rtls 2026.3.26__tar.gz

rtls-2026.3.26/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TAHRI Ahmed R.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

rtls-2026.3.26/NOTICE

@@ -0,0 +1,106 @@
+NOTICE
+======
+
+This project contains code that is derived from, or inspired by, CPython's
+``ssl`` module and its associated C extension ``_ssl``. The original CPython
+source is licensed under the Python Software Foundation License Version 2,
+reproduced below.
+
+This project links against rustls, a modern TLS library written in Rust.
+rustls is Copyright (c) 2016 Joseph Birr-Pixton and licensed under
+Apache-2.0, MIT, or ISC (at your option). The rustls MIT license is
+reproduced below.
+
+Summary of changes made to Python
+----------------------------------
+
+rtls does not embed or modify CPython source code directly. Instead, it
+re-implements the ``ssl`` module's public API (SSLContext, SSLSocket,
+SSLObject, MemoryBIO, exceptions, constants, and utility functions) on top
+of the rustls TLS library via PyO3. The API surface - class names, method
+signatures, property semantics, constant values, exception hierarchy, and
+``getpeercert()`` dict structure - is modelled after CPython 3.12+ to
+achieve drop-in compatibility.
+
+No CPython C code is included in this project.
+
+------------------------------------------------------------------------
+
+PYTHON SOFTWARE FOUNDATION LICENSE VERSION 2
+--------------------------------------------
+
+1. This LICENSE AGREEMENT is between the Python Software Foundation
+("PSF"), and the Individual or Organization ("Licensee") accessing and
+otherwise using this software ("Python") in source or binary form and
+its associated documentation.
+
+2. Subject to the terms and conditions of this License Agreement, PSF hereby
+grants Licensee a nonexclusive, royalty-free, world-wide license to reproduce,
+analyze, test, perform and/or display publicly, prepare derivative works,
+distribute, and otherwise use Python alone or in any derivative version,
+provided, however, that PSF's License Agreement and PSF's notice of copyright,
+i.e., "Copyright (c) 2001-2025 Python Software Foundation; All Rights
+Reserved" are retained in Python alone or in any derivative version prepared by
+Licensee.
+
+3. In the event Licensee prepares a derivative work that is based on
+or incorporates Python or any part thereof, and wants to make
+the derivative work available to others as provided herein, then
+Licensee hereby agrees to include in any such work a brief summary of
+the changes made to Python.
+
+4. PSF is making Python available to Licensee on an "AS IS"
+basis.  PSF MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR
+IMPLIED.  BY WAY OF EXAMPLE, BUT NOT LIMITATION, PSF MAKES NO AND
+DISCLAIMS ANY REPRESENTATION OR WARRANTY OF MERCHANTABILITY OR FITNESS
+FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF PYTHON WILL NOT
+INFRINGE ANY THIRD PARTY RIGHTS.
+
+5. PSF SHALL NOT BE LIABLE TO LICENSEE OR ANY OTHER USERS OF PYTHON
+FOR ANY INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES OR LOSS AS
+A RESULT OF MODIFYING, DISTRIBUTING, OR OTHERWISE USING PYTHON,
+OR ANY DERIVATIVE THEREOF, EVEN IF ADVISED OF THE POSSIBILITY THEREOF.
+
+6. This License Agreement will automatically terminate upon a material
+breach of its terms and conditions.
+
+7. Nothing in this License Agreement shall be deemed to create any
+relationship of agency, partnership, or joint venture between PSF and
+Licensee.  This License Agreement does not grant permission to use PSF
+trademarks or trade name in a trademark sense to endorse or promote
+products or services of Licensee, or any third party.
+
+8. By copying, installing or otherwise using Python, Licensee
+agrees to be bound by the terms and conditions of this License
+Agreement.
+
+------------------------------------------------------------------------
+
+RUSTLS LICENSE (MIT)
+--------------------
+
+Copyright (c) 2016 Joseph Birr-Pixton <jpixton@gmail.com>
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

