gh-89532: Remove LibreSSL workarounds by ramikg · Pull Request #28728 · python/cpython

ramikg · 2021-10-05T04:57:58Z

Python 3.10 drops support for LibreSSL (as per PEP 644), but there are still a few workarounds & mentions of LibreSSL in the source code.

The related PR cleans the code of any LibreSSL workarounds or mentions.

https://bugs.python.org/issue45369

Issue: Remove LibreSSL workarounds #89532

Fixes#89532

tiran

Thanks for your PR.

Python 3.10 didn't actively drop support for LibreSSL. For a lack of better wording, we passively removed compatibility with forks that don't provide OpenSSL 1.1.1 API. I still like to keep some code so we can re-add LibreSSL support later.

bedevere-bot · 2021-10-05T08:23:38Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Co-authored-by: Christian Heimes <christian@python.org>

tiran

Thanks for the quick fix!

ramikg · 2021-10-07T08:44:10Z

I have made the requested changes; please review again

bedevere-bot · 2021-10-07T08:44:12Z

Thanks for making the requested changes!

@tiran: please review the changes made to this pull request.

github-actions · 2021-11-07T00:06:00Z

This PR is stale because it has been open for 30 days with no activity.

dhewg · 2022-07-19T18:40:32Z

For a lack of better wording, we passively removed compatibility with forks that don't provide OpenSSL 1.1.1 API. I still like to keep some code so we can re-add LibreSSL support later.

Some time has passed, and I guess this patch sort of reflects the state of Python v3.10 with LibreSSL v3.5.
It looks like the next version will support SSL_CTX_get_security_level too.
What's left then are those four hash functions, which probably won't be added anytime soon.

Does that change anything for Python w.r.t. LibreSSL support?

dhewg · 2022-07-19T18:49:01Z

Of course I stumble upon this just after posting.
That sounds like it can solve the issue about the missing hashing functions?

tiran · 2022-07-19T19:15:52Z

It is unlikely that we will officially support LibreSSL. Even if LibreSSL would become feature compatible with OpenSSL, we just don't have to resources to test and verify that Python works correctly with LibreSSL.

Is LibreSSL still relevant? AFAIK only OpenBSD uses it. All Linux distros have dropped support for LibreSSL, even Gentoo. FreeBSD uses OpenSSL and NetBSD seems to prefer OpenSSL as well (they have OpenSSL 1.1.1n and LibreSSL 2.7.4 from 2018).

erlend-aasland · 2024-01-05T10:08:09Z

@ramikg, can you resolve the conflicts and update the PR?

ramikg · 2024-01-05T18:35:11Z

@ramikg, can you resolve the conflicts and update the PR?

Sure, done.

gpshead

This PR should not remove RAND_egd, that is something OpenSSL provides.

bedevere-app · 2024-01-06T19:22:06Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

ramikg · 2024-01-06T20:16:12Z

This PR should not remove RAND_egd, that is something OpenSSL provides.

True. I've brought it back, and reworded the comment to be relevant to OpenSSL.
I've kept the try clause so that OpenSSL builds with OPENSSL_NO_EGD won't break.

(By the way, RAND_egd has already been mostly removed from CPython, as I've mentioned here.)

I have made the requested changes; please review again

Remove LibreSSL specific workaround ifdefs from `_ssl.c` and delete the non-version-specific `_ssl_data.h` file (relevant for OpenSSL < 1.1.1, which we no longer support per PEP 644). Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

ramikg added 2 commits September 30, 2021 20:36

Delete _ssl_data.h (relevant for OpenSSL < 1.1.1)
a6c710e

Remove LibreSSL comment from SSL docs
70ecc30

bedevere-bot added the awaiting review label Oct 5, 2021

the-knights-who-say-ni added the CLA signed label Oct 5, 2021

ramikg changed the title ~~bpo-45369: Remove libressl support~~bpo-45369: Remove LibreSSL supportOct 5, 2021

tiran changed the title ~~bpo-45369: Remove LibreSSL support~~bpo-45369: Remove LibreSSL workaroundsOct 5, 2021

