Seen on "AMD64 Snow Leopard 2 3.x" buildbot:

=====================================================================
ERROR: test_options (test.test_ssl.ContextTests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/buildbot/buildarea/3.x.parc-snowleopard-1/build/Lib/test/test_ssl.py", line 81, in f
    return func(*args, **kwargs)
  File "/Users/buildbot/buildarea/3.x.parc-snowleopard-1/build/Lib/test/test_ssl.py", line 362, in test_options
    ctx.options = (ctx.options & ~ssl.OP_NO_SSLv2) | ssl.OP_NO_TLSv1
ValueError: can't clear options before OpenSSL 0.9.8m

http://www.python.org/dev/buildbot/all/builders/AMD64%20Snow%20Leopard%202%203.x/builds/581/steps/test/logs/stdio

I think that the regression was introduced by one of the following build (build 571 didn't run the test suite):

http://www.python.org/dev/buildbot/all/builders/AMD64%20Snow%20Leopard%202%203.x/builds/571
http://www.python.org/dev/buildbot/all/builders/AMD64%20Snow%20Leopard%202%203.x/builds/572

The OpenSSL version linked against is "OpenSSL 0.9.8r 8 Feb 2011", but apparently the source headers are still those for an earlier version, hence the apparent failure (the headers don't have the necessary API).
Bill, could you please upgrade the OpenSSL headers on that buildbot to match the runtime version (if that's possible)?

Two problems: (1) on OS X builds, libssl is dynamically linked to _ssl.so so there is a potential disconnect when combining checking versions based on a compile time check (as in _ssl.c) with an execution time check of the actual loaded library (as in test_ssl.py) and (2) in point releases (like 10.6.x), Apple often deliberately does not update the include files for libraries that were released in a major release (like 10.6).  As of 10.6.8, the /usr/include/openssl headers are at 0.9.8l but /usr/lib/libssl0.9.8.dylib is at 0.9.8r.

That said, we will probably need to supply our own libssl for Python installers in the future as there are rumors that Apple has hinted it may no longer supply openssl in the future.

New changeset 52ed0c6bb461 by Antoine Pitrou in branch '3.2':
Issue #12440: When testing whether some bits in SSLContext.options can be
http://hg.python.org/cpython/rev/52ed0c6bb461

New changeset 4120cd8a86f4 by Antoine Pitrou in branch 'default':
Issue #12440: When testing whether some bits in SSLContext.options can be
http://hg.python.org/cpython/rev/4120cd8a86f4

Should be fixed now.

> That said, we will probably need to supply our own libssl for Python
> installers in the future as there are rumors that Apple has hinted it
> may no longer supply openssl in the future.

What about their own Python? Will it come without an ssl module?