classification
Title: Pre-build OpenSSL and Tcl/Tk for Windows
Type: enhancement Stage: commit review
Components: Build, Windows Versions: Python 3.7
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: steve.dower Nosy List: alex, christian.heimes, dstufft, gregory.p.smith, haypo, janssen, paul.moore, steve.dower, tim.golden, zach.ware
Priority: normal Keywords:

Created on 2017-07-12 22:37 by steve.dower, last changed 2017-07-17 09:26 by steve.dower.

Pull Requests
URL Status Linked Edit
PR 2688 merged steve.dower, 2017-07-12 22:39
Messages (6)
msg298249 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2017-07-12 22:37
To save time and improve reliability while building CPython, we should pre-build and sign OpenSSL and Tcl/Tk binaries and make it a binary dependency.

Our slightly-patched sources will still be available, and it will be relatively easy for people to download and rebuild them, but for most cases (particularly CI/buildbots) we will be able to reuse prebuilt binaries.

Since they need to be signed, this basically means it's my responsibility to update the GitHub repo whenever we update Tcl, Tk, Tix or OpenSSL versions. As is usual whenever I get a job, I promise to find a way to mostly automate it :)
msg298269 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2017-07-13 06:51
@Zach - FYI, this will make it unnecessary to run prepare_ssl.bat when checking in updated sources. Rather, this script now requires Perl to do the entire build, so we don't have to have any difference between our source bundle and the original OpenSSL one.
msg298378 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2017-07-14 23:19
Zach opted out of reviewing right now, so I went ahead and pushed my builds to the GitHub repos so that AppVeyor can run.

It built and ran fine (which I'm not surprised about), but it was only 1-2 minutes faster on AppVeyor (which I _am_ surprised about).

Tcl/tk/tix take longer than that to build on my dev machine, as does OpenSSL, so I'm not sure how AppVeyor was getting them to build so quickly. But in any case, it is definitely faster now, and I suspect more for our devs than our CI. OpenSSL can also be more easily upgraded, and the entire library is now available via ctypes, so all up I think it's a win (+ssl and hashlib experts in case they disagree).

Anyone want to take a look at the change before I merge?
msg298467 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2017-07-17 09:15
New changeset 68d663cf85d1ac5eaf83482eed39c0a6f8093601 by Steve Dower in branch 'master':
[bpo-30916] Pre-build OpenSSL and Tcl/Tk for Windows (#2688)
https://github.com/python/cpython/commit/68d663cf85d1ac5eaf83482eed39c0a6f8093601
msg298468 - (view) Author: STINNER Victor (haypo) * (Python committer) Date: 2017-07-17 09:22
Failure:
http://buildbot.python.org/all/builders/AMD64%20Windows7%20SP1%203.x/builds/750
msg298470 - (view) Author: Steve Dower (steve.dower) * (Python committer) Date: 2017-07-17 09:26
The buildbot failure blamed on this issue is actually due to issue30450 - it's the first time we've added a new external, and so the inability to download Python via Powershell on Windows 7 is the problem, not this.
History
Date User Action Args
2017-07-17 09:26:35steve.dowersetstage: commit review
2017-07-17 09:26:20steve.dowersetmessages: + msg298470
2017-07-17 09:22:06hayposetnosy: + haypo
messages: + msg298468
2017-07-17 09:15:52steve.dowersetmessages: + msg298467
2017-07-14 23:19:14steve.dowersetnosy: + gregory.p.smith, janssen, christian.heimes, alex, dstufft
messages: + msg298378
2017-07-13 06:51:10steve.dowersetmessages: + msg298269
2017-07-12 22:39:45steve.dowersetpull_requests: + pull_request2753
2017-07-12 22:37:45steve.dowercreate