pyatls: use urllib3 v2

[HernanGatta]

Overview

There are multiple mutually-incompatible HTTP libraries for Python: the built-in http library, urllib3, and requests.

These are layered in that requests uses urllib3 which in turn uses http. These libraries provide similarly or identically named classes to those in the lower layers but have different interfaces and exhibit different behavior, depending on usage.

As a result, care must be taken to not mix them. Additionally, the general consensus in the Python world is to use urllib3 because of its superior feature set, such as built-in support for connection pooling.

Note: The individual commits are meant to be reviewed individually.

Changes

Previously, the aTLS library used the http library directly, provided a shim to plug it into urllib3, and provided an aTLS adapter for the requests library directly atop the http-based implementation.

Additionally, the library used urllib3 v1.x, which is being deprecated in favor of v2.x, which is not API-compatible with v1.x. It follows that currently the aTLS library only works when v1.x is in the environment, though in a clean environment pip would install the v2.x series. Pinning urllib3 to < 2.0.0 would be less than ideal as its users move on.

Lastly, the current implementation of the aTLS library is not compatible with Python 3.8 due to its usage of 3.10 syntax.

This PR fixes all of these problems.

Tested

Against an Opaque Prompts instance in confidential ACI:

[X] Clean Python 3.8 environment
[X] Idem, Python 3.10
[X] Idem, Python 3.11

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ ACTION	actionlint	1		0	0.01s
✅ PYTHON	black	18		0	0.8s
✅ PYTHON	flake8	18		0	0.44s
✅ PYTHON	isort	18		0	0.24s
✅ YAML	yamllint	5		0	0.25s

See detailed report in MegaLinter reports

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

• oxsecurity/megalinter/flavors/[email protected] (59 linters)
• oxsecurity/megalinter/flavors/[email protected] (82 linters)

MegaLinter is graciously provided by

[zizhong]

LG!

[zizhong]

The requests library is not marked as a dependency of this package

do we need it here?

[HernanGatta]

I suppose it depends on what we use this file for. If it's for development dependencies, then yes; if it's for general dependencies, then I'd say no.

[HernanGatta]

Maybe I should rename it to requirements-dev.txt.

[ggroode]

I think it is fine to have it here.

[ggroode]

Thanks for this change, code itself looks good just have a couple comments on conventions and some values we are importing.

[ggroode]

I think it is fine to have it here.

[ggroode]

Not a huge deal, but importing variables starting with _ feels a bit weird since they are the python equivalent of private variables and methods (and therefore I am not certain if they are protected from changing / breaking between minor version bumps unlike public methods).

[HernanGatta]

Yeah, I don't like it either. The alternative though is duplicating them, which felt nastier when I was considering what to do.

Thinking about it more now, maybe I should duplicate them since these end up being part of the aTLS package's public API.

[ggroode]

Any particular reason this file and class have an _ in front, because my understanding is that means you don't intend to import it anywhere else, but you do end up importing it in other files (I also have never seen a python file that starts with an _, but that might be a convention I am not aware of).

[HernanGatta]

Regarding the file name, I saw it in the requests library:
https://github.com/psf/requests/blob/main/src/requests/_internal_utils.py

As for the class name, the intention is to mark it as internal to the library, but still available to the library itself. Some tools (like VS Code) automatically hide modules (.py files) and types that start with an underscore.

I suppose that if the file starts with an underscore, then there is no point to also the class starting with one.

I can leave the underscore in the file and remove it from the class. Thoughts?