GeezerVison

Don't we have an accepted PEP which requires OpenSSL 1.1.1 or newer?

Each additional CI increases the error rate since we still have unstable tests in asyncio and multiprocessing tests. I would prefer to not add too many CIs. At least, don't make them mandatory (allow to merge a PR even if they fail).

Rather than pre-commit CI jobs run on every since PR and at every PR update, can't we use a post-commit CI, like a buildbot worker? Issues in pre-commit are way more annoying.

cc @pablogsal @zware

Don't we have an accept PEP which requires OpenSSL 1.1.1 or newer?

Yes, but the PEP applies to 3.10 only. You want OpenSSL 3.0.0 compatibility in 3.8 and 3.9, don't you?

Rather than pre-commit CI jobs run on every since PR and at every PR update, can't we use a post-commit CI, like a buildbot worker? Issues in pre-commit are way more annoying.

I need an easy and reliable way to ensure that Python works with all supported OpenSSL versions. Post-commit CI is too late.

You can add OpenSSL < 1.1.1 in the CI jobs when you backport this PR to 3.9 and older. But this PR targets master, so I expect not see OpenSSL < 1.1.1 in this branch.

Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done.

Each additional CI increases the error rate since we still have unstable tests in asyncio and multiprocessing tests. I would prefer to not add too many CIs. At least, don't make them mandatory (allow to merge a PR even if they fail).

The additional SSL tests are now only executed when any OpenSSL or GHA related file is modified. The SSL tests only execute a couple of selected tests. Multiprocessing tests are skipped. The CI steps are not mandatory.

"Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done."

Ok.

"Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done."

Ok.