rtls-2026.3.26/PKG-INFO

@@ -0,0 +1,142 @@
+Metadata-Version: 2.4
+Name: rtls
+Version: 2026.3.26
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Web Environment
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Rust
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Programming Language :: Python :: Free Threading :: 4 - Resilient
+Requires-Dist: wassima>=1,<3
+License-File: LICENSE
+License-File: NOTICE
+Summary: A drop-in replacement for Python's ssl module, backed by rustls
+Home-Page: https://github.com/jawah/rtls
+Author-email: "Ahmed R. TAHRI" <tahri.ahmed@proton.me>
+Maintainer-email: "Ahmed R. TAHRI" <tahri.ahmed@proton.me>
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: homepage, https://github.com/jawah/rtls
+
+Rustls-backed TLS for CPython
+-----------------------------
+
+Ever dreamed of getting rid of OpenSSL within CPython without creating a custom build of CPython for this?
+Tired of waiting half a decade for a solid and up-to-date TLS experience, shipping Post-quantum, and ECH support by default?
+
+Then `rtls` is made for you.
+
+It's a drop-in replacement for the `ssl` stdlib!
+Support CPython 3.7 onward. Including freethreaded.
+
+### Getting Started
+
+Install from source (requires a Rust toolchain and maturin):
+
+```
+pip install rtls
+```
+
+Then swap `ssl` for `rtls` anywhere in your code:
+
+```python
+import rtls as ssl
+
+ctx = ssl.create_default_context()
+```
+
+Or use it alongside the stdlib:
+
+```python
+from rtls import SSLContext, PROTOCOL_TLS_CLIENT
+
+ctx = SSLContext(PROTOCOL_TLS_CLIENT)
+ctx.load_default_certs()
+
+import socket
+sock = socket.create_connection(("example.com", 443))
+ssock = ctx.wrap_socket(sock, server_hostname="example.com")
+ssock.sendall(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
+print(ssock.recv(4096).decode())
+```
+
+It works with asyncio out of the box:
+
+```python
+import asyncio
+import rtls as ssl
+
+async def main():
+    ctx = ssl.create_default_context()
+    reader, writer = await asyncio.open_connection("example.com", 443, ssl=ctx)
+    writer.write(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
+    await writer.drain()
+    print((await reader.read(4096)).decode())
+    writer.close()
+
+asyncio.run(main())
+```
+
+### Feature Parity with stdlib
+
+rtls re-exports **93 public names** matching the `ssl` module API. The table below summarizes
+coverage across the main areas.
+
+**What's different from `ssl`:**
+
+- TLS 1.2 is the minimum version. SSLv2, SSLv3, TLS 1.0 and TLS 1.1 are not available.
+- Hostname verification uses SAN only, never the Common Name.
+- `compression()` always returns `None` (TLS compression is disabled, as it should be).
+- `security_level` is always 2. rustls defaults are strong by design.
+- `load_cert_chain` natively accepts **in-memory PEM bytes** as `certfile`/`keyfile`, not just file paths.
+
+### Disclaimer
+
+This project is in an early stage. The public API is stable, we do not plan to diverge from stdlib.
+It's not pure Python, so you'll have either a pre-built wheel compatible with your platform or build
+from the sources by yourself.
+
+A notice is present to acknowledge CPython rights on the ssl Python codebase. The project itself is licensed
+under MIT as we always do. Rustls is also permissively licensed.
+
+Right now we deliberately focus on the client side. PRs are accepted to help us finalize/improve the server side.
+
+- We are not inclined to enable FIPS mode via aws-lc-rs for the moment, however, it's on our roadmap.
+- Do not open issue about "JA fingerprint", "Browser impersonator" or alike, we'll most likely close them on the spot. We are not interested in pursing this.
+- PyPy is not going to be supported, unfortunately.
+
+It's not faster than the stdlib. Expect roughly 5 to 10% slower. For example, a quick benchmark reveal that ssl stdlib can reach 456 MB/s raw throughput on my modest laptop while our
+implementation reached 410 MB/s. Why? We heavily pay for crossing the boundary between Rust and CPython. We could implement the Buffer protocol (avoid needless memcpy each time), but that
+would cost us our high CPython (i.e. 3.7+) compatibility. That trade off is quickly hided by the fact that you will run a memory safe TLS implementation. No longer in C shall we do TLS!
+
+Contributions, bug reports, and feedback are welcome.
+
+### Versioning
+
+This project is based on calver (YYYY-0M-0D), it does not need semver as it aims to be a drop-in replacement for stdlib `ssl`.
+You do not need to constraint the upper bound version.
+
+### Prior art
+
+I saw https://github.com/djc/pyrtls a couple of months ago, and it inspired me to write this alternative.
+Why? As you are aware, we are maintaining a fork of urllib3 and requests, and having to handwrite a support for a non ssl
+compatible lib is going to be a nightmare. We just can't ask the maintainer to rewrite everything for our
+own needs.
+
+### Documentation
+
+See https://docs.python.org/3/library/ssl.html as it's fairly detailed and spotless.
+We would host our own version later having unsupported feature removed. Amongst import naming, etc(...).
+

