Allow CPython to build against cryptography libraries lacking post-handshake authentication

[WillChilds-Klein]

Feature or enhancement

Proposal:

As part of a series of changes discussed on the python Ideas board, this issue proposes placing guards around references to TLSv1.3 post-handshake authentication (PHA). This would CPython to build against cryptography libraries lacking full PHA support.

Has this already been discussed elsewhere?

I have already discussed this feature proposal on Discourse

Links to previous discussion of this feature:

https://discuss.python.org/t/support-building-ssl-and-hashlib-modules-against-aws-lc/44505/9

Linked PRs

• gh-117784: Only reference PHA functions ifndef SSL_VERIFY_POST_HANDSHAKE #117785

[encukou]

Thanks!
As this is meant for unsupported builds, I'll not backport to 3.13. Y'all already have patching mechanism :)

Do you want to send more PRs for this issue?

[WillChilds-Klein]

No more PRs needed unless you'd like me to add an AWS-LC integration test to CPython's CI. Thank you for your reviews!