Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs

Documentation

Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768. The same release added ssl.get_sigalgs(), SSLSocket.client_sigalg() and SSLSocket.server_sigalg() for signature algorithms.

The reference documentation for both sets of methods is thinner than it could be.

Five of them need a specific OpenSSL version and raise NotImplementedError when linked against an older one, but the reference docs don't say so:

• SSLSocket.group() needs OpenSSL 3.2 or later
• SSLContext.get_groups() needs OpenSSL 3.5 or later
• ssl.get_sigalgs() needs OpenSSL 3.4 or later
• SSLSocket.client_sigalg() needs OpenSSL 3.5 or later
• SSLSocket.server_sigalg() needs OpenSSL 3.5 or later

Each requirement is already stated in the What's New in 3.15 entries and enforced in Modules/_ssl.c, so this is only about the reference pages.

There are a few other gaps around the group API. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.

Linked PRs

• gh-154518

Commencez par les pages de référence SSL consacrées à set_groups(), get_groups(), group(), aux API d’algorithmes de signature, à set_ecdh_curve() et à la section TLS 1.3, puis comparez leurs détails actuels avec Modules/_ssl.c et les entrées de What's New in 3.15. Le travail sera considéré comme terminé lorsque les exigences documentées d’OpenSSL, le comportement de NotImplementedError, la prise en charge des groupes post-quantiques, les exemples et les renvois croisés couvriront les lacunes décrites dans l’issue.