gh-146139: Disable `socketpair` authentication on WASI by dicej · Pull Request #146140 · python/cpython

dicej · 2026-03-18T18:10:03Z

Calling connect(2) on a non-blocking socket on WASI may leave the socket in a "connecting" but not yet "connected" state. In the former case, calling getpeername(2) on it will fail, leading to an unhandled exception in Python.

Issue: Fallback socketpair authentication is unreliable on WASI #146139

bedevere-app · 2026-03-18T18:10:07Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

python-cla-bot · 2026-03-18T18:10:08Z

All commit authors signed the Contributor License Agreement.

vstinner

LGTM

Lib/socket.py

vstinner · 2026-03-19T14:10:57Z

@dicej: You should sign the Python CLA: #146140 (comment).

bedevere-app · 2026-03-19T15:33:47Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

dicej · 2026-03-19T15:34:21Z

Regarding the CLA: I've asked my employer for permission to sign it and am awaiting a reply.

vstinner · 2026-03-24T11:00:23Z

Regarding the CLA: I've asked my employer for permission to sign it and am awaiting a reply.

Any update on the CLA @dicej?

dicej · 2026-03-24T13:57:40Z

Any update on the CLA @dicej?

Yes: I need my employer to sign it as an organization to cover my contributions (i.e. I'm not supposed to sign as an individual contributor), which means using this form, but it's not clear how we should fill that out given that the signatory (i.e. the person with authority to sign for the whole organization) and the contributor(s) (e.g. me) will be different people. I sent an email to psf@python.org for clarification and was redirected to contributors@python.org, but haven't heard back yet.

Given this is effectively a one-line change modulo whitespace, it all feels like overkill, but this should unblock future contributions as well.

brettcannon · 2026-03-24T18:28:58Z

it's not clear how we should fill that out given that the signatory (i.e. the person with authority to sign for the whole organization) and the contributor(s) (e.g. me) will be different people.

It's fine if they are different people. The key thing is if someone from Akamai is submitting for the entire org then they just need to be empowered to sign such a form to say any contributions coming from someone on work time is covered by the CLA.

dicej · 2026-03-27T16:49:03Z

I still haven't received a response from contributors@python.org. Can anyone confirm that, if an authorized party at Akamai signs the CLA form on behalf of Akamai, any contributions from a @akamai.com email address will be covered?

vstinner · 2026-03-30T20:42:26Z

@ambv: Do you know how to proceed for the CLA in this case?

JacobCoffee · 2026-04-09T19:22:45Z

The company has to sign on the Python.org website, checking the box for signing as an organization.

The Contributor Agreement page you're looking at now is ONLY for signing Contributor Agreements on behalf of organizations.

and the individual has to sign via GitHub sign-in through https://cla.python.org/ which cover that individuals contributions

Calling `connect(2)` on a non-blocking socket on WASI may leave the socket in a "connecting" but not yet "connected" state. In the former case, calling `getpeername(2)` on it will fail, leading to an unhandled exception in Python.

Co-authored-by: Victor Stinner <vstinner@python.org>

bedevere-app · 2026-04-13T13:19:49Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

dicej · 2026-04-13T13:20:48Z

Thanks, @JacobCoffee. The CLA is signed now.

bedevere-app · 2026-04-13T20:09:39Z

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

brettcannon · 2026-04-13T20:09:51Z

@dicej can you look at the failures (e.g. missing a news entry)?

vstinner · 2026-04-13T20:40:24Z

"_RegenSbom" failed with "HTTP error 503: Service Unavailable" on Windows. I re-ran the failed (Windows) jobs.

vstinner

(Still) LGTM.

vstinner · 2026-04-13T20:41:43Z

Let's skip the NEWS entry.

miss-islington-app · 2026-04-13T21:06:41Z

Thanks @dicej for the PR, and @vstinner for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

…H-146140) Calling `connect(2)` on a non-blocking socket on WASI may leave the socket in a "connecting" but not yet "connected" state. In the former case, calling `getpeername(2)` on it will fail, leading to an unhandled exception in Python. (cherry picked from commit a5b76d53bb29afd864243f44ef22968f6385dfa0) Co-authored-by: Joel Dice <joel.dice@akamai.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Brett Cannon <brett@python.org>

bedevere-app · 2026-04-13T21:06:49Z

GH-148526 is a backport of this pull request to the 3.14 branch.

…H-146140) Calling `connect(2)` on a non-blocking socket on WASI may leave the socket in a "connecting" but not yet "connected" state. In the former case, calling `getpeername(2)` on it will fail, leading to an unhandled exception in Python. (cherry picked from commit a5b76d5) Co-authored-by: Joel Dice <joel.dice@akamai.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Brett Cannon <brett@python.org>

bedevere-app · 2026-04-13T21:06:54Z

GH-148527 is a backport of this pull request to the 3.13 branch.

vstinner · 2026-04-13T21:16:26Z

Thanks @dicej for the fix and signing the CLA. I backported the fix to 3.13 and 3.14 branches.

) (#148527) gh-146139: Disable `socketpair` authentication on WASI (GH-146140) Calling `connect(2)` on a non-blocking socket on WASI may leave the socket in a "connecting" but not yet "connected" state. In the former case, calling `getpeername(2)` on it will fail, leading to an unhandled exception in Python. (cherry picked from commit a5b76d5) Co-authored-by: Joel Dice <joel.dice@akamai.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Brett Cannon <brett@python.org>

) (#148526) gh-146139: Disable `socketpair` authentication on WASI (GH-146140) Calling `connect(2)` on a non-blocking socket on WASI may leave the socket in a "connecting" but not yet "connected" state. In the former case, calling `getpeername(2)` on it will fail, leading to an unhandled exception in Python. (cherry picked from commit a5b76d5) Co-authored-by: Joel Dice <joel.dice@akamai.com> Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Brett Cannon <brett@python.org>

bedevere-app bot mentioned this pull request Mar 18, 2026

Fallback socketpair authentication is unreliable on WASI #146139

Closed

bedevere-app bot added the awaiting review label Mar 18, 2026

vstinner approved these changes Mar 19, 2026

View reviewed changes

Lib/socket.py Outdated Show resolved Hide resolved

bedevere-app bot added awaiting merge and removed awaiting review labels Mar 19, 2026

brettcannon added the OS-wasi label Mar 24, 2026

dicej and others added 2 commits April 13, 2026 07:19

Update Lib/socket.py

e71d5a7

Co-authored-by: Victor Stinner <vstinner@python.org>

dicej force-pushed the disable-sockepair-auth-on-wasi branch from eb851ef to e71d5a7 Compare April 13, 2026 13:19

Merge branch 'main' into disable-sockepair-auth-on-wasi

c1cb472

vstinner approved these changes Apr 13, 2026

View reviewed changes

vstinner added the skip news label Apr 13, 2026

vstinner enabled auto-merge (squash) April 13, 2026 20:42

vstinner added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Apr 13, 2026

vstinner merged commit a5b76d5 into python:main Apr 13, 2026
86 of 95 checks passed

bedevere-app bot removed the awaiting merge label Apr 13, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Apr 13, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 13, 2026

Uh oh!

Conversation

dicej commented Mar 18, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-app bot commented Mar 18, 2026

Uh oh!

python-cla-bot bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vstinner commented Mar 19, 2026

Uh oh!

bedevere-app bot commented Mar 19, 2026

Uh oh!

dicej commented Mar 19, 2026

Uh oh!

vstinner commented Mar 24, 2026

Uh oh!

dicej commented Mar 24, 2026

Uh oh!

brettcannon commented Mar 24, 2026

Uh oh!

dicej commented Mar 27, 2026

Uh oh!

vstinner commented Mar 30, 2026

Uh oh!

JacobCoffee commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-app bot commented Apr 13, 2026

Uh oh!

dicej commented Apr 13, 2026

Uh oh!

bedevere-app bot commented Apr 13, 2026

Uh oh!

brettcannon commented Apr 13, 2026

Uh oh!

vstinner commented Apr 13, 2026

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

vstinner commented Apr 13, 2026

Uh oh!

Uh oh!

miss-islington-app bot commented Apr 13, 2026

Uh oh!

bedevere-app bot commented Apr 13, 2026

Uh oh!

bedevere-app bot commented Apr 13, 2026

Uh oh!

vstinner commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

dicej commented Mar 18, 2026 •

edited by bedevere-app bot

Loading

python-cla-bot bot commented Mar 18, 2026 •

edited

Loading

JacobCoffee commented Apr 9, 2026 •

edited

Loading