GeezerVison

Moves the 3.7 line from OpenSSL 1.1.1 (EOL September 2023; 1.1.1w is the last build in the inventory) to OpenSSL 3, as 3.7.17.9. The ActiveState 3.9.25.x and 3.10.22.x lines already ship OpenSSL 3.5.9 on Linux and Windows. This brings 3.7 to the same footing.

What's in it

• Upstream ssl changes the 3.9 line got for OpenSSL 3, cherry-picked with -x:
  • bpo-43794: OP_IGNORE_UNEXPECTED_EOF by default. Without it, a peer that closes without close_notify raises SSLError: unexpected eof while reading instead of returning b''. That broke 103 cases across test_ssl, test_imaplib and test_urllib2_localnet, and it would break http.client, urllib and pip against many real servers.
  • bpo-39953, bpo-40266, bpo-43788: per-version _ssl_data error tables. With OpenSSL 3, 3.7's old table misnamed errors, for example [SSL: KRB5_S_TKT_NYV] unexpected eof.
  • bpo-43789: the password callback is no longer called again after an error.
  • Test updates: bpo-4379 and bpo-41561 (TLS 1.0/1.1 tests skip when unavailable), bpo-46114 (version check).
• Windows build. PCbuild/openssl.props copied lib*-1_1.dll from the import-library directory. OpenSSL 3 puts its DLLs in bin\ and names them libssl-3.dll.
  • python.props now sets opensslBinDir: bin\ when the OpenSSL tree has one, otherwise the import-library directory.
  • openssl.props takes the DLL suffix from SSL_MAJOR_VERSION/SSL_MINOR_VERSION, which the Platform's python-builder sets. Without them it detects a 3.x OpenSSL from bin\ and otherwise assumes 1.1. The -x64 suffix is added only when such a DLL exists.
  • This is the file shape python-builder expects. Its NoSuffixOpenSSL step deletes the -x64 line and stops if the line is missing, the same as for 3.9 and 3.10. So 3.7.17.9 moves from python-legacy-builder (and its --legacy-ssl option set) to python-builder. The legacy builder's 1.1-only rewrite no longer matches this file.
• Release notes: a 3.7.17.9 section in Doc/whatsnew/3.7.rst, including the behavior changes that come with OpenSSL 3 itself:
  • the default security level refuses TLS 1.0/1.1, SHA-1 signatures and short RSA keys;
  • MD4 and whirlpool are in the legacy provider;
  • extension modules must be built against OpenSSL 3.
• Doc cleanup: removed the pasted citation markers (NVD+5SUSE+5linux.oracle.com+5, starwindsoftware.com+2, ...) from the 3.7.17.7 notes, and fixed the short heading underlines of 3.7.17.4 through 3.7.17.7.

Not included

• bpo-43799 (OPENSSL_API_COMPAT, OPENSSL_NO_DEPRECATED): it's only a deprecation-warning cleanup, and it depends on 3.9's rewritten _hashopenssl.c. With it, 3.7's _ssl.c would no longer compile. The build keeps its deprecation warnings.
• The 3.9 hashlib rework for OpenSSL 3 (bpo-40479): not needed. With OpenSSL 3.5.9, 3.7's hashlib behaves the same as 3.9's on the same OpenSSL:
  • md4 and whirlpool raise ValueError cleanly;
  • algorithms_available lists nothing unusable;
  • pbkdf2, scrypt and hmac are unchanged.

Testing

• Linux x86_64, built against the Platform's OpenSSL 3.5.9 (headers and libraries from the 3.9.25.4 runtime):
  • Before the ports, 3 of 17 SSL/hash-related modules failed: test_ssl, test_imaplib and test_urllib2_localnet. All 17 now pass. The modules are test_ssl, test_hashlib, test_hmac, test_httplib, test_urllib2_localnet, test_imaplib, test_poplib, test_smtplib, test_ftplib, test_nntplib, test_asyncio, test_logging, test_urllib2, test_xmlrpc, test_ensurepip, test_venv and test_crypt.
  • Full regrtest against a 1.1.1w build of 3.7.17.8, run side by side: 386 and 385 modules OK. The same five modules fail on both (test_cmd_line, test_concurrent_futures, test_email, test_socket, test_urllib2), and no test case fails only on the OpenSSL 3 build.
• Linux, against OpenSSL 1.1.1w: the branch still builds, and test_ssl, test_hashlib, test_imaplib, test_urllib2_localnet and test_httplib pass.
• Windows x64 (EC2 test box, VS 2022 v143), against the Platform's shared/openssl 3.5.9 artifact:
  • Built the way python-builder builds: SSL_MAJOR_VERSION=3, SSL_MINOR_VERSION=5, and the -x64 line removed with the builder's own pattern (exactly one match). The build copies libcrypto-3.dll and libssl-3.dll with their .pdb files.
  • A plain build with neither variable set copies the same DLLs.
  • ssl.OPENSSL_VERSION is 3.5.9.
  • 13 modules pass: test_ssl, test_hashlib, test_hmac, test_httplib, test_urllib2_localnet, test_imaplib, test_poplib, test_smtplib, test_ftplib, test_asyncio, test_logging, test_urllib2 and test_xmlrpc.
  • The unclean-close and hashlib probes match Linux.

After merge

• Tag v3.7.17.9.
• Inventory language/python 3.7.17.9, starting from 3.7.17.8:
  • builder/python-legacy-builder becomes builder/python-builder, under the same condition 3.8.20.2 uses;
  • drop the legacy-openssl option set (--legacy-ssl);
  • drop the < 3 cap on shared/openssl;
  • drop the Windows shared/ffi < 3.4.6 cap. 3.7's _ctypes on Windows compiles the bundled libffi_msvc, so the Platform's libffi isn't linked and the libffi 3.5+ ctypes fix 3.9 and 3.10 needed doesn't apply;
  • drop windows-python-core-openssl eq 1.1.1u, which only the old non-alternative build path uses.
• Core-Python-3.7 rebuild, then core-qa on Windows and Linux against the 3.7.17.8 runtime.
• No GitHub CI runs on 3.7.17.x PRs, so the testing above is the verification.