Use HTTPS for web service queries

[Freso]

MusicBrainz is now planning to go all HTTPS-only in the future. To begin with, only the non-/ws/ sections of the page with be HTTPS-only, but it is planned that eventually everything will only be accessible through HTTPS - so python-musicbrainzngs should probably make the switch sooner rather than later. :)

Relevant upstream ticket: https://tickets.musicbrainz.org/browse/MBH-363

[mineo]

Does MB use SNI? That is not supported on all Python versions we support.

[gentlecat]

Yes, we've had issues with that before. In CritiqueBrainz we had to add some hacks to access MBS via HTTPS.

[alastair]

I don't mind dropping support for python 2.6 if we need to. Are there any other possible workarounds?

[gentlecat]

https://github.com/metabrainz/critiquebrainz/blob/master/critiquebrainz/__init__.py#L3-L9

[alastair]

Right, https://stackoverflow.com/questions/18578439/using-requests-with-tls-doesnt-give-sni-support/18579484#18579484 shows something similar. We could leave it as "supported with this caveat"

[gentlecat]

Also keep in mind that 2.7 started supporting SNI and a bunch of other things only from 2.7.9.

[sampsyo]

Looks like Requests (i.e., #123) also supports SNI.

EDIT: Oops; @alastair already noticed this!

[alastair]

Yep. I'm happy to start considering requests again, but this won't help anyone using older versions of the library

[alastair]

We talked about this in IRC. Our plan is to:

• default to https://musicbrainz.org
• update set_hostname with a new parameter use_https=False

The new parameter should default to false so that it's backwards compatible with existing code which already calls set_hostname expecting it to connect to an http endpoint

[hugovk]

It's about time to drop Python 2.6 anyway, it's been EOL since 2013 and many packages have already dropped support meaning it's getting harder to support and test.

Luckily, usage is low.

Here's the pip installs for musicbrainzngs from PyPI for the last month:

$ pypinfo --percent --pip musicbrainzngs pyversion
python_version percent download_count
-------------- ------- --------------
2.7              48.0%            617
3.6              29.6%            380
3.5              18.1%            232
3.4               3.4%             44
2.6               0.4%              5
3.3               0.3%              4
3.7               0.2%              3

Python 3.2 and 3.3 are also now EOL, and have even lower numbers, so you could consider dropping those too.

Thoughts?

[Freso]

Considerations for HTTP/HTTPS have come up again for whipper-team/whipper#210 - @alastair, how would you feel about this as a GCI task? :)

[Freso]

Considering that Python 2 will be dead in less than a year, maybe we can just bump the minimum version for the next release (0.7 or 1.0) to Python 2.7.6+ and any future releases by Python 3 only?