From d12cf9aee1707ef0667cfa36f33fd64233e35833 Mon Sep 17 00:00:00 2001
From: ed <s@ocv.me>
Date: Tue, 16 Dec 2025 20:27:55 +0000
Subject: [PATCH] u2c: fix deprecation + add -teh

---
 bin/partyfuse.py | 9 +++++----
 bin/u2c.py       | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/bin/partyfuse.py b/bin/partyfuse.py
index 0d88caca..7be355e1 100755
--- a/bin/partyfuse.py
+++ b/bin/partyfuse.py
@@ -6,8 +6,8 @@ __copyright__ = 2019
 __license__ = "MIT"
 __url__ = "https://github.com/9001/copyparty/"
 
-S_VERSION = "2.1"
-S_BUILD_DT = "2025-09-06"
+S_VERSION = "2.2"
+S_BUILD_DT = "2025-12-16"
 
 """
 mount a copyparty server (local or remote) as a filesystem
@@ -284,8 +284,8 @@ class Gateway(object):
             if ar.td:
                 self.ssl_context = ssl._create_unverified_context()
             elif ar.te:
-                self.ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS)
-                self.ssl_context.load_verify_locations(ar.te)
+                self.ssl_context = ssl.create_default_context(cafile=ar.te)
+                self.ssl_context.check_hostname = ar.teh
 
         self.conns = {}
 
@@ -1165,6 +1165,7 @@ NOTE: if server has --usernames enabled, then password is "username:password"
 
     ap2 = ap.add_argument_group("https/TLS")
     ap2.add_argument("-te", metavar="PEMFILE", help="certificate to expect/verify")
+    ap2.add_argument("-teh", action="store_true", help="require correct hostname in -te cert")
     ap2.add_argument("-td", action="store_true", help="disable certificate check")
 
     ap2 = ap.add_argument_group("cache/perf")
diff --git a/bin/u2c.py b/bin/u2c.py
index 16173cb4..cbd6595e 100755
--- a/bin/u2c.py
+++ b/bin/u2c.py
@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 from __future__ import print_function, unicode_literals
 
-S_VERSION = "2.16"
-S_BUILD_DT = "2025-12-11"
+S_VERSION = "2.17"
+S_BUILD_DT = "2025-12-16"
 
 """
 u2c.py: upload to copyparty
@@ -165,8 +165,8 @@ class HCli(object):
             elif self.verify is True:
                 self.ctx = None
             else:
-                self.ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
-                self.ctx.load_verify_locations(self.verify)
+                self.ctx = ssl.create_default_context(cafile=self.verify)
+                self.ctx.check_hostname = ar.teh
 
         self.base_hdrs = {
             "Accept": "*/*",
@@ -1593,6 +1593,7 @@ NOTE: if server has --usernames enabled, then password is "username:password"
 
     ap = app.add_argument_group("tls")
     ap.add_argument("-te", metavar="PATH", help="path to ca.pem or cert.pem to expect/verify")
+    ap.add_argument("-teh", action="store_true", help="require correct hostname in -te cert")
     ap.add_argument("-td", action="store_true", help="disable certificate check")
     # fmt: on