Initial patch by Bruno Piguet.

This is implemented as if a useful .netrc file could exist without passwords,
which is possible in the general case; but in fact our netrc implementation
does not support it.  Fixing that issue will be an enhancement.

Changeset c39f42f46a05 left a dangling head on 3.1.

Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099).

codecs.open().

broke backwards compatibility.

such as was shipped with Centos 5 and Mac OS X 10.4.

libffi to 3.0.13.  (i'm not sure if it is needed anymore but see
issue 10309 for details which makes no mention of upstream; this
change is already in 3.3 and 3.4 but may need reapplying to 2.7
as done here)

  in the merge fun from upstream which already had it in 3.0.13.
* Add the missing update to libffi.info.

from unbuffered (0) to buffering (-1) to match the behavior existing code
expects and match the behavior of the subprocess module in Python 2 to avoid
introducing hard to track down bugs.