request-headers) the `User-Agent` and `Accept-Encoding` request headers. ([#1502](https://github.com/httpie/cli/issues/1502))
 
 ## [3.2.2](https://github.com/httpie/cli/compare/3.2.1...3.2.2) (2023-05-19)

docs/README.md

@@ -574,7 +574,7 @@ $ http PUT pie.dev/put \
 |                                    HTTP Headers `Name:Value` | Arbitrary HTTP header, e.g. `X-API-Token:123`                                                                                                                                                                          |
 |                                 URL parameters `name==value` | Appends the given name/value pair as a querystring parameter to the URL. The `==` separator is used.                                                                                                                   |
 |                                    Data Fields `field=value` | Request data fields to be serialized as a JSON object (default), to be form-encoded (with `--form, -f`), or to be serialized as `multipart/form-data` (with `--multipart`)                                             |
-|                                Raw JSON fields `field:=json` | Useful when sending JSON and one or more fields need to be a `Boolean`, `Number`, nested `Object`, or an `Array`, e.g., `meals:='["ham","spam"]'` or `pies:=[1,2,3]` (note the quotes)                                 |
+|                                Raw JSON fields `field:=json` | Useful when sending JSON and one or more fields need to be a `Boolean`, `Number`, nested `Object`, or an `Array`, e.g., `meals:='["ham","spam"]'` or `pies:='[1,2,3]'` (note the quotes)                                 |
 | File upload fields `field@/dir/file`, `field@file;type=mime` | Only available with `--form`, `-f` and `--multipart`. For example `screenshot@~/Pictures/img.png`, or `'cv@cv.txt;type=text/markdown'`. With `--form`, the presence of a file field results in a `--multipart` request |
 
