Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade Windows and macOS installer builds to OpenSSL 1.1.1g #84345

Closed
ned-deily opened this issue Apr 3, 2020 · 23 comments
Closed

Upgrade Windows and macOS installer builds to OpenSSL 1.1.1g #84345

ned-deily opened this issue Apr 3, 2020 · 23 comments
Labels
3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes OS-mac OS-windows

Comments

@ned-deily
Copy link
Member

BPO 40164
Nosy @pfmoore, @ronaldoussoren, @tiran, @tjguk, @ned-deily, @ambv, @zware, @zooba, @srinivasreddy, @miss-islington
PRs
  • bpo-40164: Update Windows to OpenSSL 1.1.1f #19359
  • [3.8] bpo-40164: Update Windows to OpenSSL 1.1.1f (GH-19359) #19361
  • [3.7] bpo-40164: Update Windows to OpenSSL 1.1.1f (GH-19359) #19362
  • bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g. #19642
  • [3.8] bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g. (GH-19642) #19643
  • [3.7] bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g. (GH-19642) #19644
  • bpo-40164: Update Windows OpenSSL to 1.1.1g #20834
  • [3.9] bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834) #20839
  • [3.8] bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834) #20840
  • [3.7] bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834) #20841
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-06-12.21:22:14.701>
created_at = <Date 2020-04-03.00:56:28.796>
labels = ['OS-mac', '3.8', '3.9', '3.10', '3.7', 'OS-windows']
title = 'Upgrade Windows and macOS installer builds to OpenSSL 1.1.1g'
updated_at = <Date 2020-06-12.22:35:11.583>
user = 'https://github.com/ned-deily'

    bugs.python.org fields:

    activity = <Date 2020-06-12.22:35:11.583>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2020-06-12.21:22:14.701>
closer = 'steve.dower'
components = ['macOS', 'Windows']
creation = <Date 2020-04-03.00:56:28.796>
creator = 'ned.deily'
dependencies = []
files = []
hgrepos = []
issue_num = 40164
keywords = ['patch']
message_count = 23.0
messages = ['365657', '365727', '365764', '365766', '365767', '366932', '366940', '366955', '366970', '366971', '366972', '369244', '369245', '371343', '371401', '371402', '371404', '371414', '371417', '371419', '371421', '371422', '371426']
nosy_count = 10.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'christian.heimes', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'thatiparthy', 'miss-islington']
pr_nums = ['19359', '19361', '19362', '19642', '19643', '19644', '20834', '20839', '20840', '20841']
priority = None
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue40164'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']
    @ned-deily
    Copy link
    Member Author

    1.1.1f released 2020-03-31

    Reminder to Windows team to update Windows build.

    Reminder to macOS team to update macOS installer build.
    (note: please don't submit a PR or patch for this!)

    https://www.openssl.org/source/

    @ned-deily ned-deily added deferred-blocker 3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes OS-mac OS-windows labels Apr 3, 2020
    @zooba
    Copy link
    Member

    zooba commented Apr 3, 2020

    I've pushed new binaries for OpenSSL 1.1.1f on Windows. I'll try and to the rest over the weekend, but if someone else wants to do the PCbuild PR feel free.

    @zooba
    Copy link
    Member

    zooba commented Apr 4, 2020

    New changeset a1d4dbd by Steve Dower in branch 'master':
    bpo-40164: Update Windows to OpenSSL 1.1.1f (GH-19359)
    a1d4dbd

    @zooba
    Copy link
    Member

    zooba commented Apr 4, 2020

    New changeset 37126e7 by Steve Dower in branch '3.8':
    bpo-40164: Update Windows to OpenSSL 1.1.1f (GH-19359)
    37126e7

    @zooba
    Copy link
    Member

    zooba commented Apr 4, 2020

    New changeset e7a47c2 by Steve Dower in branch '3.7':
    bpo-40164: Update Windows to OpenSSL 1.1.1f (GH-19359)
    e7a47c2

    @ned-deily
    Copy link
    Member Author

    And today (2020-04-21) 1.1.1g is released with a high severity fix.

