https://www.openssl.org/news/secadv_20150611.txt

Marking as release blocker for 3.5.0

Make that OpenSSL 1.0.2c now.

Steve?

I'll give it a shot tomorrow. Haven't done it before (not even sure I have the svn.p.o permissions). Do I still need Perl for this?

Yes, you'll need Perl, NASM, and svn on PATH.

I tried to send you an email about this a week or two ago, did I not get it
sent or did it go awry?

Zach, is there a write-up in the devguide for how to do this? And/or
could you send me the same email, please?

Not yet and yes :)

There was an email, though I don't remember whether it was a detailed one.

I'll take notes as I work through it and write something up or contribute them to whoever is writing.

I assume we use svn+ssh:// for this? I can't ssh into svn.python.org with my usual key, so I'm guessing it needs to be set up on there.

Who is best to contact about that?

For SVN access, I think it's probably Martin or perhaps Benjamin. Apparently svn.python.org still lives on the old Europe-based infrastructure...

Perhaps it would be good to switch the externals repo to hg, actually?

Antoine Pitrou added the comment:
> For SVN access, I think it's probably Martin or perhaps Benjamin.

Benjamin was the one who set up my access.

> Perhaps it would be good to switch the externals repo to hg, actually?

Moving away from svn.python.org has been on my to-figure-out list for
some time, but like instructions for the devguide, that hasn't
happened yet either.

The advantage of svn for externals is that nobody needs the history and most people don't need a full enlistment. A hg setup should probably be one repo per project per version, and I'm not sure that's a great idea.

I just wanna say, thanks everybody for tackling this.  Here's hoping it makes it into 3.5 beta 3!

I've emailed Benjamin, but I'm not sure when he was getting back. If I'm blocked on this then I guess Zach will have to do it again.

I got as far as building and testing for 3.5 without any issues. But if I can't check in to the repository then there's not much else I can do. Preparing the sources was smooth enough (though I added a shebang to prepare_ssl so I could run it directly).

Steve: what username did you use?  Try svn+ssh://pythondev@svn.python.org/external

I'm having to set things up in a new-since-last-time VM to be able to do it, so if that works before I get it done, go for it.

Because svn is still on the old infrastructure, it is quite possible Steve's key didn't get added to pythondev's key list.  There might be someone else on infrastructure who could add it, if Benjamin isn't available.

It turns out I have access to the machine: Steve's key is already enabled in the pythondev account.

Yep, Benjamin added it about half an hour ago :)

Should have this done fairly soon.

Already have the source checked in on svn.python.org

Just spotted that. How about I kick off 3.5 and 2.7 with the old build files to test and you get 3.6 and 2.7 new?

Sure, can do.  I already have a test running on 3.4 as well.

It all seems to work (no new failures).

Agreed. Build and obviously related tests are fine.

Would you like to check it in on all branches?  I'm about to be separated from my computer for a while.

Sure, I'll get it.

New changeset 6fd63f0a0026 by Steve Dower in branch '3.4':
Issue #24432: Update Windows builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/6fd63f0a0026

New changeset ebc8559b2e57 by Steve Dower in branch '3.5':
Issue #24432: Update Windows builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/ebc8559b2e57

New changeset 91c5097bca2b by Steve Dower in branch 'default':
Issue #24432: Update Windows builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/91c5097bca2b

New changeset c49d2ea5e48a by Steve Dower in branch '2.7':
Issue #24432: Update Windows builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/c49d2ea5e48a

New changeset 695bbbaf2478 by Ned Deily in branch '2.7':
Issue #24432: Update OS X 10.5+ installer builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/695bbbaf2478

New changeset 4b52fce3753d by Ned Deily in branch '3.4':
Issue #24432: Update OS X 10.5+ installer builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/4b52fce3753d

New changeset bbf4e35ed69e by Ned Deily in branch '3.5':
Issue #24432: Update OS X 10.5+ installer builds to use OpenSSL 1.0.2c.
https://hg.python.org/cpython/rev/bbf4e35ed69e

New changeset fbb9ac8aebfd by Ned Deily in branch 'default':
Issue #24432: merge from 3.5
https://hg.python.org/cpython/rev/fbb9ac8aebfd