rtls-2026.3.26/README.md

@@ -0,0 +1,109 @@
+Rustls-backed TLS for CPython
+-----------------------------
+
+Ever dreamed of getting rid of OpenSSL within CPython without creating a custom build of CPython for this?
+Tired of waiting half a decade for a solid and up-to-date TLS experience, shipping Post-quantum, and ECH support by default?
+
+Then `rtls` is made for you.
+
+It's a drop-in replacement for the `ssl` stdlib!
+Support CPython 3.7 onward. Including freethreaded.
+
+### Getting Started
+
+Install from source (requires a Rust toolchain and maturin):
+
+```
+pip install rtls
+```
+
+Then swap `ssl` for `rtls` anywhere in your code:
+
+```python
+import rtls as ssl
+
+ctx = ssl.create_default_context()
+```
+
+Or use it alongside the stdlib:
+
+```python
+from rtls import SSLContext, PROTOCOL_TLS_CLIENT
+
+ctx = SSLContext(PROTOCOL_TLS_CLIENT)
+ctx.load_default_certs()
+
+import socket
+sock = socket.create_connection(("example.com", 443))
+ssock = ctx.wrap_socket(sock, server_hostname="example.com")
+ssock.sendall(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
+print(ssock.recv(4096).decode())
+```
+
+It works with asyncio out of the box:
+
+```python
+import asyncio
+import rtls as ssl
+
+async def main():
+    ctx = ssl.create_default_context()
+    reader, writer = await asyncio.open_connection("example.com", 443, ssl=ctx)
+    writer.write(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
+    await writer.drain()
+    print((await reader.read(4096)).decode())
+    writer.close()
+
+asyncio.run(main())
+```
+
+### Feature Parity with stdlib
+
+rtls re-exports **93 public names** matching the `ssl` module API. The table below summarizes
+coverage across the main areas.
+
+**What's different from `ssl`:**
+
+- TLS 1.2 is the minimum version. SSLv2, SSLv3, TLS 1.0 and TLS 1.1 are not available.
+- Hostname verification uses SAN only, never the Common Name.
+- `compression()` always returns `None` (TLS compression is disabled, as it should be).
+- `security_level` is always 2. rustls defaults are strong by design.
+- `load_cert_chain` natively accepts **in-memory PEM bytes** as `certfile`/`keyfile`, not just file paths.
+
+### Disclaimer
+
+This project is in an early stage. The public API is stable, we do not plan to diverge from stdlib.
+It's not pure Python, so you'll have either a pre-built wheel compatible with your platform or build
+from the sources by yourself.
+
+A notice is present to acknowledge CPython rights on the ssl Python codebase. The project itself is licensed
+under MIT as we always do. Rustls is also permissively licensed.
+
+Right now we deliberately focus on the client side. PRs are accepted to help us finalize/improve the server side.
+
+- We are not inclined to enable FIPS mode via aws-lc-rs for the moment, however, it's on our roadmap.
+- Do not open issue about "JA fingerprint", "Browser impersonator" or alike, we'll most likely close them on the spot. We are not interested in pursing this.
+- PyPy is not going to be supported, unfortunately.
+
+It's not faster than the stdlib. Expect roughly 5 to 10% slower. For example, a quick benchmark reveal that ssl stdlib can reach 456 MB/s raw throughput on my modest laptop while our
+implementation reached 410 MB/s. Why? We heavily pay for crossing the boundary between Rust and CPython. We could implement the Buffer protocol (avoid needless memcpy each time), but that
+would cost us our high CPython (i.e. 3.7+) compatibility. That trade off is quickly hided by the fact that you will run a memory safe TLS implementation. No longer in C shall we do TLS!
+
+Contributions, bug reports, and feedback are welcome.
+
+### Versioning
+
+This project is based on calver (YYYY-0M-0D), it does not need semver as it aims to be a drop-in replacement for stdlib `ssl`.
+You do not need to constraint the upper bound version.
+
+### Prior art
+
+I saw https://github.com/djc/pyrtls a couple of months ago, and it inspired me to write this alternative.
+Why? As you are aware, we are maintaining a fork of urllib3 and requests, and having to handwrite a support for a non ssl
+compatible lib is going to be a nightmare. We just can't ask the maintainer to rewrite everything for our
+own needs.
+
+### Documentation
+
+See https://docs.python.org/3/library/ssl.html as it's fairly detailed and spotless.
+We would host our own version later having unsupported feature removed. Amongst import naming, etc(...).