 Note that the structured data fields aren’t the only way to specify request data:
@@ -1044,7 +1044,7 @@ $ http POST pie.dev/post < files/data.json
 ```bash
 $ http -f POST pie.dev/post name='John Smith' cv@~/files/data.xml
 ```
-
+
 The request above is the same as if the following HTML form were submitted:
 
 ```html
@@ -2568,7 +2568,7 @@ HTTPie plays exceptionally well with the following tools:
 
 BSD-3-Clause: [LICENSE](https://github.com/httpie/cli/blob/master/LICENSE).
 
-### Authors
+### Authors
 
 [Jakub Roztocil](https://roztocil.co) ([@jakubroztocil](https://twitter.com/jakubroztocil)) created HTTPie and [these fine people](https://github.com/httpie/cli/blob/master/AUTHORS.md) have contributed.
 

extras/httpie-completion.fish

@@ -112,3 +112,10 @@ complete -c http      -l version           -d 'Show version'
 complete -c http      -l traceback         -d 'Prints exception traceback should one occur'
 complete -c http      -l default-scheme -x -d 'The default scheme to use'
 complete -c http      -l debug             -d 'Show debugging output'
+
+
+# Alias for https to http
+
+function https --wraps http
+        http $argv;
+end

extras/man/http.1

@@ -1,5 +1,5 @@
 .\" This file is auto-generated from the parser declaration in httpie/cli/definition.py by extras/scripts/generate_man_pages.py.
-.TH http 1 "2024-07-10" "HTTPie 3.2.3" "HTTPie Manual"
+.TH http 1 "2024-07-10" "HTTPie 3.2.4" "HTTPie Manual"
 .SH NAME
 http
 .SH SYNOPSIS

extras/man/httpie.1

@@ -1,5 +1,5 @@
 .\" This file is auto-generated from the parser declaration in httpie/manager/cli.py by extras/scripts/generate_man_pages.py.
-.TH httpie 1 "2024-07-10" "HTTPie 3.2.3" "HTTPie Manual"
+.TH httpie 1 "2024-07-10" "HTTPie 3.2.4" "HTTPie Manual"
 .SH NAME
 httpie
 .SH SYNOPSIS

extras/man/https.1

@@ -1,5 +1,5 @@
 .\" This file is auto-generated from the parser declaration in httpie/cli/definition.py by extras/scripts/generate_man_pages.py.
-.TH https 1 "2024-07-10" "HTTPie 3.2.3" "HTTPie Manual"
+.TH https 1 "2024-07-10" "HTTPie 3.2.4" "HTTPie Manual"
 .SH NAME
 https
 .SH SYNOPSIS

httpie/__init__.py

@@ -3,7 +3,7 @@ HTTPie: modern, user-friendly command-line HTTP client for the API era.
 
 """
 
-__version__ = '3.2.3'
+__version__ = '3.2.4'
-__date__ = '2024-07-10'
+__date__ = '2024-11-01'
 __author__ = 'Jakub Roztocil'
 __licence__ = 'BSD'

httpie/compat.py

@@ -1,4 +1,5 @@
 import sys
+from ssl import SSLContext
 from typing import Any, Optional, Iterable
 
 from httpie.cookies import HTTPieCookiePolicy
@@ -10,7 +11,6 @@ from http import cookiejar # noqa
 # policy. <https://github.com/psf/requests/issues/5449>
 cookiejar.DefaultCookiePolicy = HTTPieCookiePolicy
 
-
 is_windows = 'win32' in str(sys.platform).lower()
 is_frozen = getattr(sys, 'frozen', False)
 
@@ -66,7 +66,6 @@ except ImportError:
             res = instance.__dict__[self.name] = self.func(instance)
             return res
 
-
 # importlib_metadata was a provisional module, so the APIs changed quite a few times
 # between 3.8-3.10. It was also not included in the standard library until 3.8, so
 # we install the backport for <3.8.
@@ -100,3 +99,15 @@ def get_dist_name(entry_point: importlib_metadata.EntryPoint) -> Optional[str]:
         return None
     else:
         return metadata.get('name')
+
+
+def ensure_default_certs_loaded(ssl_context: SSLContext) -> None:
+    """
+    Workaround for a bug in Requests 2.32.3
+
+    See <https://github.com/httpie/cli/issues/1583>
+
+    """
+    if hasattr(ssl_context, 'load_default_certs'):
+        if not ssl_context.get_ca_certs():
+            ssl_context.load_default_certs()

httpie/ssl_.py

@@ -1,13 +1,15 @@
 import ssl
 from typing import NamedTuple, Optional
 
-from httpie.adapters import HTTPAdapter
 # noinspection PyPackageRequirements
 from urllib3.util.ssl_ import (
     create_urllib3_context,
     resolve_ssl_version,
 )
 
+from .adapters import HTTPAdapter
+from .compat import ensure_default_certs_loaded
+
 
 SSL_VERSION_ARG_MAPPING = {
     'ssl2.3': 'PROTOCOL_SSLv23',
@@ -32,7 +34,7 @@ class HTTPieCertificate(NamedTuple):
     def to_raw_cert(self):
         """Synthesize a requests-compatible (2-item tuple of cert and key file)
         object from HTTPie's internal representation of a certificate."""
-        return (self.cert_file, self.key_file)
+        return self.cert_file, self.key_file
 
 
 class HTTPieHTTPSAdapter(HTTPAdapter):
@@ -71,7 +73,7 @@ class HTTPieHTTPSAdapter(HTTPAdapter):
         ssl_version: str = None,
         ciphers: str = None,
     ) -> 'ssl.SSLContext':
-        return create_urllib3_context(
+        ssl_context = create_urllib3_context(
             ciphers=ciphers,
             ssl_version=resolve_ssl_version(ssl_version),
             # Since we are using a custom SSL context, we need to pass this
@@ -79,6 +81,8 @@ class HTTPieHTTPSAdapter(HTTPAdapter):
             # in `super().cert_verify()`.
             cert_reqs=ssl.CERT_REQUIRED if verify else ssl.CERT_NONE
         )
+        ensure_default_certs_loaded(ssl_context)
+        return ssl_context
 
     @classmethod
     def get_default_ciphers_names(cls):

setup.cfg

@@ -50,7 +50,7 @@ install_requires =
     pip
     charset_normalizer>=2.0.0
     defusedxml>=0.6.0
-    requests[socks] >=2.22.0, <=2.31.0
+    requests[socks] >=2.22.0
     Pygments>=2.5.2
     requests-toolbelt>=0.9.1
     multidict>=4.7.0