fluidattacks-agent 0.1.2__tar.gz → 0.3.0__tar.gz

{fluidattacks_agent-0.1.2 → fluidattacks_agent-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fluidattacks-agent
-Version: 0.1.2
+Version: 0.3.0
 Summary: In-process probe reporting what a Python workload imports and runs
 Project-URL: Homepage, https://fluidattacks.com
 Project-URL: Source, https://gitlab.com/fluidattacks/universe/-/tree/trunk/watches/agents/python
@@ -26,7 +26,7 @@ dependency inventory can say which of its findings are reachable at runtime and
 which are not.
 
 It is a library, not a service. It observes the interpreter it is installed in,
-writes what it saw, and does nothing else. It takes no dependencies: the
+sends what it saw, and does nothing else. It takes no dependencies: the
 standard library only, because it is installed into workloads we do not own.
 
 ## Installing
@@ -60,8 +60,8 @@ a workload's own first-party code produce no records.
 
 ## Where reports go
 
-By default, one file per report under `/tmp/.watches-exec`, for a collector to
-drain. Naming an endpoint sends them instead:
+Naming an endpoint is what makes the probe observe at all. A workload that
+names none starts nothing:
 
 | | |
 |---|---|
@@ -74,10 +74,9 @@ drain. Naming an endpoint sends them instead:
 A file is preferred over a variable because a file can be mode 400, while an
 environment variable is readable by any process of the same user.
 
-An endpoint named without enough beside it to reach is a misconfiguration, not a
-reason to fall back: the probe then holds nothing and counts every report it
-refused, so a half-configured deployment is loud rather than a directory filling
-up where nobody drains it.
+An endpoint named without enough beside it to reach — no credential, or not
+`https://` — is a misconfiguration, and the probe starts nothing rather than
+observe what it could never deliver.
 
 ## What travels, and what does not
 

{fluidattacks_agent-0.1.2 → fluidattacks_agent-0.3.0}/README.md

@@ -5,7 +5,7 @@ dependency inventory can say which of its findings are reachable at runtime and
 which are not.
 
 It is a library, not a service. It observes the interpreter it is installed in,
-writes what it saw, and does nothing else. It takes no dependencies: the
+sends what it saw, and does nothing else. It takes no dependencies: the
 standard library only, because it is installed into workloads we do not own.
 
 ## Installing
@@ -39,8 +39,8 @@ a workload's own first-party code produce no records.
 
 ## Where reports go
 
-By default, one file per report under `/tmp/.watches-exec`, for a collector to
-drain. Naming an endpoint sends them instead:
+Naming an endpoint is what makes the probe observe at all. A workload that
+names none starts nothing:
 
 | | |
 |---|---|
@@ -53,10 +53,9 @@ drain. Naming an endpoint sends them instead:
 A file is preferred over a variable because a file can be mode 400, while an
 environment variable is readable by any process of the same user.
 
-An endpoint named without enough beside it to reach is a misconfiguration, not a
-reason to fall back: the probe then holds nothing and counts every report it
-refused, so a half-configured deployment is loud rather than a directory filling
-up where nobody drains it.
+An endpoint named without enough beside it to reach — no credential, or not
+`https://` — is a misconfiguration, and the probe starts nothing rather than
+observe what it could never deliver.
 
 ## What travels, and what does not
 

{fluidattacks_agent-0.1.2 → fluidattacks_agent-0.3.0}/fluidattacks_agent/deliver.py

@@ -12,18 +12,18 @@ from typing import Final
 from fluidattacks_agent.batch import Batch, Batcher
 from fluidattacks_agent.outbox import Outbox
 from fluidattacks_agent.patience import TOPMOST, fraction, splay, standoff
-from fluidattacks_agent.post import TIMEOUT, Verdict, posted
+from fluidattacks_agent.post import TIMEOUT, Verdict, posted, prepared
 from fluidattacks_agent.settings import Delivery
-from fluidattacks_agent.sink import Stalled
+from fluidattacks_agent.sink import PARTING, Stalled
 
-# how old the centre's picture may be while nothing new is being found
+# how old the centre's picture may be: the period the window is folded on
 INTERVAL: Final = 15.0
 
-# what a workload's own exit may be delayed by while what is held goes out
-PARTING: Final = 2.0
-
 NAME: Final = "fluidattacks-agent"
 
