Mailman 3 - Twisted-web

Twisted 16.3.1 Release Announcement
by Amber "Hawkie" Brown 15 Aug '16

15 Aug '16

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.3.1. This is a bug fix & security fix release, and is recommended for all users of Twisted. The fixes are: - A bugfix for a HTTP/2 edge case, - Fix for CVE-2008-7317 (generating potentially guessable HTTP session identifiers) - Fix for CVE-2008-7318 (sending secure session cookies over insecured connections) - Fix for CVE-2016-1000111 (http://httpoxy.org/ <http://httpoxy.org/>) For more information, check the NEWS file (link provided below). You can find the downloads at <https://pypi.python.org/pypi/Twisted <https://pypi.python.org/pypi/Twisted>> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads <http://twistedmatrix.com/trac/wiki/Downloads>>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-16.3.1/NEWS <https://github.com/twisted/twisted/blob/twisted-16.3.1/NEWS>>. Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted! Twisted Regards, Amber Brown (HawkOwl)

1 0

Re: [Twisted-web] [Twisted-Python] Twisted 16.4.0 Prerelease 1 Announcement
by Glyph Lefkowitz 14 Aug '16

14 Aug '16

> On Aug 14, 2016, at 9:18 PM, John Santos <JOHN(a)egh.com> wrote: > > > Quick check with my app (Python 2.7) which uses twisted.conch and t.c.insults > pretty heavily shows no problems with Twisted 16.4.0. > > I really appreciate the Twisted project's attention to backwards > compatibility, though someday I will port this to Python 3 :-) Thanks a ton for testing the upgrade! -g

1 0

Twisted 16.4.0 Prerelease 1 Announcement
by Amber "Hawkie" Brown 13 Aug '16

13 Aug '16

In a rare Twisted release double feature right after 16.3.1, I bring you the first prerelease of Twisted 16.4.0. This is a big release, the first after the Git migration has really kicked in! And so, here's what it brings us: - twist, a new command line tool for running Twisted plugins, similar to twistd but with a simpler, cleaner interface. - A new interface for Protocols, IHandshakeListener, which tells Twisted to tell the Protocol when the TLS handshake has been completed. - async/await support for Deferreds, allowing you to write Python 3.5+ coroutines using Twisted - Trial can be invoked with "python -m twisted.trial". - 35+ more modules ported to Python 3, and many many cleanups on the way to Python 3 on Windows support. - 240+ closed tickets overall. For more information, check the NEWS file (link provided below). As usual, it's available for download -- go here (https://twistedmatrix.com/Releases/pre/16.4.0pre1/ <https://twistedmatrix.com/Releases/pre/16.4.0pre1/>) to get the prerelease tarballs and the full NEWS file. If you want to install it right away, run: pip install https://twistedmatrix.com/Releases/pre/16.4.0pre1/Twisted-16.4.0rc1.tar.bz2 <https://twistedmatrix.com/Releases/pre/16.4.0pre1/Twisted-16.4.0rc1.tar.bz2> Please let me know if you have any issues, as well as if you don't! If everything works well, that's a good thing for me to know :) Twisted Regards, Amber Brown (HawkOwl)

2 1

Twisted 16.3.1 Prerelease 1 Announcement
by Amber "Hawkie" Brown 10 Aug '16

10 Aug '16

Hi everyone, I've just uploaded the first prerelease of Twisted 16.3.1, a security & critical bug fix release of the 16.3 series. It contains: - A bugfix for a HTTP/2 edge case, - Fix for CVE-2008-7317 (generating potentially guessable HTTP session identifiers) - Fix for CVE-2008-7318 (sending secure session cookies over insecured connections) - Fix for CVE-2016-1000111 (http://httpoxy.org/) You can find the tarball and the full news file for testing at https://twistedmatrix.com/Releases/pre/16.3.1pre1/ . If no issues are found, I will issue a full release by Friday. - Amber