tiran requested changes Oct 5, 2021
View reviewed changes

Comment threadLib/test/test_ssl.py Outdated
Comment threadMisc/NEWS.d/next/Core and Builtins/2021-10-05-05-00-16.bpo-45369.tluk_X.rst Outdated
Comment threadTools/ssl/multissltests.py Outdated

bedevere-bot added awaiting changes and removed awaiting review labels Oct 5, 2021

tiran added the needs backport to 3.10 only security fixes label Oct 5, 2021

ramikgand others added 4 commits October 7, 2021 11:40

Remove LIBRESSL_VERSION_NUMBER macro from _ssl.c
156303b

Remove ssl.RAND_egd
2cbea53

📜🤖 Added by blurb_it.
351eaea

Reword LibreSSL news entry
c2a66a8
Co-authored-by: Christian Heimes <christian@python.org>

tiran reviewed Oct 7, 2021
View reviewed changes

bedevere-bot removed the awaiting changes label Oct 7, 2021

bedevere-bot added the awaiting change review label Oct 7, 2021

bedevere-bot requested a review from tiran October 7, 2021 08:44

github-actionsBot added the stale Stale PR or inactive for long period of time. label Nov 7, 2021

dhewg mentioned this pull request Nov 8, 2021
tools: switch LibreSSL to OpenSSL 1.1.1 openwrt/openwrt#4749
Closed

serhiy-storchaka added the needs backport to 3.11 only security fixes label May 20, 2022

ezio-melotti removed the CLA signed label Jul 13, 2022

dhewg mentioned this pull request Jul 18, 2022
openssl: add host build recipe openwrt/openwrt#10299
Open

bedevere-bot added the awaiting review label May 6, 2023

arhadthedev mentioned this pull request May 6, 2023
Renaming issues/PRs incorrectly changes awaiting change review and awaiting merge to awaiting reviewpython/bedevere#556
Closed

pquentin mentioned this pull request May 10, 2023
urllib3>=2.0 does not work with system Python on macOS urllib3/urllib3#3020
Closed

ramikgmannequin mentioned this pull request Jan 5, 2024
Remove LibreSSL workarounds #89532
Closed

Merge branch 'main' into remove-libressl-support
8842a39

ramikg requested a review from ericsnowcurrently as a code owner January 5, 2024 18:07

gpshead removed the needs backport to 3.11 only security fixes label Jan 6, 2024

gpshead requested changes Jan 6, 2024
View reviewed changes

bedevere-appBot added awaiting changes and removed awaiting review labels Jan 6, 2024

erlend-aasland removed pending The issue will be closed if no feedback is provided stale Stale PR or inactive for long period of time. labels Jan 6, 2024

Restore RAND_egd references
b0a2fa4

ramikg requested a review from gpshead January 6, 2024 20:27

switch the other _ssl_data.h reference to _ssl_data_31.h
deabec9

gpshead approved these changes Jan 6, 2024
View reviewed changes

bedevere-appBot added awaiting merge and removed awaiting changes labels Jan 6, 2024

gpshead self-assigned this Jan 6, 2024

gpshead enabled auto-merge (squash) January 6, 2024 23:23

gpshead merged commit 84d1f76 into python:mainJan 6, 2024

bedevere-appBot removed the awaiting merge label Jan 6, 2024

ramikg deleted the remove-libressl-support branch January 7, 2024 06:12

Uh oh!

Uh oh!

Conversation

ramikg commented Oct 5, 2021• edited by gpshead Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tiran left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-bot commented Oct 5, 2021

Uh oh!

tiran left a comment

Choose a reason for hiding this comment

Uh oh!

ramikg commented Oct 7, 2021

Uh oh!

bedevere-bot commented Oct 7, 2021

Uh oh!

github-actionsBot commented Nov 7, 2021

Uh oh!

dhewg commented Jul 19, 2022

Uh oh!

dhewg commented Jul 19, 2022

Uh oh!

tiran commented Jul 19, 2022

Uh oh!

erlend-aasland commented Jan 5, 2024

Uh oh!

ramikg commented Jan 5, 2024

Uh oh!

gpshead left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-appBot commented Jan 6, 2024

Uh oh!

ramikg commented Jan 6, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

ramikg commented Oct 5, 2021•
edited by gpshead
Loading

ramikg commented Jan 6, 2024•
edited
Loading