|
Expand Up
|
@@ -23,13 +23,15 @@ jobs: |
|
|
runs-on: ubuntu-latest |
|
|
outputs: |
|
|
run_tests: ${{ steps.check.outputs.run_tests }} |
|
|
run_ssl_tests: ${{ steps.check.outputs.run_ssl_tests }} |
|
|
steps: |
|
|
- uses: actions/checkout@v2 |
|
|
- name: Check for source changes |
|
|
id: check |
|
|
run: | |
|
|
if [ -z "$GITHUB_BASE_REF" ]; then |
|
|
echo '::set-output name=run_tests::true' |
|
|
echo '::set-output name=run_ssl_tests::true' |
|
|
else |
|
|
git fetch origin $GITHUB_BASE_REF --depth=1 |
|
|
# git diff "origin/$GITHUB_BASE_REF..." (3 dots) may be more |
|
Expand All
|
@@ -46,6 +48,7 @@ jobs: |
|
|
# |
|
|
# https://github.com/python/core-workflow/issues/373 |
|
|
git diff --name-only origin/$GITHUB_BASE_REF.. | grep -qvE '(\.rst$|^Doc|^Misc)' && echo '::set-output name=run_tests::true' || true |
|
|
git diff --name-only origin/$GITHUB_BASE_REF.. | grep -qE '(ssl|hashlib|hmac|^.github)' && echo '::set-output name=run_ssl_tests::true' || true |
|
|
fi |
|
|
|
|
|
check_generated_files: |
|
Expand Down
Expand Up
|
@@ -138,6 +141,11 @@ jobs: |
|
|
run: echo "::add-matcher::.github/problem-matchers/gcc.json" |
|
|
- name: Install Dependencies |
|
|
run: sudo ./.github/workflows/posix-deps-apt.sh |
|
|
- name: Configure OpenSSL env vars |
|
|
run: | |
|
|
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> $GITHUB_ENV |
|
|
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> $GITHUB_ENV |
|
|
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> $GITHUB_ENV |
|
|
- name: 'Restore OpenSSL build' |
|
|
id: cache-openssl |
|
|
uses: actions/[email protected] |
|
Expand All
|
@@ -146,12 +154,65 @@ jobs: |
|
|
key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }} |
|
|
- name: Install OpenSSL |
|
|
if: steps.cache-openssl.outputs.cache-hit != 'true' |
|
|
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory $PWD/multissl --openssl $OPENSSL_VER --system Linux |
|
|
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory $MULTISSL_DIR --openssl $OPENSSL_VER --system Linux |
|
|
- name: Add ccache to PATH |
|
|
run: | |
|
|
echo "PATH=/usr/lib/ccache:$PATH" >> $GITHUB_ENV |
|
|
- name: Configure ccache action |
|
|
uses: hendrikmuhs/ccache-action@v1 |
|
|
- name: Configure CPython |
|
|
run: ./configure --with-pydebug --with-openssl=$PWD/multissl/openssl/$OPENSSL_VER |
|
|
run: ./configure --with-pydebug --with-openssl=$OPENSSL_DIR |
|
|
- name: Build CPython |
|
|
run: make -j4 |
|
|
- name: Display build info |
|
|
run: make pythoninfo |
|
|
- name: Tests |
|
|
run: xvfb-run make buildbottest TESTOPTS="-j4 -uall,-cpu" |
|
|
|
|
|
build_ubuntu_ssltests: |
|
|
name: 'Ubuntu SSL tests with OpenSSL ${{ matrix.openssl_ver }}' |
|
|
runs-on: ubuntu-20.04 |
|
|
needs: check_source |
|
|
if: needs.check_source.outputs.run_tests == 'true' && needs.check_source.outputs.run_ssl_tests == 'true' |
|
|
strategy: |
|
|
fail-fast: false |
|
|
matrix: |
|
|
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1k, 3.0.0-alpha14] |
Comment thread
Outdated
vstinner
Apr 12, 2021
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't we have an accepted PEP which requires OpenSSL 1.1.1 or newer?
Each additional CI increases the error rate since we still have unstable tests in asyncio and multiprocessing tests. I would prefer to not add too many CIs. At least, don't make them mandatory (allow to merge a PR even if they fail).
Rather than pre-commit CI jobs run on every since PR and at every PR update, can't we use a post-commit CI, like a buildbot worker? Issues in pre-commit are way more annoying.
cc @pablogsal @zware
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
tiran
Apr 12, 2021
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't we have an accept PEP which requires OpenSSL 1.1.1 or newer?
Yes, but the PEP applies to 3.10 only. You want OpenSSL 3.0.0 compatibility in 3.8 and 3.9, don't you?
Rather than pre-commit CI jobs run on every since PR and at every PR update, can't we use a post-commit CI, like a buildbot worker? Issues in pre-commit are way more annoying.
I need an easy and reliable way to ensure that Python works with all supported OpenSSL versions. Post-commit CI is too late.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can add OpenSSL < 1.1.1 in the CI jobs when you backport this PR to 3.9 and older. But this PR targets master, so I expect not see OpenSSL < 1.1.1 in this branch.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Each additional CI increases the error rate since we still have unstable tests in asyncio and multiprocessing tests. I would prefer to not add too many CIs. At least, don't make them mandatory (allow to merge a PR even if they fail).
The additional SSL tests are now only executed when any OpenSSL or GHA related file is modified. The SSL tests only execute a couple of selected tests. Multiprocessing tests are skipped. The CI steps are not mandatory.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done."
Ok.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
|
|
env: |
|
|
OPENSSL_VER: ${{ matrix.openssl_ver }} |
|
|
MULTISSL_DIR: ${{ github.workspace }}/multissl |
|
|
OPENSSL_DIR: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }} |
|
|
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib |
|
|
steps: |
|
|
- uses: actions/checkout@v2 |
|
|
- name: Register gcc problem matcher |
|
|
run: echo "::add-matcher::.github/problem-matchers/gcc.json" |
|
|
- name: Install Dependencies |
|
|
run: sudo ./.github/workflows/posix-deps-apt.sh |
|
|
- name: Configure OpenSSL env vars |
|
|
run: | |
|
|
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> $GITHUB_ENV |
|
|
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> $GITHUB_ENV |
|
|
echo "LD_LIBRARY_PATH=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}/lib" >> $GITHUB_ENV |
|
|
- name: 'Restore OpenSSL build' |
|
|
id: cache-openssl |
|
|
uses: actions/[email protected] |
|
|
with: |
|
|
path: ./multissl/openssl/${{ env.OPENSSL_VER }} |
|
|
key: ${{ runner.os }}-multissl-openssl-${{ env.OPENSSL_VER }} |
|
|
- name: Install OpenSSL |
|
|
if: steps.cache-openssl.outputs.cache-hit != 'true' |
|
|
run: python3 Tools/ssl/multissltests.py --steps=library --base-directory $MULTISSL_DIR --openssl $OPENSSL_VER --system Linux |
|
|
- name: Add ccache to PATH |
|
|
run: | |
|
|
echo "PATH=/usr/lib/ccache:$PATH" >> $GITHUB_ENV |
|
|
- name: Configure ccache action |
|
|
uses: hendrikmuhs/ccache-action@v1 |
|
|
- name: Configure CPython |
|
|
run: ./configure --with-pydebug --with-openssl=$OPENSSL_DIR |
|
|
- name: Build CPython |
|
|
run: make -j4 |
|
|
- name: Display build info |
|
|
run: make pythoninfo |
|
|
- name: SSL tests |
|
|
run: ./python Lib/test/ssltests.py |