+# before any fold, so the first wait to end folds whatever the probe holds
+NEVER: Final = float("-inf")
+
 
 @dataclass
 class Deliverer:
@@ -46,23 +46,27 @@ class Deliverer:
     guard: threading.Lock = field(default_factory=threading.Lock, repr=False)
     # one pass at a time: what is taken but not delivered lives in one place
     passing: threading.Lock = field(default_factory=threading.Lock, repr=False)
-    # told once a period went by with the far end in reach and nothing left to
-    # carry, so what the probe still holds goes out before it is any older
-    remind: Callable[[], None] = field(default=lambda: None, repr=False)
-    # when the probe was last reminded: a far end that refuses and then takes
-    # ends a wait every standoff, and a wait ending is not a period going by
-    reminded: float = 0.0
+    # what renders the probe's window into reports. Called here, on the
+    # carrier's own thread and clock, so a workload's threads render nothing
+    fold: Callable[[], None] = field(default=lambda: None, repr=False)
+    folded: float = NEVER
     leaving: bool = False
     delivered: int = 0
 
     def write(self, text: str) -> None:
         """Take a report for delivery, or refuse and be counted for it."""
+        # here, inside the fold that made the report, so what a post imports is
+        # imported under the lock a fork waits out and not on the pass after
+        prepared()
         if self.batcher.next(self.told, text, self.outbox.put) is None:
             raise Stalled(errno.ENOSPC, "nothing taken", len(text))
-        self._rouse()
+        # a fold of the carrier's own writes here, and its pass follows in the
+        # same turn: only another thread has a carrier to wake
+        if threading.current_thread() is not self.thread:
+            self.rouse()
 
-    def _rouse(self) -> None:
-        """Say there is something to carry, and find a carrier if there is none."""
+    def rouse(self) -> None:
+        """Start the carrier if there is none, and say there is something for it."""
         with self.guard:
             # a carrier that stopped takes delivery with it, and one is not
             # worth starting for a process already on its way out
@@ -81,23 +85,17 @@ class Deliverer:
         while not self.leaving:
             # a thread that dies takes delivery with it and tells nobody
             with contextlib.suppress(Exception):
-                roused = self.woken.wait(self._waiting())
+                self.woken.wait(self._waiting())
                 self.woken.clear()
-                if time.monotonic() < self.due:
+                now = time.monotonic()
+                if now < self.due:
                     continue
+                # on this clock and no other: a far end refusing and then taking
+                # ends a wait every standoff, and a wait ending is not a period
+                if now - self.folded >= self.interval:
+                    self.folded = now
+                    self.fold()
                 self.offering()
-                # a period, never a wake: a wake says there is something to
-                # carry, and asking for more on one made each flush bring the
-                # next. Nothing in hand, or the far end is still refusing
-                now = time.monotonic()
-                if (
-                    not roused
-                    and self.holding is None
-                    and not self.leaving
-                    and now - self.reminded >= self.interval
-                ):
-                    self.reminded = now
-                    self.remind()
 
     def parting(self) -> None:
         """Give whatever is held one bounded chance to travel, then give up."""
@@ -128,11 +126,15 @@ class Deliverer:
         # every worker of a pre-forking server was born in the same second
         self.due = 0.0
         self.tries = 0
-        self.reminded = 0.0
+        self.folded = NEVER
         # a child is not on its way out merely because its parent was
         self.leaving = False
         self.batcher.forked()
         self.outbox.forked()
+        # the clock is this thread's, and the child has none until it is
+        # started again. Safe here because threading's own fork handler, which
+        # registered first, has already run
+        self.rouse()
 
     def registered(self) -> None:
         """Ask the interpreter to say when this process has become two."""
@@ -173,6 +175,8 @@ class Deliverer:
         self.due = time.monotonic() + standoff(self.tries, self.share())
 
     def _waiting(self) -> float:
-        """Wait out a standoff if there is one, and otherwise a pass."""
-        left = self.due - time.monotonic()
-        return left if left > 0 else self.interval
+        """Wait out a standoff if there is one, and otherwise until the next fold."""
+        now = time.monotonic()
+        if self.due > now:
+            return self.due - now
+        return max(0.0, self.folded + self.interval - now)

