Tools/ssl/multissltests.py expects to find OpenSSL tarballs in:
https://www.openssl.org/source/

Like: https://www.openssl.org/source/openssl-1.1.1f.tar.gz

Problem: OpenSSL moves old versions to https://www.openssl.org/source/old/

If Tools/ssl/multissltests.py fails to download a tarball (HTTP error 404), it should try to get it from /source/old/.

It would prevent us to have to upgrade OpenSSL version immediately in all Python branches of all CIs (Azure Pipelines and Travis CI) as soon as OpenSSL decides to move a tarball. This move is not under our control.

Upgrading OpenSSL is a good practice. Breaking our CI is not :-)

When OpenSSL moves a tarball, all our pre-commit CIs are broken and suddenly, all PRs can no longer be merged. We have first write PRs to update the configuration of our CI to use the newer OpenSSL version, merge these PRs, and then *all* pending PRs must be rebased on top of these merged PRS to retrieve the newer CI configuration.

There are currently 1085 pending PRs at https://github.com/python/cpython/pulls Well, for most of them, the CI already passed so we can merge them. But if a reviewer requires changes, the CI will re-run and then fail :-(

Moreover, fixing multissltests.py doesn't help neither, since again, PRs should be rebased to retrieve multissltests.py changes.

I hope that I'm wrong and the situation is not so bad.

--

Another solution would be to enhance our workflow to always rebase PRs on the development branch. Something like what https://mergify.io/ does.

I'm not sure what is the configuration of Azure Pipelines, GitHub actions and Travis CI. Would it be possible to make them rebase the PRs before running tests.

Ah crap :/ That's annoying.

This breaks all CI of all our active branches and all open PRs. I'll fix the issue and talk to OpenSSL upstream.

Benjamin, Larry,
The problem affects testing of security-only branches and 2.7.

> talk to OpenSSL upstream.

Do you mean continue to provide old versions in /source/ directory as well? Maybe they move tarballs to /source/old/ on purpose, to force users to use the latest versions which get fixes for new vulnerabilities?

New changeset 938717fd04c53c717895a756d5910e8c8813706c by Christian Heimes in branch 'master':
bpo-40163: Fix multissltest download of old OpenSSL (GH-19329)
https://github.com/python/cpython/commit/938717fd04c53c717895a756d5910e8c8813706c

New changeset 7a89f9b4e2c05a6abdf59e8a96a1fc80a47a1144 by Miss Islington (bot) in branch '3.7':
bpo-40163: Fix multissltest download of old OpenSSL (GH-19329)
https://github.com/python/cpython/commit/7a89f9b4e2c05a6abdf59e8a96a1fc80a47a1144

New changeset fcea08059f46d2d9582bb7ce5b2e905b20b86e8e by Miss Islington (bot) in branch '3.8':
bpo-40163: Fix multissltest download of old OpenSSL (GH-19329)
https://github.com/python/cpython/commit/fcea08059f46d2d9582bb7ce5b2e905b20b86e8e

Thanks for the fix!