GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-89532: Remove LibreSSL workarounds by ramikg · Pull Request #28728 · python/cpython

Conversation

@ramikg

@ramikg ramikg commented Oct 5, 2021 •
edited by gpshead
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Python 3.10 drops support for LibreSSL (as per PEP 644), but there are still a few workarounds & mentions of LibreSSL in the source code.

The related PR cleans the code of any LibreSSL workarounds or mentions.

https://bugs.python.org/issue45369

  • Issue: Remove LibreSSL workarounds #89532

Fixes #89532

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
ramikg added 2 commits September 30, 2021 20:36
@ramikg
Delete _ssl_data.h (relevant for OpenSSL < 1.1.1)
a6c710e
@ramikg
Remove LibreSSL comment from SSL docs
70ecc30
@bedevere-bot bedevere-bot added the awaiting review label Oct 5, 2021
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Oct 5, 2021
@ramikg ramikg changed the title bpo-45369: Remove libressl support bpo-45369: Remove LibreSSL support Oct 5, 2021
@tiran tiran changed the title bpo-45369: Remove LibreSSL support bpo-45369: Remove LibreSSL workarounds Oct 5, 2021
tiran
tiran suggested changes Oct 5, 2021
View reviewed changes

@tiran tiran left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your PR.

Python 3.10 didn't actively drop support for LibreSSL. For a lack of better wording, we passively removed compatibility with forks that don't provide OpenSSL 1.1.1 API. I still like to keep some code so we can re-add LibreSSL support later.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
theoparis reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
Comment thread Lib/test/test_ssl.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Misc/NEWS.d/next/Core and Builtins/2021-10-05-05-00-16.bpo-45369.tluk_X.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Tools/ssl/multissltests.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added awaiting changes and removed awaiting review labels Oct 5, 2021
@bedevere-bot

bedevere-bot commented Oct 5, 2021

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran tiran added the needs backport to 3.10 label Oct 5, 2021
ramikg and others added 4 commits October 7, 2021 11:40
@ramikg
Remove LIBRESSL_VERSION_NUMBER macro from _ssl.c
156303b
@ramikg
Remove ssl.RAND_egd
2cbea53
@blurb-it @ramikg
📜🤖 Added by blurb_it.
351eaea
@ramikg @tiran
Reword LibreSSL news entry
c2a66a8 
Co-authored-by: Christian Heimes <[email protected]>
tiran
tiran reviewed Oct 7, 2021
View reviewed changes

@tiran tiran left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the quick fix!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@ramikg

ramikg commented Oct 7, 2021

Copy link
Copy Markdown
Contributor Author

I have made the requested changes; please review again
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the awaiting changes label Oct 7, 2021
@bedevere-bot

bedevere-bot commented Oct 7, 2021

Copy link
Copy Markdown

Thanks for making the requested changes!

@tiran: please review the changes made to this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added the awaiting change review label Oct 7, 2021
@bedevere-bot
bedevere-bot requested a review from tiran October 7, 2021 08:44
@github-actions

github-actions Bot commented Nov 7, 2021

Copy link
Copy Markdown

This PR is stale because it has been open for 30 days with no activity.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@github-actions github-actions Bot added the stale Stale PR or inactive for long period of time. label Nov 7, 2021
@dhewg dhewg mentioned this pull request Nov 8, 2021
tools: switch LibreSSL to OpenSSL 1.1.1 openwrt/openwrt#4749
Closed
@serhiy-storchaka serhiy-storchaka added the needs backport to 3.11 only security fixes label May 20, 2022
@ezio-melotti ezio-melotti removed the CLA signed label Jul 13, 2022
@dhewg dhewg mentioned this pull request Jul 18, 2022
openssl: add host build recipe openwrt/openwrt#10299
Open
@dhewg

dhewg commented Jul 19, 2022

Copy link
Copy Markdown

For a lack of better wording, we passively removed compatibility with forks that don't provide OpenSSL 1.1.1 API. I still like to keep some code so we can re-add LibreSSL support later.

Some time has passed, and I guess this patch sort of reflects the state of Python v3.10 with LibreSSL v3.5.
It looks like the next version will support SSL_CTX_get_security_level too.
What's left then are those four hash functions, which probably won't be added anytime soon.

Does that change anything for Python w.r.t. LibreSSL support?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@dhewg

dhewg commented Jul 19, 2022

Copy link
Copy Markdown

Of course I stumble upon this just after posting.
That sounds like it can solve the issue about the missing hashing functions?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran

tiran commented Jul 19, 2022

Copy link
Copy Markdown
Member

It is unlikely that we will officially support LibreSSL. Even if LibreSSL would become feature compatible with OpenSSL, we just don't have to resources to test and verify that Python works correctly with LibreSSL.