fluidattacks_agent-0.3.0/fluidattacks_agent/executions.py

@@ -0,0 +1,162 @@
+"""Watch code inside a package start running, where the interpreter allows it."""
+
+import sys
+from collections.abc import Callable, Mapping
+from dataclasses import dataclass, field
+from pathlib import PurePath
+from typing import Final
+
+from fluidattacks_agent.distributions import Dist, distribution_of
+from fluidattacks_agent.report import (
+    Ecosystem,
+    Evidence,
+    Granularity,
+    Record,
+    Sighting,
+    dated,
+    merged,
+    reached,
+    sighted,
+    trimmed,
+)
+
+# 3.15 makes the import below lazy from this; every version we support
+# ignores it, so nothing changes until the floor moves
+__lazy_modules__ = ["pathlib"]
+
+# what one window holds at most: a real application runs some 26,000 distinct
+# functions while it starts, and the start is the busiest window there is. A
+# name refused past it is counted, and named again the next window it runs in
+MAX_FUNCTIONS: Final = 32768
+
+OURS: Final = "fluidattacks_agent"
+
+SOURCE: Final = ".py"
+
+INITIALIZER: Final = "__init__"
+PARENT: Final = ".."
+
+TOOL: Final = 3
+TOOL_NAME: Final = "fluidattacks-agent"
+
+
+TOOLS: Final = 6
+
+
+def available() -> bool:
+    """Say whether this interpreter can report code starting at all."""
+    return hasattr(sys, "monitoring")
+
+
+def alone(tool: int = TOOL) -> bool:
+    """Say whether this is the only tool watching: restart_events takes none."""
+    held = (sys.monitoring.get_tool(other) for other in range(TOOLS) if other != tool)
+    return not any(name is not None for name in held)
+
+
+def module_of(filename: str, sites: tuple[str, ...]) -> str | None:
+    """Name the module whose source a running code object came from."""
+    for site in sites:
+        prefix = site + "/"
+        if not filename.startswith(prefix) or not filename.endswith(SOURCE):
+            continue
+        held = PurePath(filename[len(prefix) :])
+        parts = list(held.parts)
+        if not parts or held.is_absolute() or PARENT in parts:
+            return None
+        stem = parts.pop()[: -len(SOURCE)]
+        if not stem:
+            return None
+        if stem != INITIALIZER:
+            parts.append(stem)
+        return ".".join(parts) or None
+    return None
+
+
+@dataclass
+class RunObserver:
+    """Functions that started in the window under way, and in no window before it."""
+
+    sites: tuple[str, ...] = ()
+    # the window's own: a fold takes the whole map, and the reader adds the
+    # windows up. So the bound is on a window and not on the process's life
+    seen: dict[str, Sighting] = field(default_factory=dict)
+    # what a fold took and did not report, for the next fold to offer again.
+    # The fold's own: no thread of the workload writes beside it. Bounded by
+    # the same ceiling, and what finds no room is counted with the refusals
+    owed: dict[str, Sighting] = field(default_factory=dict)
+    suppressed: int = 0
+    unkept: int = 0
+
+    def note(
+        self,
+        filename: str,
+        qualname: str,
+        clock: Callable[[], int] = reached,
+    ) -> str | None:
+        """Take note of code starting, naming the function whenever the window has room."""
+        module = module_of(filename, self.sites)
+        if module is None:
+            return None
+        if module.split(".", maxsplit=1)[0] == OURS:
+            return None
+        qualified = f"{module}.{qualname}"
+        # bound once: a fold may swap the window out meanwhile, and a sighting
+        # must land in the window it was counted against, never in the next
+        seen = self.seen
+        held = seen.get(qualified)
+        if held is None and len(seen) >= MAX_FUNCTIONS:
+            self.suppressed += 1
+            return None
+        seen[qualified] = sighted(held, clock())
+        return qualified
+
+    def drain(self) -> dict[str, Sighting]:
+        """Take the window whole, and what the last fold owed, leaving the next one empty."""
+        taken, self.seen = self.seen, {}
+        # into a map of the fold's own, so what a late sighting lands in the
+        # window taken is at most lost, and never written over by the fold
+        offered = self.owed
+        self.owed = {}
+        merged(offered, taken)
+        return offered
+
+    def restore(self, taken: Mapping[str, Sighting]) -> None:
+        """Keep for the next fold what this one took and did not report, as far as there is room."""
+        merged(self.owed, taken)
+        self.unkept += trimmed(self.owed, MAX_FUNCTIONS)
+
+    def records(
+        self,
+        taken: Mapping[str, Sighting],
+        installed: dict[str, Dist],
+        origin: int,
+    ) -> tuple[list[Record], dict[str, Sighting]]:
+        """Report every function a distribution owns, and say what the next window keeps."""
+        found: list[Record] = []
+        kept: dict[str, Sighting] = {}
+        scanned = bool(installed)
+        for qualified in sorted(taken):
+            held = taken[qualified]
+            dist = distribution_of(qualified, installed)
+            if dist is None:
+                # no distribution will own what a settled scan does not, and a
+                # scan that has found nothing yet may still own all of these
+                if not scanned:
+                    kept[qualified] = held
+                continue
+            found.append(
+                Record(
+                    ecosystem=Ecosystem.PYPI,
+                    name=dist.name,
+                    version=dist.version,
+                    confidence=dist.confidence,
+                    symbol=qualified,
+                    granularity=Granularity.FUNCTION,
+                    evidence=Evidence.EXECUTED,
+                    frequency=held.times,
+                    when=held.first,
+                    used=dated(origin, held.last),
+                ),
+            )
+        return found, kept