1 0

getSession, componentized but not async?
by Donal McMullan 07 Jul '16

07 Jul '16

I'm curious about request.getSession Per the docs: https://twistedmatrix.com/documents/current/web/howto/using-twistedweb.html It seems like it's tricky to use correctly. My code needs to: - define an Interface - define a class that implements my Interface - call registerAdapter, passing in my class, server.Session and my Interface - get a Session instance - brace myself - create an instance of my Interface class, passing in the Session instance - update that Interface instance.... it will persisted, but only in-memory By default, that data doesn't go to database/memcached/whatever, so it's only accessible in-process On first blush, that seems like a lot of legwork. I'm not clear on what utility's provided by all this versus say maintaining a dict as a class-attribute on Site or something. It's also (for me) counter-intuitive to be creating an instance of an _Interface_ and poking data into it. Also I was a bit surprised that getSession doesn't return a deferred, since it seems like it'd be common to want to persist session data in an external store so that multiple twisted-web processes can access it in a clustered/load-balanced setup. How do other folks go about that? I hacked something together a while ago to run session data into Redis, but what I ended up with required so much surgery on twisted web's classes that I figured I must be doing it wrong. I think Site, SessionFactory and Request were all customised. I was thinking about this again in the context of Cory's "Implement server-side HTTP/2 server push" ticket: https://twistedmatrix.com/trac/ticket/8485 In this context, I'd like to have access to my session data in multiple Resource objects without _necessarily_ having to round-trip to an external store each time to get/put the same data. In the case of http 1.1 requests, I guess there's no way around that round-trip, so it might be optimal if my Resource objects could be oblivious to the underlying protocol version and Session get/put mechanism. So it'd be great if the default Session mechanism could take care of me there, and I could just have my cake and eat it. Another wrinkle that surprised me when I was hacking on this was that there didn't seem to be a way to uniquely identify a request instance, so within the session code it was impossible to tell if two calls to getSession were coming from different points in the callback chain responding to a single Request, or if the second belonged to a different Request entirely. So my confusion is probably apparent at this stage :) I'm guessing others have been here before me. What approaches have you taken to storing your sessions? Are there good open source projects that I should look to for best practice? Thanks! DJM

3 6

Twisted 16.3.0 Release Announcement
by Amber Hawkie Brown 06 Jul '16

06 Jul '16

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.3.0. The highlights of this release are: - The Git migration has happened, so we've updated our development documentation to match. We're now trialling accepting pull requests at github.com/twisted/twisted, so if you've ever wanted an excuse to contribute, now's the chance! - In our steady shedding of baggage, twisted.spread.ui, twisted.manhole (not to be confused with twisted.conch.manhole!), and a bunch of old and deprecated stuff from twisted.python.reflect and twisted.protocols.sip have been removed. - twisted.web's HTTP server now handles pipelined requests better -- it used to try and process them in parallel, but this was fraught with problems and now it processes them in series, which is less surprising to code that expects the Request's transport to not be buffered (e.g. WebSockets). There is also a bugfix for HTTP timeouts not working in 16.2. - Twisted now has HTTP/2 support in its web server! This is currently not available by default -- you will need to install hyper-h2, which is available in the [h2] setuptools extras. If you want to play around with it "pip install twisted[h2]" (on Python 2, a bugfix release will make it available on Python 3) and add "h2" to your Site's acceptableProtocols. - 53 tickets closed overall, including cleanups that move us closer to a total Python 3 port. For more information, check the NEWS file (link provided below). You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-16.3.0/NEWS>. Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted! Twisted Regards, Amber Brown (HawkOwl)

1 0

Twisted 16.3.0 Prerelease 2 Announcement
by Amber "Hawkie" Brown 28 Jun '16

28 Jun '16

Hi everyone, Here's another prerelease in the 16.3 series -- fixing a 16.2 regression in HTTP timeouts not working. For more information, check the NEWS file (link provided below). As usual, it's available for download -- go here (https://twistedmatrix.com/Releases/pre/16.3.0pre2/) to get the prerelease tarballs and the full NEWS file. If you want to install it right away, run: pip install https://twistedmatrix.com/Releases/pre/16.3.0pre2/Twisted-16.3.0rc2.tar.bz2 A reminder that if you would like to try out the newly-landed HTTP/2 support, run: pip install -U https://twistedmatrix.com/Releases/pre/16.3.0pre2/Twisted-16.3.0rc2.tar.bz2… This will download the new HTTP/2 dependencies and the TLS requirements as well. Please let me know if you have any issues, as well as if you don't! If everything works well, that's a good thing for me to know :) Twisted Regards, Amber Brown (HawkOwl)