    @ned-deily ned-deily changed the title Upgrade Windows and macOS installer builds to OpenSSL 1.1.1f Upgrade Windows and macOS installer builds to OpenSSL 1.1.1g Apr 21, 2020
    @ned-deily ned-deily changed the title Upgrade Windows and macOS installer builds to OpenSSL 1.1.1f Upgrade Windows and macOS installer builds to OpenSSL 1.1.1g Apr 21, 2020
    @zooba
    Copy link
    Member

    zooba commented Apr 21, 2020

    That'll teach me for being so quick on this...

    Are we even impacted by the issue though? I don't see any calls to SSL_check_chain() in our code or the SSL sources.

    Advisory: https://www.openssl.org/news/secadv/20200421.txt
    Full diff: openssl/openssl@OpenSSL_1_1_1f...OpenSSL_1_1_1g

    @ned-deily
    Copy link
    Member Author

    Are we even impacted by the issue though?

    Certainly we use a check_chain function at least indirectly but, whether that path is vulnerable, dunno.

    But, in any case, we will no doubt be pinged about it so best to be ahead of the curve, I think.

    @ned-deily
    Copy link
    Member Author

    New changeset 783a673 by Ned Deily in branch 'master':
    bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g. (GH-19642)
    783a673

    @miss-islington
    Copy link
    Contributor

    New changeset 9e51aab by Miss Islington (bot) in branch '3.8':
    bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g. (GH-19642)
    9e51aab

    @ned-deily
    Copy link
    Member Author

    New changeset 7ad3add by Miss Islington (bot) in branch '3.7':
    bpo-40164: Update macOS installer builds to use OpenSSL 1.1.1g. (GH-19642) (GH-19644)
    7ad3add

    @ambv
    Copy link
    Contributor

    ambv commented May 18, 2020

    Should this still be open?

    @ned-deily
    Copy link
    Member Author

    I believe the Windows builds are still using 1.1.1f.

    @ned-deily
    Copy link
    Member Author

    Any chance of getting the Windows builds using 1.1.1g for the upcoming 3.7.8?

    @zooba
    Copy link
    Member

    zooba commented Jun 12, 2020

    Yeah, I'll get onto it now.

    @srinivasreddy
    Copy link
    Mannequin

    srinivasreddy mannequin commented Jun 12, 2020

    Steve,
    I have done it. And I didn't see your reply.

    @zooba
    Copy link
    Member

    zooba commented Jun 12, 2020

    Thanks. Your PR will start to work once I've done the updated build, so don't worry about the failure right now.

    OpenSSL updates require build manager involvement, so it's blocked on me :)

    @zooba
    Copy link
    Member

    zooba commented Jun 12, 2020

    Okay, new sources and build are up, so I retriggered the PR. If it's all good, I'll merge and backport.

    @zooba
    Copy link
    Member

    zooba commented Jun 12, 2020

    New changeset 80d827c by Srinivas Reddy Thatiparthy (శ్రీనివాస్ రెడ్డి తాటిపర్తి) in branch 'master':
    bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834)
    80d827c

    @miss-islington
    Copy link
    Contributor

    New changeset 166d723 by Miss Islington (bot) in branch '3.9':
    bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834)
    166d723

    @zooba
    Copy link
    Member

    zooba commented Jun 12, 2020

    New changeset 7e57c36 by Steve Dower in branch '3.8':
    bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834)
    7e57c36

    @zooba
    Copy link
    Member

    zooba commented Jun 12, 2020

    New changeset 617af99 by Steve Dower in branch '3.7':
    bpo-40164: Update Windows OpenSSL to 1.1.1g (GH-20834)
    617af99

    @zooba zooba closed this as completed Jun 12, 2020
    @ned-deily
    Copy link
    Member Author

    Thanks, Steve and Srinivas!

    @ned-deily ned-deily added 3.10 only security fixes and removed deferred-blocker labels Jun 12, 2020
    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.7 (EOL) end of life 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes OS-mac OS-windows
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    4 participants
    @ambv @zooba @ned-deily @miss-islington