{"action":"created","issue":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/2966","repository_url":"https://api.github.com/repos/kennethreitz/requests","labels_url":"https://api.github.com/repos/kennethreitz/requests/issues/2966/labels{/name}","comments_url":"https://api.github.com/repos/kennethreitz/requests/issues/2966/comments","events_url":"https://api.github.com/repos/kennethreitz/requests/issues/2966/events","html_url":"https://github.com/kennethreitz/requests/issues/2966","id":125993142,"number":2966,"title":"Consider using system trust stores by default in 3.0.0.","user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kennethreitz/requests/labels/Needs%20More%20Information","name":"Needs More Information","color":"fef2c0"},{"url":"https://api.github.com/repos/kennethreitz/requests/labels/Please%20Review","name":"Please Review","color":"fef2c0"},{"url":"https://api.github.com/repos/kennethreitz/requests/labels/Question/Not%20a%20bug","name":"Question/Not a bug","color":"777777"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/kennethreitz/requests/milestones/20","html_url":"https://github.com/kennethreitz/requests/milestones/3.0.0","labels_url":"https://api.github.com/repos/kennethreitz/requests/milestones/20/labels","id":487518,"number":20,"title":"3.0.0","description":null,"creator":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"open_issues":25,"closed_issues":12,"state":"open","created_at":"2013-11-17T11:29:34Z","updated_at":"2016-05-19T07:51:13Z","due_on":null,"closed_at":null},"comments":93,"created_at":"2016-01-11T17:15:47Z","updated_at":"2016-05-20T19:53:08Z","closed_at":null,"body":"It's been raised repeatedly, mostly by people using Linux systems, that it's annoying that requests doesn't use the system trust store and instead uses the one that certifi ships. This is an understandable position. I have some personal attachment to the certifi approach, but the other side of that argument definitely has a reasonable position too. For this reason, I'd like us to look into whether we should use the system trust store by default, and make certifi's bundle a fallback option.\r\n\r\nI have some caveats here:\r\n\r\n1. If we move to the system trust store, we must do so on *all* platforms: Linux must not be its own special snowflake.\r\n2. We must have broad-based support for Linux and Windows.\r\n3. We must be able to fall back to certifi cleanly.\r\n\r\nRight now it seems like the best route to achieving this would be to use [certitude](https://github.com/python-hyper/certitude). This currently has support for dynamically generating the cert bundle OpenSSL needs directly from the system keychain on OS X. If we added Linux and Windows support to that library, we may have the opportunity to switch to using certitude.\r\n\r\nGiven @kennethreitz's bundling policy, we probably cannot unconditionally switch to certitude, because certitude depends on cryptography (at least on OS X). However, certitude could take the current privileged position that certifi takes, or be a higher priority than certifi, as an optional dependency that is used if present on the system.\r\n\r\nThoughts? This is currently a RFC, so please comment if you have opinions. /cc @sigmavirus24 @alex @kennethreitz @dstufft @glyph @reaperhulk @morganfainberg"},"comment":{"url":"https://api.github.com/repos/kennethreitz/requests/issues/comments/220702875","html_url":"https://github.com/kennethreitz/requests/issues/2966#issuecomment-220702875","issue_url":"https://api.github.com/repos/kennethreitz/requests/issues/2966","id":220702875,"user":{"login":"shazow","id":6292,"avatar_url":"https://avatars.githubusercontent.com/u/6292?v=3","gravatar_id":"","url":"https://api.github.com/users/shazow","html_url":"https://github.com/shazow","followers_url":"https://api.github.com/users/shazow/followers","following_url":"https://api.github.com/users/shazow/following{/other_user}","gists_url":"https://api.github.com/users/shazow/gists{/gist_id}","starred_url":"https://api.github.com/users/shazow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shazow/subscriptions","organizations_url":"https://api.github.com/users/shazow/orgs","repos_url":"https://api.github.com/users/shazow/repos","events_url":"https://api.github.com/users/shazow/events{/privacy}","received_events_url":"https://api.github.com/users/shazow/received_events","type":"User","site_admin":false},"created_at":"2016-05-20T19:53:08Z","updated_at":"2016-05-20T19:53:08Z","body":"FWIW I'd be happy for this to live in urllib3."}}
{"actor":{"display_login":"shazow"}}