1 0

Twisted 16.3.0 Prerelease 1 Announcement
by Amber "Hawkie" Brown 15 Jun '16

15 Jun '16

Hello everyone! It's time for yet another Twisted release -- although not long after the last, we have had a bunch of good changes from the PyCon sprints, and some long-awaited work has landed! - The Git migration has happened, so we've updated our development documentation to match. We're now trialling accepting pull requests at github.com/twisted/twisted, so if you've ever wanted an excuse to contribute, now's the chance! - In our steady shedding of baggage, twisted.spread.ui, twisted.manhole (not to be confused with twisted.conch.manhole!), and a bunch of old and deprecated stuff from twisted.python.reflect and twisted.protocols.sip have been removed. - twisted.web's HTTP server now handles pipelined requests better -- it used to try and process them in parallel, but this was fraught with problems and now it processes them in series, which is less surprising to code that expects the Request's transport to not be buffered (e.g. WebSockets). - Twisted now has HTTP/2 support in its web server! This is currently not available by default -- you will need to install hyper-h2, which is available in the [h2] setuptools extras. If you want to play around with it, see the install link below. Upon release, you will be able to simply "pip install twisted[http2]". - 53 tickets closed overall, including cleanups that move us closer to a total Python 3 port. For more information, check the NEWS file (link provided below). As usual, it's available for download -- go here (https://twistedmatrix.com/Releases/pre/16.3.0pre1/) to get the prerelease tarballs and the full NEWS file. If you want to install it right away, run: pip install https://twistedmatrix.com/Releases/pre/16.3.0pre1/Twisted-16.3.0rc1.tar.bz2 If you would like to try out the newly-landed HTTP/2 support, run: pip install -U https://twistedmatrix.com/Releases/pre/16.3.0pre1/Twisted-16.3.0rc1.tar.bz2… This will download the new HTTP/2 dependencies and the TLS requirements as well. Please let me know if you have any issues, as well as if you don't! If everything works well, that's a good thing for me to know :) Twisted Regards, Amber Brown (HawkOwl)

2 1

Twisted 16.2 Release Announcement
by Amber "Hawkie" Brown 18 May '16

18 May '16

On behalf of Twisted Matrix Laboratories, I am honoured to announce the release of Twisted 16.2! Just in time for PyCon US, this release brings a few headlining features (like the haproxy endpoint) and the continuation of the modernisation of the codebase. More Python 3, less deprecated code, what's not to like? - twisted.protocols.haproxy.proxyEndpoint, a wrapper endpoint that gives some extra information to the wrapped protocols passed by haproxy; - Migration of twistd and other twisted.application.app users to the new logging system (twisted.logger); - Porting of parts of Twisted Names' server to Python 3; - The removal of the very old MSN client code and the deprecation of the unmaintained ICQ/OSCAR client code; - More cleanups in Conch in preparation for a Python 3 port and cleanups in HTTP code in preparation for HTTP/2 support; - Over thirty tickets overall closed since 16.1. For more information, check the NEWS file (link provided below). You can find the downloads at <https://pypi.python.org/pypi/Twisted> (or alternatively <http://twistedmatrix.com/trac/wiki/Downloads>). The NEWS file is also available at <https://github.com/twisted/twisted/blob/twisted-16.2.0/NEWS>. Many thanks to everyone who had a part in this release - the supporters of the Twisted Software Foundation, the developers who contributed code as well as documentation, and all the people building great things with Twisted! Twisted Regards, Amber Brown (HawkOwl)

1 0

[INFRASTRUCTURE OUTAGE] Migration of Buildbot to new hardware
by Amber "Hawkie" Brown 14 May '16

14 May '16

Hi everyone, Keeping the infrastructure updates coming! I'm going to be moving the Buildbot to new hardware, so it may be down for today, plus however long DNS takes to propagate. This should only affect Twisted committers running tests on the builder infrastructure; Trac, docs, and everything else will remain online. - Amber

2 2