{fluidattacks_agent-0.1.2 → fluidattacks_agent-0.3.0}/fluidattacks_agent/loads.py

@@ -1,13 +1,25 @@
 """Account for package code the interpreter read without importing it."""
 
 import os
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping
 from dataclasses import dataclass, field
 from types import ModuleType
 
 from fluidattacks_agent.distributions import Dist, distribution_of
-from fluidattacks_agent.report import Ecosystem, Evidence, Granularity, Record, keyed
+from fluidattacks_agent.report import (
+    Ecosystem,
+    Evidence,
+    Granularity,
+    Record,
+    Sighting,
+    dated,
+    merged,
+    reached,
+    sighted,
+    trimmed,
+)
 
+# what one window holds at most, and not the process's life
 MAX_PACKAGES = 4096
 
 OURS = "fluidattacks_agent"
@@ -46,51 +58,67 @@ def package_of(path: str, sites: tuple[str, ...]) -> str | None:
 
 @dataclass
 class LoadObserver:
-    """Packages whose code was read, bounded the way the reader's map is."""
+    """Packages whose code was read in the window under way."""
 
     sites: tuple[str, ...] = ()
     # how many files of each package were read, not merely whether any was
-    seen: dict[str, int] = field(default_factory=dict)
-    moved: set[str] = field(default_factory=set)
+    seen: dict[str, Sighting] = field(default_factory=dict)
+    # what a fold took and did not report, for the next fold to offer again.
+    # The fold's own: no thread of the workload writes beside it. Bounded by
+    # the same ceiling, and what finds no room is counted with the refusals
+    owed: dict[str, Sighting] = field(default_factory=dict)
     suppressed: int = 0
+    unkept: int = 0
 
-    def note(self, path: str) -> str | None:
-        """Take note of a file opened, naming the package whenever there is room."""
+    def note(self, path: str, clock: Callable[[], int] = reached) -> str | None:
+        """Take note of a file opened, naming the package whenever the window has room."""
         package = package_of(path, self.sites)
         if package is None or package == OURS:
             return None
-        if package in self.seen:
-            self.seen[package] += 1
-            self.moved.add(package)
-            return package
-        if len(self.seen) >= MAX_PACKAGES:
+        seen = self.seen
+        held = seen.get(package)
+        if held is None and len(seen) >= MAX_PACKAGES:
             self.suppressed += 1
             return None
-        self.seen[package] = 1
-        self.moved.add(package)
+        seen[package] = sighted(held, clock())
         return package
 
