[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Ned Deily : -- assignee: ned.deily -> resolution: -> fixed stage: patch review -> resolved status: open -> closed versions: +Python 2.7, Python 3.7, Python 3.8 ___ Python tracker

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Ned Deily added the comment: New changeset 8ab624b17ba656e9af5a79be6af0cf2911a111ba by Ned Deily (Gregory P. Smith) in branch '3.6': [3.6] bpo-35925: Skip SSL tests that fail due to weak external certs or old TLS (GH-13124) (GH-13252)

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: 3.6 (and 3.5 if larry wants) are the only remaining trees to apply this to, assigning to the 3.6 RM. -- assignee: gregory.p.smith -> ned.deily versions: -Python 2.7 ___ Python tracker

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: New changeset 7346a16ed584fd1e85359154820d286370b68648 by Gregory P. Smith in branch '2.7': [2.7] bpo-35925: Skip SSL tests that fail due to weak external certs or old TLS (GH-13124) (GH-13253)

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Gregory P. Smith : -- pull_requests: +13165 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Gregory P. Smith : -- pull_requests: +13163 stage: backport needed -> patch review ___ Python tracker ___ ___

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: (same on 2.7) -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: In our 3.6 tree the test_ssl failure is now: == ERROR: test_protocol_sslv23 (test.test_ssl.ThreadedTests) Connecting to an SSLv23 server with various client options

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Julien Palard added the comment:  -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: thats https://bugs.python.org/issue36816 (separate issue as our infrastructure is fixed to have a modern certificate). PR pending automerge post-CI. -- ___ Python tracker

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Julien Palard added the comment: I'm still seeing the issue on https://github.com/python/cpython/pull/12255 (freshly rebased to master to have 2cc0223f43a1ffd59c887a73e2b0ce5202f3be90. On this build: https://dev.azure.com/Python/cpython/_build/results?buildId=42065

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Chih-Hsuan Yen : -- nosy: -yan12125 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Chih-Hsuan Yen : -- nosy: +yan12125 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: The merged PR basically skips the specific failing unit test cases of the ssl key strength check error is detected during these network tests. It should probably be backported into 3.6 and 2.7 to ease maintenance and trust of the buildbots on those.

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

miss-islington added the comment: New changeset ffa29b5aca1aaeae46af2582c401ef0ed20d4153 by Miss Islington (bot) in branch '3.7': bpo-35925: Skip SSL tests that fail due to weak external certs. (GH-13124) https://github.com/python/cpython/commit/ffa29b5aca1aaeae46af2582c401ef0ed20d4153

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: New changeset 2cc0223f43a1ffd59c887a73e2b0ce5202f3be90 by Gregory P. Smith in branch 'master': bpo-35925: Skip SSL tests that fail due to weak external certs. (GH-13124) https://github.com/python/cpython/commit/2cc0223f43a1ffd59c887a73e2b0ce5202f3be90

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by miss-islington : -- pull_requests: +13052 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Gregory P. Smith : -- keywords: +patch pull_requests: +13036 stage: needs patch -> patch review ___ Python tracker ___

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: PR coming -- assignee: -> gregory.p.smith ___ Python tracker ___ ___ Python-bugs-list mailing

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: While altering the environment to not use the system default openssl config is an option to make this green again today very easily. That'd "solve" the red bot problem and nothing else. :/ Doing that just kicks the can down the road as all of us Linux

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Steve Dower added the comment: This is still failing regularly - any progress? Do we need to skip tests? -- nosy: +steve.dower ___ Python tracker ___

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

STINNER Victor added the comment: Lukasz: this issue is that Debian Buster uses a strict OpenSSL policy. I guess that external public server used by tests are incompatible with this strict policy. -- nosy: +lukasz.langa ___ Python tracker

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

STINNER Victor added the comment: bpo-36104 has been marked as a duplicate of this issue. Copy of Lukasz's msg336511: The ARMv7 Ubuntu buildbot is consistently failing since build #2160: https://buildbot.python.org/all/#/builders/106/builds/2160 This looks like a testing environment issue

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

STINNER Victor added the comment: After my change: commit 3ef6344ee53f59ee86831ec36ed2c6f93a56229d Author: Victor Stinner Date: Tue Feb 19 18:06:03 2019 +0100 bpo-36037: Fix test_ssl for strict OpenSSL policy (GH-11940) Two tests are still failing on the Debian buildbot worker:

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Charalampos Stratakis added the comment: SSLContext.minimum_version is added here on the master branch: https://github.com/python/cpython/commit/698dde16f60729d9e3f53c23a4ddb8e5ffe818bf But I'd be also reluctant to partially backport a new feature to fix the test suite. --

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Benjamin Peterson added the comment: It's okay with me if you want to backport minimum_version (and I suppose maximum_version). -- ___ Python tracker ___

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

STINNER Victor added the comment: I wrote a fix for bpo-36037 "test_ssl fails on RHEL8 strict OpenSSL configuration" which should fix test_ssl on Debian as well, but my change doesn't apply to Python 2.7 nor 3.6 since these Python versions lack SSLContext.minimum_version attribute

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Charalampos Stratakis added the comment: Getting those failures on RHEL8 as well, which can be worked around by setting the env OPENSSL_CONF=/non-existing-file == ERROR: test_protocol_sslv23 (test.test_ssl.ThreadedTests)

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Benjamin Peterson added the comment: I agree that we need to be more resistant to system configuration, but it doesn't seem worth holding 2.7 up for. -- priority: release blocker -> high ___ Python tracker

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: FWIW I've just manually confirmed that running Python 2.7's test_ssl with OPENSSL_CONF=/invalid-path set passes on the debian buster buildbot host. -- ___ Python tracker

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Gregory P. Smith added the comment: release managers are free to defer this blocker. i'm just marking it as such for the purposes of making sure it is a conscious decision. The problem is more likely with our test suite vs the environment than it is with CPython itself. --

[issue35925] test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a)

Change by Gregory P. Smith : -- title: test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster buildbot -> test_httplib test_nntplib test_ssl fail on ARMv7 Debian buster bot (OpenSSL 1.1.1a) ___ Python tracker