Is LibreSSL still relevant? AFAIK only OpenBSD uses it. All Linux distros have dropped support for LibreSSL, even Gentoo. FreeBSD uses OpenSSL and NetBSD seems to prefer OpenSSL as well (they have OpenSSL 1.1.1n and LibreSSL 2.7.4 from 2018).
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added the awaiting review label May 6, 2023
@arhadthedev arhadthedev mentioned this pull request May 6, 2023
Renaming issues/PRs incorrectly changes awaiting change review and awaiting merge to awaiting review python/bedevere#556
Closed
@pquentin pquentin mentioned this pull request May 10, 2023
urllib3>=2.0 does not work with system Python on macOS urllib3/urllib3#3020
Closed
@ramikg ramikg mannequin mentioned this pull request Jan 5, 2024
Remove LibreSSL workarounds #89532
Closed
@erlend-aasland

erlend-aasland commented Jan 5, 2024

Copy link
Copy Markdown
Contributor

@ramikg, can you resolve the conflicts and update the PR?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ramikg
Merge branch 'main' into remove-libressl-support
8842a39
@ramikg
ramikg requested a review from ericsnowcurrently as a code owner January 5, 2024 18:07
@ramikg

ramikg commented Jan 5, 2024

Copy link
Copy Markdown
Contributor Author

@ramikg, can you resolve the conflicts and update the PR?

Sure, done.
erlend-aasland reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@gpshead gpshead removed the needs backport to 3.11 only security fixes label Jan 6, 2024
gpshead
gpshead requested changes Jan 6, 2024
View reviewed changes

@gpshead gpshead left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR should not remove RAND_egd, that is something OpenSSL provides.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting changes and removed awaiting review labels Jan 6, 2024
@bedevere-app

bedevere-app Bot commented Jan 6, 2024

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@erlend-aasland erlend-aasland removed pending The issue will be closed if no feedback is provided stale Stale PR or inactive for long period of time. labels Jan 6, 2024
@ramikg
Restore RAND_egd references
b0a2fa4
@ramikg

ramikg commented Jan 6, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

This PR should not remove RAND_egd, that is something OpenSSL provides.

True. I've brought it back, and reworded the comment to be relevant to OpenSSL.
I've kept the try clause so that OpenSSL builds with OPENSSL_NO_EGD won't break.

(By the way, RAND_egd has already been mostly removed from CPython, as I've mentioned here.)

I have made the requested changes; please review again
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ramikg
ramikg requested a review from gpshead January 6, 2024 20:27
@gpshead
switch the other _ssl_data.h reference to _ssl_data_31.h
deabec9
gpshead
gpshead approved these changes Jan 6, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting changes labels Jan 6, 2024
@gpshead gpshead self-assigned this Jan 6, 2024
@gpshead
gpshead enabled auto-merge (squash) January 6, 2024 23:23
@gpshead
gpshead merged commit 84d1f76 into python:main Jan 6, 2024
@bedevere-app bedevere-app Bot removed the awaiting merge label Jan 6, 2024
@ramikg
ramikg deleted the remove-libressl-support branch January 7, 2024 06:12
kulikjak pushed a commit to kulikjak/cpython that referenced this pull request Jan 22, 2024
@ramikg @tiran
@gpshead @kulikjak
pythongh-89532: Remove LibreSSL workarounds (python#28728)
75eeed4 
Remove LibreSSL specific workaround ifdefs from `_ssl.c` and delete the non-version-specific `_ssl_data.h` file (relevant for OpenSSL < 1.1.1, which we no longer support per PEP 644).

Co-authored-by: Christian Heimes <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
aisk pushed a commit to aisk/cpython that referenced this pull request Feb 11, 2024
@ramikg @tiran
@gpshead @aisk
pythongh-89532: Remove LibreSSL workarounds (python#28728)
75791d0 
Remove LibreSSL specific workaround ifdefs from `_ssl.c` and delete the non-version-specific `_ssl_data.h` file (relevant for OpenSSL < 1.1.1, which we no longer support per PEP 644).

Co-authored-by: Christian Heimes <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Glyphack pushed a commit to Glyphack/cpython that referenced this pull request Sep 2, 2024
@ramikg @tiran
@gpshead @Glyphack
pythongh-89532: Remove LibreSSL workarounds (python#28728)
0042ba0 
Remove LibreSSL specific workaround ifdefs from `_ssl.c` and delete the non-version-specific `_ssl_data.h` file (relevant for OpenSSL < 1.1.1, which we no longer support per PEP 644).

Co-authored-by: Christian Heimes <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@tiran tiran Awaiting requested review from tiran
@ericsnowcurrently ericsnowcurrently Awaiting requested review from ericsnowcurrently ericsnowcurrently is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Remove LibreSSL workarounds

Uh oh!

There was an error while loading. Please reload this page.

12 participants

@ramikg @bedevere-bot @dhewg @tiran @arhadthedev @orbea @erlend-aasland @gpshead @hugovk @serhiy-storchaka @the-knights-who-say-ni @ezio-melotti
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.