+    def drain(self) -> dict[str, Sighting]:
+        """Take the window whole, and what the last fold owed, leaving the next one empty."""
+        taken, self.seen = self.seen, {}
+        # into a map of the fold's own, so what a late sighting lands in the
+        # window taken is at most lost, and never written over by the fold
+        offered = self.owed
+        self.owed = {}
+        merged(offered, taken)
+        return offered
+
+    def restore(self, taken: Mapping[str, Sighting]) -> None:
+        """Keep for the next fold what this one took and did not report, as far as there is room."""
+        merged(self.owed, taken)
+        self.unkept += trimmed(self.owed, MAX_PACKAGES)
+
     def records(
         self,
+        taken: Mapping[str, Sighting],
         modules: dict[str, ModuleType],
         installed: dict[str, Dist],
-        carried: Mapping[tuple[str, str], int],
-    ) -> list[Record]:
-        """Report the packages that were read and never became modules."""
+        origin: int,
+    ) -> tuple[list[Record], dict[str, Sighting]]:
+        """Report the packages read that became no module, and say what the next window keeps."""
         found: list[Record] = []
+        kept: dict[str, Sighting] = {}
         scanned = bool(installed)
-        for package in sorted(self.moved):
-            times = self.seen[package]
-            if times <= carried.get(keyed(Evidence.READ, package), 0):
-                self.moved.discard(package)
-                continue
+        for package in sorted(taken):
+            held = taken[package]
             if package in modules:
-                # kept, because a name can leave sys.modules and be read again
+                # the stronger evidence has it. A name that leaves sys.modules
+                # and is read again is a sighting of the window that reads it
                 continue
             dist = distribution_of(package, installed)
             if dist is None:
-                if scanned:
-                    self.moved.discard(package)
+                if not scanned:
+                    kept[package] = held
                 continue
             found.append(
                 Record(
@@ -103,7 +131,9 @@ class LoadObserver:
                     # module it is would claim the interpreter reached it
                     granularity=Granularity.PACKAGE,
                     evidence=Evidence.READ,
-                    frequency=times,
+                    frequency=held.times,
+                    when=held.first,
+                    used=dated(origin, held.last),
                 ),
             )
-        return found
+        return found, kept

{fluidattacks_agent-0.1.2 → fluidattacks_agent-0.3.0}/fluidattacks_agent/observer.py

@@ -1,16 +1,27 @@
 """Watch what a workload imports, without taking part in importing it."""
 
 import sys
-from collections.abc import Mapping
+from collections.abc import Callable, Mapping
 from dataclasses import dataclass, field
 from types import ModuleType
 from typing import Protocol
 
 from fluidattacks_agent.distributions import Dist, distribution_of
-from fluidattacks_agent.report import Ecosystem, Evidence, Granularity, Record, keyed
-
-# the probe rides inside a workload we do not own, so its bookkeeping is
-# bounded the same way the reader's is
+from fluidattacks_agent.report import (
+    Ecosystem,
+    Evidence,
+    Granularity,
+    Record,
+    Sighting,
+    dated,
+    merged,
+    reached,
+    sighted,
+    trimmed,
+)
+
+# the probe rides inside a workload we do not own, so what one window holds is
+# bounded, and the bound is on the window rather than on the process's life
 MAX_MODULES = 4096
 
 # our own package would otherwise land in the workload's inventory
@@ -27,29 +38,29 @@ class ImportObserver:
     finders behind it to decide the outcome.
     """
 
-    # how many times each module was looked up, by its whole dotted name, so a
-    # record can name the module that was seen and not only the package holding
-    # it. The name is what bounds the ceiling below
-    seen: dict[str, int] = field(default_factory=dict)
-    moved: set[str] = field(default_factory=set)
-    # modules seen past the ceiling, so the loss is never silent
+    # how many times each module was looked up in the window under way, by its
+    # whole dotted name, so a record can name the module that was seen and not
+    # only the package holding it. The name is what bounds the ceiling below
+    seen: dict[str, Sighting] = field(default_factory=dict)
+    # what a fold took and did not report, for the next fold to offer again.
+    # The fold's own: no thread of the workload writes beside it. Bounded by
+    # the same ceiling, and what finds no room is counted with the refusals
+    owed: dict[str, Sighting] = field(default_factory=dict)
     suppressed: int = 0
+    unkept: int = 0
 
