gh-146207: Add support for OpenSSL 4.0.0 alpha1#146217
Draft
vstinner wants to merge 5 commits intopython:mainfrom
Draft
gh-146207: Add support for OpenSSL 4.0.0 alpha1#146217vstinner wants to merge 5 commits intopython:mainfrom
vstinner wants to merge 5 commits intopython:mainfrom
Conversation
OpenSSL 4.0.0 alpha1 no longer defines the symbols: * SSLv3_method * TLSv1_method * TLSv1_1_method * TLSv1_2_method
Member
Author
|
I didn't test my own change on OpenSSL 4.0.0 alpha1, I only asked @heitbaum to test my change. |
Member
|
@vstinner This patch (should, probably :) ) be enough to get you a test in CI, even if we don't want to merge it yet: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2fa2ab768dc..40feaef01ce 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -275,6 +275,7 @@ jobs:
- { name: openssl, version: 3.4.4 }
- { name: openssl, version: 3.5.5 }
- { name: openssl, version: 3.6.1 }
+ - { name: openssl, version: 4.0.0-alpha1 }
## AWS-LC
- { name: aws-lc, version: 1.68.0 }
env: |
Member
Author
|
I applied @zware's patch: Tests / Ubuntu SSL tests (ubuntu-24.04, openssl, 4.0.0-alpha1) job is currently running.
Yeah, I will revert this patch once we get the openssl, 4.0.0-alpha1 CI job result. |
Member
|
Not as simple as hoped :(. I can reproduce the CI failure locally, though; there's a missing symlink (or With that, I get these failures: 2 tests failed:
test_ssl test_urllib2_localnet
43 tests OK.
0:00:23 load avg: 3.07 Re-running 2 failed tests in verbose mode in subprocesses
0:00:23 load avg: 3.07 Run 2 tests in parallel using 2 worker processes
0:00:24 load avg: 3.07 [1/2/1] test_ssl failed (1 failure)
Re-running test_ssl in verbose mode (matching: test_openssl_version)
test_ssl: testing with 'OpenSSL 4.0.0-alpha1 10 Mar 2026' (4, 0, 0, 0, 0)
under 'Linux-6.19.7-200.fc43.x86_64-x86_64-with-glibc2.42'
HAS_SNI = True
OP_ALL = 0x80000050
OP_NO_TLSv1_1 = 0x10000000
test_openssl_version (test.test_ssl.BasicSocketTests.test_openssl_version) ... FAIL
======================================================================
FAIL: test_openssl_version (test.test_ssl.BasicSocketTests.test_openssl_version)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_ssl.py", line 590, in test_openssl_version
self.assertLess(n, 0x40000000)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
AssertionError: 1073741824 not less than 1073741824
----------------------------------------------------------------------
Ran 1 test in 0.007s
FAILED (failures=1)
test test_ssl failed
0:00:24 load avg: 3.07 [2/2/2] test_urllib2_localnet failed (2 errors)
Re-running test_urllib2_localnet in verbose mode (matching: test_https, test_https_sni)
test_https (test.test_urllib2_localnet.TestUrlopen.test_https) ... ERROR
stopping HTTPS server
joining HTTPS thread
test_https_sni (test.test_urllib2_localnet.TestUrlopen.test_https_sni) ... ERROR
stopping HTTPS server
joining HTTPS thread
======================================================================
ERROR: test_https (test.test_urllib2_localnet.TestUrlopen.test_https)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 569, in test_https
data = self.urlopen("https://localhost:%s/bizarre" % handler.port, context=context)
File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 473, in urlopen
l.extend(f.readlines(200))
~~~~~~~~~~~^^^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/http/client.py", line 714, in readline
result = self.fp.readline(limit)
File "/path/to/cpython/bump_multissl_awslc/Lib/socket.py", line 734, in readinto
return self._sock.recv_into(b)
~~~~~~~~~~~~~~~~~~~~^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1355, in recv_into
return self.read(nbytes, buffer)
~~~~~~~~~^^^^^^^^^^^^^^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1154, in read
return self._sslobj.read(len, buffer)
~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
ssl.SSLError: A failure in the SSL library occurred (_ssl.c:2977)
======================================================================
ERROR: test_https_sni (test.test_urllib2_localnet.TestUrlopen.test_https_sni)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 585, in test_https_sni
self.urlopen("https://localhost:%s" % handler.port, context=context)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/test/test_urllib2_localnet.py", line 473, in urlopen
l.extend(f.readlines(200))
~~~~~~~~~~~^^^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/http/client.py", line 714, in readline
result = self.fp.readline(limit)
File "/path/to/cpython/bump_multissl_awslc/Lib/socket.py", line 734, in readinto
return self._sock.recv_into(b)
~~~~~~~~~~~~~~~~~~~~^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1355, in recv_into
return self.read(nbytes, buffer)
~~~~~~~~~^^^^^^^^^^^^^^^^
File "/path/to/cpython/bump_multissl_awslc/Lib/ssl.py", line 1154, in read
return self._sslobj.read(len, buffer)
~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
ssl.SSLError: A failure in the SSL library occurred (_ssl.c:2977)
----------------------------------------------------------------------
Ran 2 tests in 0.122s
FAILED (errors=2)
test test_urllib2_localnet failed
2 tests failed again:
test_ssl test_urllib2_localnet |
Member
Author
|
I tested I fixed a few more issues, but |
Member
Author
I fixed that with a5152be. |
Contributor
|
Tested results in #146207 (comment) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenSSL 4.0.0 alpha1 no longer defines the symbols: