Upgrade to OpenSSL 1.1.1c, 1.1.0k, and/or 1.0.2s

[tiran]

BPO	34631
Nosy	@pfmoore, @ronaldoussoren, @tiran, @tjguk, @ned-deily, @alex, @zware, @zooba, @dstufft, @miss-islington
PRs	bpo-34631: Update test infra to OpenSSL 1.1.1b #12094 [2.7] bpo-34631: Updated OpenSSL to 1.0.2s in Windows installer (GH-14161) #14161 bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer #14163 [3.8] bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer (GH-14163) #14164 [3.7] bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer (GH-14163) #14165 bpo-34631: Update OpenSSL to 1.1.1c in macOS installer #14187 [3.8] bpo-34631: Updated OpenSSL to 1.1.1c in macOS installer (GH-14187) #14189 [3.7] bpo-34631: Updated OpenSSL to 1.1.1c in macOS installer (GH-14187) #14190 [2.7] bpo-34631: Updated OpenSSL to 1.0.2s in macOS installer. #14198

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2019-06-18.10:50:43.756>
created_at = <Date 2018-09-11.17:13:46.164>
labels = ['OS-mac', 'expert-SSL', 'deferred-blocker', '3.7', '3.8', '3.9', 'type-feature', 'OS-windows']
title = 'Upgrade to OpenSSL 1.1.1c, 1.1.0k, and/or 1.0.2s'
updated_at = <Date 2019-06-18.10:50:43.755>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2019-06-18.10:50:43.755>
actor = 'ned.deily'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2019-06-18.10:50:43.756>
closer = 'ned.deily'
components = ['macOS', 'Windows', 'SSL']
creation = <Date 2018-09-11.17:13:46.164>
creator = 'christian.heimes'
dependencies = []
files = []
hgrepos = []
issue_num = 34631
keywords = ['patch']
message_count = 17.0
messages = ['325034', '336846', '338748', '345826', '345836', '345868', '345875', '345886', '345887', '345893', '345911', '345932', '345933', '345959', '345962', '345963', '345980']
nosy_count = 11.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'janssen', 'christian.heimes', 'tim.golden', 'ned.deily', 'alex', 'zach.ware', 'steve.dower', 'dstufft', 'miss-islington']
pr_nums = ['12094', '14161', '14163', '14164', '14165', '14187', '14189', '14190', '14198']
priority = 'deferred blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue34631'
versions = ['Python 2.7', 'Python 3.7', 'Python 3.8', 'Python 3.9']

[tiran]

OpenSSL 1.1.1 was released today. The blog post https://www.openssl.org/blog/blog/2018/09/11/release111/ lists all major improvements.

Highlights:

• TLS 1.3
• API and ABI compatible with OpenSSL 1.1.0
• LTS release (support schedule TBD)

All tests on master are passing with OpenSSL 1.1.1. I still want to hold off and wait a couple of patch releases, before we start to ship Windows and macOS builds with 1.1.1. Some aspects of the TLS 1.3 handshake are different to TLS 1.2. I might have to implement some additional APIs for post handshake authentication.

[tiran]

Hi macOS and Windows devs,

as I explained in https://mail.python.org/pipermail/python-dev/2019-February/156470.html we need to update Python 3.7 to OpenSSL 1.1.1 eventually. 1.1.0 will reach EOL in September.

[ned-deily]

[From the cited python-dev email]:

"Python 3.7 and master (3.8) are affected. As of now, both branches use
OpenSSL 1.1.0 and must be updated to 1.1.1 soonish. Ned has scheduled
3.7.3 release for 2019-03-25. That's still well within the release
schedule for 1.1.0. I suggest that we update to 1.1.1 directly after the
release of Python 3.7.3 and target 3.7.4 as first builds with TLS 1.3
support. That gives Victor, Steve, and me enough time to sort out the
remaining issues."

So setting the priority here to "deferred blocker" as a reminder to take care of this prior to 3.8.0b1 (2019-05-26) and 3.7.4rc1 (2019-06-10) at the latest.

[ned-deily]

It looks we missed the window for 3.7.4 here. (I assume the Windows installer build is not using 1.1.1. Steve?) Talking with Christian about this in IRC, we agreed, the CI pipelines (Azure and travis) are now using 1.1.1c and I've put a request to the buildbot owners to upgrade to 1.1.1c if possible. So let's retarget 1.1.1c for 3.7.5 then which will be right around the time 1.1.0 support ends. In the meantime, we should update other installers to 1.1.0k and 1.0.2s.

[ned-deily]

(I assume the Windows installer build is not using 1.1.1. Steve?)

After doing a little more homework and better understanding PCbuild/get_externals.bat, https://github.com/python/cpython-source-deps, and https://github.com/python/cpython-bin-deps and their twisting branches, it appears we *are* using 1.1.1, in particular, 1.1.1b for 3.7 and 3.8 Windows builds. So:

1. Can/should be try to update to 1.1.1c for 3.7.4 on Windows, and

2. Should I try to update the macOS installer to 1.1.1c for 3.7.4?

For the latter, I'll give it a try and see how smoothly it goes before making a final decision.

[zooba]

The canonical source of versions used on Windows is in PCbuild/python.props

I'll pull the 1.1.1c sources into cpython-source-deps and run a build. If all goes smoothly, we can consider it, but I don't have a huge amount of time for CPython this week I'm afraid.

[zooba]

New changeset d8e3a8a by Steve Dower in branch '2.7':
bpo-34631: Updated OpenSSL to 1.0.2s in Windows installer (GH-14161)
d8e3a8a

[zooba]

The tests seem to pass fine for 1.1.1c against master, so I'll merge that and see if the backport is also okay.

[zooba]

New changeset a268edd by Steve Dower in branch 'master':
bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer (GH-14163)
a268edd

[zooba]

New changeset c28c135 by Steve Dower (Miss Islington (bot)) in branch '3.8':
bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer (GH-14163)
c28c135

[zooba]

Ned - the 3.7 backport seems to be okay (PR 14165). Do we want it?

[ned-deily]

Might as well, thanks!

[zooba]

New changeset 14bac00 by Steve Dower in branch '3.7':
bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer (GH-14163)
14bac00

[ned-deily]

New changeset f3fb839 by Ned Deily in branch 'master':
bpo-34631: Updated OpenSSL to 1.1.1c in macOS installer (GH-14187)
f3fb839

[miss-islington]

New changeset bd75abf by Miss Islington (bot) in branch '3.8':
bpo-34631: Updated OpenSSL to 1.1.1c in macOS installer (GH-14187)
bd75abf

[miss-islington]

New changeset 0f3abbc by Miss Islington (bot) in branch '3.7':
bpo-34631: Updated OpenSSL to 1.1.1c in macOS installer (GH-14187)
0f3abbc

[ned-deily]

New changeset a5b1b22 by Ned Deily in branch '2.7':
bpo-34631: Updated OpenSSL to 1.0.2s in macOS installer. (GH-14198)
a5b1b22