I remember now why we had None here before: we wanted to avoid creating a shared default object in the API which should be immutable/comparable. So I think we need something else here:

• A sentinel object (we deliberately chose not to do this IIRC)
• Do not define the default, and specify that a missing TrustStore should default to the system trust store. This is my preference.

Do not define the default, and specify that a missing TrustStore should default to the system trust store. This is my preference.

I don't understand, can you add an example?

We wanted to avoid creating a shared default object in the API which should be immutable/comparable.

I think there is room for a TrustStore.is_system(truststore) method.

Yeah, what I was thinking of does not work. I think a larger problem is that TrustStore objects are currently not immutable. I would propose to make them immutable by freezing them (which means I need to fix some path handling in the stdlib, but that's probably fine) which would make it fine to assign the system trust store as a default parameter.

We could then consider making the configs frozen as well. What do you think?

Making the class immutable means that implementations that require one of _path or _buffer can't have the following:

which is a pattern that is implemented in both tlslib.stdlib (buffer->path) and siotls (path->buffer).

I think we need to discuss the three TrustStore, Certificate and PrivateKey APIs more12. For the time being, I suggest we add a TrustStore.is_system() method to solve the problem at hand and have the discussion about immutability and path->buffer/buffer->path elsewhere.

+1 to have the configuration immutable. It already is a frozen dataclass in siotls. I'll push a commit to specify it in the spec.

Footnotes

1. https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543-a-unified-tls-api-for-python/51263/71: § Certificate Chain, Certificate Revocation List ↩

2. https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543-a-unified-tls-api-for-python/51263/71: § Save DER in-place ↩

No need to change the spec, it already says that the configuration objects are immutable (emphasis mine):

For this reason, we split the responsibility of SSLContext into two separate objects, which are each split into server and client versions. The TLSServerConfiguration and TLSClientConfiguration objects act as containers for a TLS configuration: the ClientContext and ServerContext objects are instantiated with a TLSClientConfiguration and TLSServerConfiguration object, respectively, and are used to create buffers or sockets. All four objects would be immutable.