-    def note(self, fullname: str) -> str | None:
-        """Take note of a module looked up, naming it whenever there is room."""
+    def note(self, fullname: str, clock: Callable[[], int] = reached) -> str | None:
+        """Take note of a module looked up, naming it whenever the window has room."""
         if fullname.split(".", maxsplit=1)[0] == OURS:
             return None
-        if fullname in self.seen:
-            self.seen[fullname] += 1
-            self.moved.add(fullname)
-            return fullname
-        # the ceiling bounds how many distinct names are held, not how often a
-        # name already held is counted
-        if len(self.seen) >= MAX_MODULES:
+        seen = self.seen
+        held = seen.get(fullname)
+        # the ceiling bounds how many distinct names a window holds, not how
+        # often a name already held is counted
+        if held is None and len(seen) >= MAX_MODULES:
             self.suppressed += 1
             return None
-        self.seen[fullname] = 1
-        self.moved.add(fullname)
+        seen[fullname] = sighted(held, clock())
         return fullname
 
     def find_spec(
@@ -61,38 +72,53 @@ class ImportObserver:
         """Note the module being looked up, then defer to the finders behind."""
         self.note(fullname)
 
+    def drain(self) -> dict[str, Sighting]:
+        """Take the window whole, and what the last fold owed, leaving the next one empty."""
+        taken, self.seen = self.seen, {}
+        # into a map of the fold's own, so what a late sighting lands in the
+        # window taken is at most lost, and never written over by the fold
+        offered = self.owed
+        self.owed = {}
+        merged(offered, taken)
+        return offered
+
+    def restore(self, taken: Mapping[str, Sighting]) -> None:
+        """Keep for the next fold what this one took and did not report, as far as there is room."""
+        merged(self.owed, taken)
+        self.unkept += trimmed(self.owed, MAX_MODULES)
+
     def records(
         self,
+        taken: Mapping[str, Sighting],
         modules: dict[str, ModuleType],
         installed: dict[str, Dist],
-        carried: Mapping[tuple[str, str], int],
-    ) -> list[Record]:
+        origin: int,
+    ) -> tuple[list[Record], dict[str, Sighting]]:
         """
         Name the distribution behind every module that finished importing.
 
         A lookup is only an attempt: an import that raised never reaches
         ``modules``, and reporting it would claim a package loaded when it did
         not. Intersecting the two is what makes this evidence rather than
-        intent.
+        intent. What has not landed yet is what the next window keeps.
 
         Both maps are taken by the caller so this stays a pure fold, and so the
         distribution scan happens once per report instead of once per module.
         """
         found: list[Record] = []
+        kept: dict[str, Sighting] = {}
         scanned = bool(installed)
-        for name in sorted(self.moved):
-            times = self.seen[name]
-            if times <= carried.get(keyed(Evidence.IMPORTED, name), 0):
-                self.moved.discard(name)
-                continue
+        for name in sorted(taken):
+            held = taken[name]
             module = modules.get(name)
             if module is None:
-                # kept, because a lookup mid-import finishes after this flush
+                # kept, because a lookup mid-import finishes after this fold
+                kept[name] = held
                 continue
             dist = distribution_of(name, installed)
             if dist is None:
-                if scanned:
-                    self.moved.discard(name)
+                if not scanned:
+                    kept[name] = held
                 continue
             found.append(
                 Record(
@@ -103,10 +129,12 @@ class ImportObserver:
                     symbol=name,
                     granularity=granularity_of(module),
                     evidence=Evidence.IMPORTED,
-                    frequency=times,
+                    frequency=held.times,
+                    when=held.first,
+                    used=dated(origin, held.last),
                 ),
             )
-        return found
+        return found, kept
 
 
 def granularity_of(module: ModuleType) -> Granularity:

{fluidattacks_agent-0.1.2 → fluidattacks_agent-0.3.0}/fluidattacks_agent/post.py

@@ -118,6 +118,16 @@ def targeted(path: str, query: str) -> str:
     return f"{path or '/'}?{query}" if query else path or "/"
 
 
+def prepared() -> None:
+    """Import what a post needs, where a fork cannot catch an import half done."""
+    # a fork taken while another thread holds a module's import lock leaves
+    # that lock held in the child forever, so these are taken under the fold's
+    # own lock, which a fork waits out, and never first on the thread that posts
+    import http.client  # noqa: F401, PLC0415
+    import ssl  # noqa: F401, PLC0415
+    import urllib.parse  # noqa: F401, PLC0415
+
+
 def proven() -> "ssl.SSLContext":
     """Give a context the far end has to prove itself on, hostname included."""
     import ssl  # noqa: PLC0415