ssl.OPENSSL_VERSION still reporting 1.1.1i on windows 3.8.9/3.9.4

[mrginglymus]

BPO	43745
Nosy	@pfmoore, @tiran, @tjguk, @ambv, @zware, @zooba, @pablogsal, @miss-islington, @tirkarthi, @mrginglymus
PRs	bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. #25213 [3.9] bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213) #25214 [3.8] bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213) #25223

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-04-06.15:05:38.558>
created_at = <Date 2021-04-06.10:23:58.456>
labels = ['type-security', '3.8', '3.9', '3.10', 'release-blocker', 'OS-windows']
title = 'ssl.OPENSSL_VERSION still reporting 1.1.1i on windows 3.8.9/3.9.4'
updated_at = <Date 2021-04-09.12:02:51.580>
user = 'https://github.com/mrginglymus'

bugs.python.org fields:

activity = <Date 2021-04-09.12:02:51.580>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2021-04-06.15:05:38.558>
closer = 'steve.dower'
components = ['Windows']
creation = <Date 2021-04-06.10:23:58.456>
creator = 'Bill Collins'
dependencies = []
files = []
hgrepos = []
issue_num = 43745
keywords = ['patch']
message_count = 17.0
messages = ['390303', '390307', '390308', '390309', '390317', '390318', '390320', '390324', '390328', '390342', '390343', '390346', '390351', '390363', '390516', '390538', '390597']
nosy_count = 10.0
nosy_names = ['paul.moore', 'christian.heimes', 'tim.golden', 'lukasz.langa', 'zach.ware', 'steve.dower', 'pablogsal', 'miss-islington', 'xtreak', 'Bill Collins']
pr_nums = ['25213', '25214', '25223']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43745'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

[mrginglymus]

>>> import sys,ssl
>>> sys.version
'3.9.4 (tags/v3.9.4:1f2e308, Apr  4 2021, 13:27:16) [MSC v.1928 64 bit (AMD64)]'
>>> ssl.OPENSSL_VERSION
'OpenSSL 1.1.1i  8 Dec 2020'

I may well be holding it wrong, but something seems off.

[zooba]

No, I think I was holding git wrong (and built 1.1.1i again instead of 1.1.1k).

Guess we get to do more releases...

[tiran]

Uh :(

No more holiday releases, please. The RMs and release team need their vacation.

[zooba]

No more holiday releases, please. The RMs and release team need their vacation.

I agree, can you ask OpenSSL to stop releasing fixes? (or alternatively, can you convince everyone to let us switch to the native TLS stack on Windows where the upstream fixes are released before they are announced to the world ;) )

[tirkarthi]

Given that the PR is against master is this issue present in Python 3.10 alphas too since last alpha was released today.

[zooba]

It is, but I wouldn't hold up an alpha or beta release because of this.

[zooba]

New changeset 354b015 by Steve Dower in branch 'master':
bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
354b015

[ambv]

I elect to replace 3.9.4 Windows installers.

1. It's a Windows installer specific problem, no other users are affected.

2. You can always reinstall. You can tell by the dates reported by the REPL or in fact by checking ssl.OPENSSL_VERSION.

3. There will be 3.9.5 on May 3 anyway soon enough.

[zooba]

Yeeeessss.... we caaaann.... I think we may regret it, but happy to go with it if you'd prefer.

FWIW, the code change isn't necessary if you do a totally clean rebuild. However, most builders do not do totally clean rebuilds, so the code change ensures that they are not caught out.

(Confirmation just came through another channel, so I'm doing a rebuild of the v3.9.4 and v3.8.9 tags now.)

[zooba]

New changeset 611aa39 by Steve Dower in branch '3.9':
bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
611aa39

[zooba]

A new 3.9.4 and 3.8.9 release is available for download from python.org. The Nuget and Windows Store packages will have to remain as the original versions, since those do not allow us to overwrite with the same version number.

[miss-islington]

New changeset 9a988b8 by Miss Islington (bot) in branch '3.8':
bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
9a988b8

[mrginglymus]

Thanks for the quick action on this!

I've downloaded the new 3.8.9/3.9.4 installers, but they are unable to run over my existing 3.8.9/3.9.4 installs; "Unable to install python 3.9.4 (64-bit) due to an existing install." This is probably fine as I can just uninstall/reinstall (I hope), so just FYI.

I've upgraded my 32-bit install from 3.9.2 to the new 3.9.4 installer without issue.

Are you able to also update the embeddable packages please?

[zooba]

Are you able to also update the embeddable packages please?

They've been updated, it's just the CDN hasn't purged those files. I
need to add those files to the script.

It should show up within 24 hours, if I don't start doing the script
tonight.

[mrginglymus]

The embeddable dists for 3.9.4 have updated, but the 3.8.9 packages are still showing the builds from April 2nd.

[zooba]

I just purged the CDN again and it seems to be fine now.

[mrginglymus]

Confirmed, thanks!