Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI: Bump macOS build to use OpenSSL v3.0 #105538

Merged
merged 8 commits into from
Jun 16, 2023
Merged

CI: Bump macOS build to use OpenSSL v3.0 #105538

merged 8 commits into from
Jun 16, 2023

Conversation

erlend-aasland
Copy link
Contributor

@erlend-aasland erlend-aasland commented Jun 8, 2023 •
edited

@erlend-aasland
Copy link
Contributor Author

Not sure about how far we should backport this. I'll leave it to Ned :)

@ned-deily
Copy link
Member

Not sure about how far we should backport this.

I think it should be the RM's call for each but, based on @gpshead's discussion elsewhere regarding OpenSSL's support policies, I think we definitely should backport to 3.11 and 3.10 and probably also 3.9 and 3.8, given that 1.1.x will be no longer supported before their EOLs. 3.7 should not be backported at the moment at least as all the changes to support 3.0 have not been backported to it and 3.7 is about to hit EOL anyway. Perhaps @pablogsal and @ambv have opinions?

@ned-deily
Copy link
Member

There is one other related task: ensure that the all of the Homebrew OpenSSL versions we use in the GHA Workflows have been updated to the most recent releases. Last time I looked they weren't.

@erlend-aasland erlend-aasland added needs backport to 3.8 only security fixes needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes labels Jun 9, 2023
@erlend-aasland
Copy link
Contributor Author

There is one other related task: ensure that the all of the Homebrew OpenSSL versions we use in the GHA Workflows have been updated to the most recent releases. Last time I looked they weren't.

I added a step that upgrades only openssl@3.0; I'm not sure we should touch the HOMEBREW_NO_AUTO_UPDATE option.

@erlend-aasland
Copy link
Contributor Author

Locally, Homebrew installs OpenSSL 3.0.9, but it seems stuck at v3.0.8 in CI. I tried to disable HOMEBREW_NO_AUTO_UPDATE, but that did not help. Over at my fork, I've also tried to run brew upgrade -f openssl@3.0 (post deps install) and brew fetch -f openssl@3.0 (pre deps install), but none of them seem to have any effect. I'm giving up on this part for now (I don't have the bandwidth to follow this up.)

Perhaps @hugovk has a solution to this?

@hugovk
Copy link
Member

hugovk commented Jun 9, 2023

Hmm, it's downloading from https://ghcr.io/ which is GitHub Packages, does GitHub have their own local cache and it doesn't yet have 3.0.9?

==> Fetching openssl@3.0
==> Downloading https://ghcr.io/v2/homebrew/core/openssl/3.0/manifests/3.0.8
==> Downloading https://ghcr.io/v2/homebrew/core/openssl/3.0/blobs/sha256:bf169df9308d0f428e[22](https://github.com/python/cpython/actions/runs/5219127895/jobs/9420617810?pr=105538#step:4:23)738863b85464af92f970fe823a24ae7a150d79b2bc24
==> Downloading from https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:bf169df9308d0f428e22738863b85464af92f970fe8[23](https://github.com/python/cpython/actions/runs/5219127895/jobs/9420617810?pr=105538#step:4:24)a24ae7a150d79b2bc24?se=2023-06-09T07%3A05%3A00Z&sig=hdu9U%2FPBC5P5q%2BdjeBZYmCaWFcxomsGs2KCpHVEdKGI%3D&sp=r&spr=https&sr=b&sv=2019-12-12
==> Pouring openssl@3.0--3.0.8.monterey.bottle.tar.gz

https://github.com/python/cpython/actions/runs/5219127895/jobs/9420617810?pr=105538#step:4:22

Looks like Homebrew now defaults to a local mirror:

https://docs.brew.sh/Installation#git-remote-mirroring

Perhaps unsetting HOMEBREW_BREW_GIT_REMOTE, or even setting HOMEBREW_NO_INSTALL_FROM_API=1 will help?

@erlend-aasland
Copy link
Contributor Author

Thanks, @hugovk. I tried adjusting the env vars again, also this time adding a brew cleanup --prune=all openssl@3.0, then a brew fetch -f openssl@3.0 step, but no luck.

@erlend-aasland
Copy link
Contributor Author

There is one other related task: ensure that the all of the Homebrew OpenSSL versions we use in the GHA Workflows have been updated to the most recent releases. Last time I looked they weren't.

IMO, we should not let that block this PR. Unless others disagree, I propose to land this PR.

