Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs

Documentation

Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768. The same release added ssl.get_sigalgs(), SSLSocket.client_sigalg() and SSLSocket.server_sigalg() for signature algorithms.

The reference documentation for both sets of methods is thinner than it could be.

Five of them need a specific OpenSSL version and raise NotImplementedError when linked against an older one, but the reference docs don't say so:

• SSLSocket.group() needs OpenSSL 3.2 or later
• SSLContext.get_groups() needs OpenSSL 3.5 or later
• ssl.get_sigalgs() needs OpenSSL 3.4 or later
• SSLSocket.client_sigalg() needs OpenSSL 3.5 or later
• SSLSocket.server_sigalg() needs OpenSSL 3.5 or later

Each requirement is already stated in the What's New in 3.15 entries and enforced in Modules/_ssl.c, so this is only about the reference pages.

There are a few other gaps around the group API. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.

Linked PRs

• gh-154518

Bắt đầu với các trang tham chiếu SSL cho set_groups(), get_groups(), group(), các API thuật toán chữ ký, set_ecdh_curve() và phần TLS 1.3, sau đó so sánh các chi tiết hiện có của chúng với Modules/_ssl.c và các mục trong What's New in 3.15. Công việc được xem là hoàn tất khi các yêu cầu OpenSSL được ghi lại, hành vi NotImplementedError, hỗ trợ nhóm hậu lượng tử, các ví dụ và các tham chiếu chéo bao quát những thiếu sót được mô tả trong issue.