issue2551350 - Python changes for 3.12 with roundup 2.3.0 mailer.py

Fix due to change in smtplib.SMTP.starttls() signature.

As of 3.3 it can use an optional ssl context argument for
certificates/keys. In 3.12 it dropped legacy support for specifing
cert/key files as arguments and requires a context.

I modified Andrew's original patch to initialize SSLContext with
ssl.PROTOCOL_TLS_CLIENT.

If there is a cert file specified, enable
  check_hostname - verify that the cert supplied by the server matches
       the hostname we supplied.

If there is no cert file call

  load_default_certs()

Also opened issue2551351 to look into more SMTP ssmtp tightening.  We
also should have an option in Roundup to use TLS/SSL (smtps) without
using starttls.

Note that this code is untested by the test suite due to the need to
setup an SMTP server with STARTTLS support. issue2551351 has some
notes on this.

CHANGES.txt

@@ -145,6 +145,9 @@ Fixed:
 - issue2551350 - Python changes for 3.12 with roundup 2.3.0. Fixes for
   cgitb.py crash due to pydoc.html.header() signature change. (Patch
   by Andrew (kragacles), applied John Rouillard)
+- issue2551350 - Python changes for 3.12 with roundup 2.3.0. Fixes for
+  mailer.py crash due to change in starttls signature change. (Patch
+  by Andrew (kragacles), modified and applied John Rouillard)
 
 Features:
 

roundup/mailer.py

@@ -6,6 +6,7 @@
 import os
 import smtplib
 import socket
+import ssl
 import sys
 import time
 import traceback
@@ -312,8 +313,18 @@ def __init__(self, config):
         # start the TLS if requested
         if config["MAIL_TLS"]:
             self.ehlo()
-            self.starttls(config["MAIL_TLS_KEYFILE"],
-                          config["MAIL_TLS_CERTFILE"])
+            if sys.version_info[0:2] >= (3, 6):
+                sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                if config["MAIL_TLS_CERTFILE"]:
+                    sslctx.load_cert_chain(config["MAIL_TLS_CERTFILE"],
+                                           keyfile=config["MAIL_TLS_KEYFILE"])
+                    sslctx.check_hostname = True
+                else:
+                    sslctx.load_default_certs()
+                self.starttls(context=sslctx)
+            else:
+                self.starttls(config["MAIL_TLS_KEYFILE"],
+                              config["MAIL_TLS_CERTFILE"])
 
         # ok, now do we also need to log in?
         mailuser = config["MAIL_USERNAME"]