@erlend-aasland erlend-aasland merged commit 34e93d3 into python:main Jun 16, 2023
21 checks passed
@miss-islington

This comment was marked as outdated.

Sign in to view
@erlend-aasland erlend-aasland deleted the macos-openssl-3.0 branch June 16, 2023 19:00
@bedevere-bot
Copy link

GH-105867 is a backport of this pull request to the 3.12 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 16, 2023
@erlend-aasland @miss-islington
CI: Bump macOS build to use OpenSSL v3.0 (pythonGH-105538)
92b02e5 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
@bedevere-bot bedevere-bot removed the needs backport to 3.12 bug and security fixes label Jun 16, 2023
@bedevere-bot
Copy link

GH-105868 is a backport of this pull request to the 3.11 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 16, 2023
@erlend-aasland @miss-islington
CI: Bump macOS build to use OpenSSL v3.0 (pythonGH-105538)
9f74494 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
@miss-islington

This comment was marked as outdated.

Sign in to view
@bedevere-bot bedevere-bot removed the needs backport to 3.11 only security fixes label Jun 16, 2023
@miss-islington

This comment was marked as outdated.

Sign in to view
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jun 16, 2023
@erlend-aasland @miss-islington
CI: Bump macOS build to use OpenSSL v3.0 (pythonGH-105538)
e7a4e82 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
@bedevere-bot
Copy link

GH-105869 is a backport of this pull request to the 3.10 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.10 only security fixes label Jun 16, 2023
@bedevere-bot
Copy link

GH-105871 is a backport of this pull request to the 3.9 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.9 only security fixes label Jun 16, 2023
erlend-aasland added a commit to erlend-aasland/cpython that referenced this pull request Jun 16, 2023
@erlend-aasland
[3.9] CI: Bump macOS build to use OpenSSL v3.0 (pythonGH-105538)
aa288d5 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
@bedevere-bot
Copy link

GH-105872 is a backport of this pull request to the 3.8 branch.

@bedevere-bot bedevere-bot removed the needs backport to 3.8 only security fixes label Jun 16, 2023
erlend-aasland added a commit that referenced this pull request Jun 16, 2023
@miss-islington @erlend-aasland
[3.11] CI: Bump macOS build to use OpenSSL v3.0 (GH-105538) (#105868)
69e2da0 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
erlend-aasland added a commit that referenced this pull request Jun 16, 2023
@miss-islington @erlend-aasland
[3.12] CI: Bump macOS build to use OpenSSL v3.0 (GH-105538) (#105867)
b34f1df 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
shailshouryya pushed a commit to shailshouryya/cpython that referenced this pull request Jun 16, 2023
@erlend-aasland @shailshouryya
CI: Bump macOS build to use OpenSSL v3.0 (python#105538)
0a1d42f 
comment
gvanrossum pushed a commit to gvanrossum/cpython that referenced this pull request Jun 18, 2023
@erlend-aasland @gvanrossum
CI: Bump macOS build to use OpenSSL v3.0 (python#105538)
6431ae2
ambv pushed a commit that referenced this pull request Jul 5, 2023
@miss-islington @erlend-aasland
[3.10] CI: Bump macOS build to use OpenSSL v3.0 (GH-105538) (#105869)
073c660 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
ambv pushed a commit that referenced this pull request Jul 5, 2023
@erlend-aasland
[3.9] CI: Bump macOS build to use OpenSSL v3.0 (GH-105538) (#105871)
38b489b 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
ambv pushed a commit that referenced this pull request Jul 5, 2023
@erlend-aasland
[3.8] CI: Bump macOS build to use OpenSSL v3.0 (GH-105538) (#105872)
1663f8b 
(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
carlosroman pushed a commit to DataDog/cpython that referenced this pull request Oct 11, 2023
@erlend-aasland @carlosroman
[3.9] CI: Bump macOS build to use OpenSSL v3.0 (pythonGH-105538) (pyt…
118d575 
…hon#105871)

(cherry picked from commit 34e93d3)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gpshead gpshead gpshead approved these changes

@ezio-melotti ezio-melotti Awaiting requested review from ezio-melotti ezio-melotti is a code owner

@hugovk hugovk Awaiting requested review from hugovk hugovk is a code owner

@ned-deily ned-deily Awaiting requested review from ned-deily

Assignees

@erlend-aasland erlend-aasland

Labels
skip issue skip news
Projects
OpenSSL 3
Status: Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@erlend-aasland @ned-deily @hugovk @miss-islington @bedevere-bot @gpshead