Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ssl.OPENSSL_VERSION still reporting 1.1.1i on windows 3.8.9/3.9.4 #87911

Closed
mrginglymus mannequin opened this issue Apr 6, 2021 · 17 comments
Closed

ssl.OPENSSL_VERSION still reporting 1.1.1i on windows 3.8.9/3.9.4 #87911

mrginglymus mannequin opened this issue Apr 6, 2021 · 17 comments
Labels
3.8 only security fixes 3.9 only security fixes 3.10 only security fixes OS-windows release-blocker type-security A security issue

Comments

@mrginglymus
Copy link
Mannequin

mrginglymus mannequin commented Apr 6, 2021

BPO 43745
Nosy @pfmoore, @tiran, @tjguk, @ambv, @zware, @zooba, @pablogsal, @miss-islington, @tirkarthi, @mrginglymus
PRs
  • bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. #25213
  • [3.9] bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213) #25214
  • [3.8] bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213) #25223
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2021-04-06.15:05:38.558>
created_at = <Date 2021-04-06.10:23:58.456>
labels = ['type-security', '3.8', '3.9', '3.10', 'release-blocker', 'OS-windows']
title = 'ssl.OPENSSL_VERSION still reporting 1.1.1i on windows 3.8.9/3.9.4'
updated_at = <Date 2021-04-09.12:02:51.580>
user = 'https://github.com/mrginglymus'

    bugs.python.org fields:

    activity = <Date 2021-04-09.12:02:51.580>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2021-04-06.15:05:38.558>
closer = 'steve.dower'
components = ['Windows']
creation = <Date 2021-04-06.10:23:58.456>
creator = 'Bill Collins'
dependencies = []
files = []
hgrepos = []
issue_num = 43745
keywords = ['patch']
message_count = 17.0
messages = ['390303', '390307', '390308', '390309', '390317', '390318', '390320', '390324', '390328', '390342', '390343', '390346', '390351', '390363', '390516', '390538', '390597']
nosy_count = 10.0
nosy_names = ['paul.moore', 'christian.heimes', 'tim.golden', 'lukasz.langa', 'zach.ware', 'steve.dower', 'pablogsal', 'miss-islington', 'xtreak', 'Bill Collins']
pr_nums = ['25213', '25214', '25223']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue43745'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']
    @mrginglymus
    Copy link
    Mannequin Author

    mrginglymus mannequin commented Apr 6, 2021 

    >>> import sys,ssl
>>> sys.version
'3.9.4 (tags/v3.9.4:1f2e308, Apr  4 2021, 13:27:16) [MSC v.1928 64 bit (AMD64)]'
>>> ssl.OPENSSL_VERSION
'OpenSSL 1.1.1i  8 Dec 2020'

    I may well be holding it wrong, but something seems off.

    @mrginglymus mrginglymus mannequin added 3.8 only security fixes 3.9 only security fixes OS-windows type-security A security issue labels Apr 6, 2021
    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    No, I think I was holding git wrong (and built 1.1.1i again instead of 1.1.1k).

    Guess we get to do more releases...

    @tiran
    Copy link
    Member

    tiran commented Apr 6, 2021

    Uh :(

    No more holiday releases, please. The RMs and release team need their vacation.

    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    No more holiday releases, please. The RMs and release team need their vacation.

    I agree, can you ask OpenSSL to stop releasing fixes? (or alternatively, can you convince everyone to let us switch to the native TLS stack on Windows where the upstream fixes are released before they are announced to the world ;) )

    @tirkarthi
    Copy link
    Member

    Given that the PR is against master is this issue present in Python 3.10 alphas too since last alpha was released today.

    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    It is, but I wouldn't hold up an alpha or beta release because of this.

    @zooba zooba added 3.10 only security fixes labels Apr 6, 2021
    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    New changeset 354b015 by Steve Dower in branch 'master':
    bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
    354b015

    @ambv
    Copy link
    Contributor

    ambv commented Apr 6, 2021

    I elect to replace 3.9.4 Windows installers.

    1. It's a Windows installer specific problem, no other users are affected.

    2. You can always reinstall. You can tell by the dates reported by the REPL or in fact by checking ssl.OPENSSL_VERSION.

    3. There will be 3.9.5 on May 3 anyway soon enough.

    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    Yeeeessss.... we caaaann.... I think we may regret it, but happy to go with it if you'd prefer.

    FWIW, the code change isn't necessary if you do a totally clean rebuild. However, most builders do not do totally clean rebuilds, so the code change ensures that they are not caught out.

    (Confirmation just came through another channel, so I'm doing a rebuild of the v3.9.4 and v3.8.9 tags now.)

    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    New changeset 611aa39 by Steve Dower in branch '3.9':
    bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
    611aa39

    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    A new 3.9.4 and 3.8.9 release is available for download from python.org. The Nuget and Windows Store packages will have to remain as the original versions, since those do not allow us to overwrite with the same version number.

    @zooba zooba closed this as completed Apr 6, 2021
    @zooba zooba closed this as completed Apr 6, 2021
    @miss-islington
    Copy link
    Contributor

    New changeset 9a988b8 by Miss Islington (bot) in branch '3.8':
    bpo-43745: Actually updates Windows release to OpenSSL 1.1.1k. (GH-25213)
    9a988b8

    @mrginglymus
    Copy link
    Mannequin Author

    mrginglymus mannequin commented Apr 6, 2021

    Thanks for the quick action on this!

    I've downloaded the new 3.8.9/3.9.4 installers, but they are unable to run over my existing 3.8.9/3.9.4 installs; "Unable to install python 3.9.4 (64-bit) due to an existing install." This is probably fine as I can just uninstall/reinstall (I hope), so just FYI.

    I've upgraded my 32-bit install from 3.9.2 to the new 3.9.4 installer without issue.

    Are you able to also update the embeddable packages please?

    @zooba
    Copy link
    Member

    zooba commented Apr 6, 2021

    Are you able to also update the embeddable packages please?

    They've been updated, it's just the CDN hasn't purged those files. I
    need to add those files to the script.

    It should show up within 24 hours, if I don't start doing the script
    tonight.

    @mrginglymus
    Copy link
    Mannequin Author

    mrginglymus mannequin commented Apr 8, 2021

    The embeddable dists for 3.9.4 have updated, but the 3.8.9 packages are still showing the builds from April 2nd.

    @zooba
    Copy link
    Member

    zooba commented Apr 8, 2021

    I just purged the CDN again and it seems to be fine now.

    @mrginglymus
    Copy link
    Mannequin Author

    mrginglymus mannequin commented Apr 9, 2021

    Confirmed, thanks!

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.8 only security fixes 3.9 only security fixes 3.10 only security fixes OS-windows release-blocker type-security A security issue
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    5 participants
    @ambv @tiran @zooba @tirkarthi @miss-islington