https://github.com/python/cpython/commit/114aa8c402bd9289c8bd5b59137b14cf2f5dc64b commit: 114aa8c402bd9289c8bd5b59137b14cf2f5dc64b branch: 3.15 author: Miss Islington (bot) <[email protected]> committer: serhiy-storchaka <[email protected]> date: 2026-07-19T15:30:29+03:00 summary:
[3.15] gh-154053: Fix compilation of the ssl module against LibreSSL (GH-154054) (GH-154075) LibreSSL does not provide SSL_CTX_set1_sigalgs_list() or SSL_CTX_set1_client_sigalgs_list(), added in gh-138252, so _ssl failed to compile against LibreSSL on 3.15+. Guard the set_server_sigalgs() and set_client_sigalgs() methods so they raise NotImplementedError on LibreSSL, and skip the corresponding tests. (cherry picked from commit 39b058f8ad29238edc8b65406bb1fb0bc3c0020d) Co-authored-by: Serhiy Storchaka <[email protected]> files: A Misc/NEWS.d/next/Library/2026-07-19-00-00-00.gh-issue-154053.LibreSSLsigalgs.rst M Lib/test/test_ssl.py M Modules/_ssl.c diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 90fe087ecb8511..d7ffe91bf31dc9 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -49,12 +49,15 @@ PROTOCOLS = sorted(ssl._PROTOCOL_NAMES) HOST = socket_helper.HOST IS_AWS_LC = "AWS-LC" in ssl.OPENSSL_VERSION +IS_LIBRESSL = "LibreSSL" in ssl.OPENSSL_VERSION IS_OPENSSL_3_0_0 = ssl.OPENSSL_VERSION_INFO >= (3, 0, 0) CAN_GET_SELECTED_OPENSSL_GROUP = ssl.OPENSSL_VERSION_INFO >= (3, 2) CAN_IGNORE_UNKNOWN_OPENSSL_GROUPS = ssl.OPENSSL_VERSION_INFO >= (3, 3) CAN_GET_AVAILABLE_OPENSSL_GROUPS = ssl.OPENSSL_VERSION_INFO >= (3, 5) CAN_GET_AVAILABLE_OPENSSL_SIGALGS = ssl.OPENSSL_VERSION_INFO >= (3, 4) -CAN_SET_CLIENT_SIGALGS = not IS_AWS_LC +# LibreSSL does not provide SSL_CTX_set1_(client_)sigalgs_list(). +CAN_SET_CLIENT_SIGALGS = not IS_AWS_LC and not IS_LIBRESSL +CAN_SET_SERVER_SIGALGS = not IS_LIBRESSL CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS = ssl.OPENSSL_VERSION_INFO >= (3, 3) CAN_GET_SELECTED_OPENSSL_SIGALG = ssl.OPENSSL_VERSION_INFO >= (3, 5) PY_SSL_DEFAULT_CIPHERS = sysconfig.get_config_var('PY_SSL_DEFAULT_CIPHERS') @@ -1082,6 +1085,8 @@ def test_set_client_sigalgs(self): if CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS: self.assertIsNone(ctx.set_client_sigalgs('rsa_pss_rsae_sha256:?foo')) + @unittest.skipUnless(CAN_SET_SERVER_SIGALGS, + "SSL library doesn't support setting server sigalgs") def test_set_server_sigalgs(self): ctx = ssl.create_default_context() @@ -4593,6 +4598,8 @@ def test_client_sigalgs_mismatch(self): chatty=True, connectionchatty=True, sni_name=hostname) + @unittest.skipUnless(CAN_SET_SERVER_SIGALGS, + "SSL library doesn't support setting server sigalgs") def test_server_sigalgs(self): # server rsa_pss_rsae_sha384, client auto sigalg = "rsa_pss_rsae_sha384" @@ -4613,6 +4620,8 @@ def test_server_sigalgs(self): if CAN_GET_SELECTED_OPENSSL_SIGALG: self.assertEqual(stats['server_sigalg'], sigalg) + @unittest.skipUnless(CAN_SET_SERVER_SIGALGS, + "SSL library doesn't support setting server sigalgs") def test_server_sigalgs_mismatch(self): client_context, server_context, hostname = testing_context() client_context.set_server_sigalgs("rsa_pss_rsae_sha256") diff --git a/Misc/NEWS.d/next/Library/2026-07-19-00-00-00.gh-issue-154053.LibreSSLsigalgs.rst b/Misc/NEWS.d/next/Library/2026-07-19-00-00-00.gh-issue-154053.LibreSSLsigalgs.rst new file mode 100644 index 00000000000000..3d453eb7314345 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-07-19-00-00-00.gh-issue-154053.LibreSSLsigalgs.rst @@ -0,0 +1,4 @@ +Fix compilation of the :mod:`ssl` module against LibreSSL, which does not +provide ``SSL_CTX_set1_sigalgs_list()`` and ``SSL_CTX_set1_client_sigalgs_list()``. +The :meth:`!set_server_sigalgs` and :meth:`!set_client_sigalgs` methods of +:class:`ssl.SSLContext` now raise :exc:`NotImplementedError` on LibreSSL. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index f451c0ce7364ab..af402f471a327d 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -3863,6 +3863,10 @@ _ssl__SSLContext_set_client_sigalgs_impl(PySSLContext *self, #ifdef OPENSSL_IS_AWSLC _setSSLError(get_state_ctx(self), "can't set client sigalgs on AWS-LC", 0, __FILE__, __LINE__); return NULL; +#elif defined(LIBRESSL_VERSION_NUMBER) + PyErr_SetString(PyExc_NotImplementedError, + "setting client sigalgs is not supported by LibreSSL"); + return NULL; #else if (!SSL_CTX_set1_client_sigalgs_list(self->ctx, sigalgslist)) { _setSSLError(get_state_ctx(self), "unrecognized signature algorithm", 0, __FILE__, __LINE__); @@ -3884,11 +3888,17 @@ _ssl__SSLContext_set_server_sigalgs_impl(PySSLContext *self, const char *sigalgslist) /*[clinic end generated code: output=31ecb1d310285644 input=653b752e4f8d801b]*/ { +#ifdef LIBRESSL_VERSION_NUMBER + PyErr_SetString(PyExc_NotImplementedError, + "setting server sigalgs is not supported by LibreSSL"); + return NULL; +#else if (!SSL_CTX_set1_sigalgs_list(self->ctx, sigalgslist)) { _setSSLError(get_state_ctx(self), "unrecognized signature algorithm", 0, __FILE__, __LINE__); return NULL; } Py_RETURN_NONE; +#endif } static int _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
