Anvil-uplink for Python >= 3.12 Solves AttributeError: module 'ssl' has no attribute 'wrap_socket'

[ianb]

The main reason why anvil-uplink is incompatible with 3.12 and above is the library it uses for ssl is ws4py found here: ws4py · PyPI

The built in ssl library in python was updated to nest a method used by anvil / ws4py behind another connection context object. (Its a breaking change for a reason, see why farther down)

So I forked the ws4py project and made the nessisary changes to re-enable the use of that method, you can see all of the changes here:

Comparing Lawouach:master...ib-buywise:master · Lawouach/WebSocket-for-Python

If you want to use it, put the following in your pip requirements file before anvil-uplink
(for example):

requirements.txt

ws4py @ git+https://github.com/ib-buywise/WebSocket-for-Python.git
anvil-uplink

or from your cli / pip:

pip install ws4py @ git+https://github.com/ib-buywise/WebSocket-for-Python.git
then
pip install anvil-uplink

Two things about this:

1. The reason why this method was deprecated in 3.12 is that using the old method allows ssl connections without the use of valid ssl certificates. This new code still does not change the use of ssl certificates. I can’t make anvil change the server, so it is only as secure as the current implementation of anvil uplink, it is not more secure or as secure as the people who write python 3.12 want you to be. It only implements the backwards compatibility they built into 3.12.

See this post by @p.colbert for the details:

Anvil uplink SSL error

Welcome to the Forum! I use Anvil Uplink regularly, but only up to Python 3.10, to avoid problems like this. As the very latest version of Python, I consider 3.12 to be somewhat “bleeding edge”. Clearly, Anvil Uplink 0.4.2 (the latest version on PyPI) hasn’t been vetted against it. 3.12 has removed wrap_socket: The deprecation note suggests how one might code up a replacement. I don’t know how practical it might be to hack up your local copy of the Anvil Uplink package, to incorporate th…

2. You don’t have to use pip to install my fork of ws4py, you can fork it yourself and implement the same changes if you want, or edit your own ws4py installation files (not recommended) or whatever. If you click on the changes above in the github difference link you will see its only like 4 lines of code.
   1/2 of which isn’t even used with anvil.

Why I bothered to do this…

ws4py hasn’t had a major update in years, and I did not see them coming to the rescue any time soon.
I expect anvil will eventually either move away from it, or fork it and use the ssl certificate features correctly by setting up valid ssl certificates on the anvil server.
I also have no means of or will to make someone else implement working ssl certificates until they are ready to do so.

[p.colbert]

@ianb, thank you so much! Not only for making this available, but also for explaining the context, your unusual steps, and all the caveats that come with this workaround. Everyone who wants to make use of your efforts should understand the situation well, and thanks to you, they can.

[ianb]

I’m guessing nobody should do anything above this, they should probably just update anvil-uplink:

[Security Advisory] Upgrade your Uplink library to v0.5.1

TL;DR: If you use the Uplink, you need to pip install --upgrade anvil-uplink Hi folks, It is my unpleasant duty to announce a security issue with anvil-uplink versions prior to v0.5.1. It turns out that a library we have been using was incorrectly implementing TLS, and not verifying server certificates. This opens the door to a whole range of nasties: if someone can fool your DNS or otherwise intercept your uplink connections, they could impersonate your Uplink script to An…

@ianb

allows ssl connections without the use of valid ssl certificates. This new code still does not change the use of ssl certificates. I can’t make anvil change the server

Now I feel like I should have been proactive about asking all the who what why’s.

I’m going to private my fork on github so the link breaks.