From 8b9379a89e7b5799bc64aec548d6fba41933e228 Mon Sep 17 00:00:00 2001 From: Athanasius Date: Wed, 18 Jan 2023 11:44:51 +0000 Subject: [PATCH] PLUGINS: Document that they should use `requests`, not `urllib`, and why --- PLUGINS.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/PLUGINS.md b/PLUGINS.md index 9cc2c3f3..b0626cfb 100644 --- a/PLUGINS.md +++ b/PLUGINS.md @@ -381,6 +381,20 @@ So instead use: # During shutdown ``` +### Use `requests`, not `urllib` for HTTP(S) requests +We use `requests` in lots of core code, so it will always be available. An +advantage to using it, instead of the core `urllib`, is that it brings in +`certifi` with its own set of trusted root certificates. + +We've seen issues where a plugin was using `urllib`, which uses the **system** +certificate store, and a user's system didn't yet have a new root certificate +that was necessary for the operation of a URL the plugin was acessing. + +We keep `requests`, and thus `certifi` up to date via GitHub's dependabot. If +there is ever a certificate update that we don't have in a release then +please open a +[bug report](https://github.com/EDCD/EDMarketConnector/issues/new?assignees=&labels=bug%2C+unconfirmed&template=bug_report.md&title=). + --- ## Plugin Hooks