rtls-2026.3.26/pyproject.toml

@@ -0,0 +1,97 @@
+[build-system]
+requires = ["maturin>=1.2,<2.0"]
+build-backend = "maturin"
+
+[project]
+name = "rtls"
+description = "A drop-in replacement for Python's ssl module, backed by rustls"
+readme = "README.md"
+requires-python = ">=3.7"
+license = { file = "LICENSE" }
+authors = [
+  {name = "Ahmed R. TAHRI", email="tahri.ahmed@proton.me"},
+]
+maintainers = [
+  {name = "Ahmed R. TAHRI", email="tahri.ahmed@proton.me"},
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Web Environment",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Rust",
+    "Programming Language :: Python :: Implementation :: CPython",
+    "Programming Language :: Python",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.7",
+    "Programming Language :: Python :: 3.8",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Internet :: WWW/HTTP",
+    "Programming Language :: Python :: Free Threading :: 4 - Resilient",
+]
+dynamic = [
+    'version'
+]
+dependencies = [
+  "wassima>=1,<3",
+]
+
+[tool.maturin]
+include = [
+  { path = "NOTICE", format = "sdist" },
+  { path = "tests/**/*", format = "sdist" },
+]
+exclude = [
+  { path = "**/__pycache__/**", format = "sdist" },
+]
+features = ["pyo3/extension-module", "pyo3/abi3-py37", "pyo3/generate-import-lib"]
+module-name = "rtls._rustls"
+python-source = "src"
+manifest-path = "rust/Cargo.toml"
+
+[tool.maturin.sbom]
+# Generate a CycloneDX SBOM for the Rust dependency tree.
+# Defaults to true when the sbom feature is enabled.
+rust = true
+# Generate a CycloneDX SBOM for external shared libraries grafted during
+# auditwheel repair. Defaults to true when repair copies libraries.
+auditwheel = true
+
+[project.urls]
+homepage = "https://github.com/jawah/rtls"
+
+[tool.pytest.ini_options]
+xfail_strict = true
+log_level = "DEBUG"
+filterwarnings = [
+    "error",
+    '''ignore:Exception ignored in:pytest.PytestUnraisableExceptionWarning''',
+    '''ignore:Exception in thread:pytest.PytestUnhandledThreadExceptionWarning''',
+    '''ignore:Unverified HTTPS request is being made to host:urllib3.exceptions.InsecureRequestWarning''',
+    '''ignore:Exception ignored while finalizing socket:pytest.PytestUnraisableExceptionWarning''',
+]
+
+[tool.mypy]
+disallow_untyped_calls = true
+disallow_untyped_decorators = true
+ignore_missing_imports = true
+strict_optional = false
+warn_redundant_casts = true
+warn_unused_ignores = true
+
+[tool.ruff.lint]
+select = [
+    "E",  # pycodestyle
+    "F",  # Pyflakes
+    "W",  # pycodestyle
+    "I",  # isort
+    "U",  # pyupgrade
+]
+
+[tool.ruff.lint.isort]
+required-imports = ["from __future__ import annotations"]