8000 [3.9] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-1… · python/cpython@e15de14 · GitHub
[go: up one dir, main page]
Skip to content

Commit e15de14

Browse files
gpsheadned-deily
gpshead
and
ned-deily
authored
[3.9] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) (#105205)
Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) Co-authored-by: Ned Deily <nad@python.org>
1 parent c9bf00b commit e15de14

File tree

12 files changed

+186
-18
lines changed

12 files changed

+186
-18
lines changed

‎.azure-pipelines/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(build.sourceBranchName)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.azure-pipelines/pr.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(system.pullRequest.TargetBranch)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.github/workflows/build.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ jobs:
177177
needs: check_source
178178
if: needs.check_source.outputs.run_tests == 'true'
179179
env:
180-
OPENSSL_VER: 1.1.1t
180+
OPENSSL_VER: 1.1.1u
181181
PYTHONSTRICTEXTENSIONBUILD: 1
182182
steps:
183183
- uses: actions/checkout@v3
@@ -219,7 +219,7 @@ jobs:
219219
strategy:
220220
fail-fast: false
221221
matrix:
222-
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1t, 3.0.8, 3.1.0-beta1]
222+
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1u, 3.0.9, 3.1.1]
223223
env:
224224
OPENSSL_VER: ${{ matrix.openssl_ver }}
225225
MULTISSL_DIR: ${{ github.workspace }}/multissl

‎Mac/BuildScript/build-installer.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,9 @@ def library_recipes():
244244

245245
result.extend([
246246
dict(
247-
name="OpenSSL 1.1.1t",
248-
url="https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
249-
checksum='1cfee919e0eac6be62c88c5ae8bcd91e',
247+
name="OpenSSL 1.1.1u",
248+
url="https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
249+
checksum='72f7ba7395f0f0652783ba1089aa0dcc',
250250
buildrecipe=build_universal_openssl,
251251
configure=None,
252252
install=None,

‎Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u
2+
to address several CVEs.

‎Misc/NEWS.d/next/macOS/2023-05-30-23-30-46.gh-issue-103142.55lMXQ.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Update macOS installer to use OpenSSL 1.1.1u.

‎Modules/_ssl_data_111.h

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:36:21.493286 */
1+
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T02:58:04.081473 */
22
static struct py_ssl_library_code library_codes[] = {
33
#ifdef ERR_LIB_ASN1
44
{"ASN1", ERR_LIB_ASN1},
@@ -1375,6 +1375,11 @@ static struct py_ssl_error_code error_codes[] = {
13751375
#else
13761376
{"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
13771377
#endif
1378+
#ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
1379+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
1380+
#else
1381+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
1382+
#endif
13781383
#ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
13791384
{"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
13801385
#else
@@ -4860,6 +4865,11 @@ static struct py_ssl_error_code error_codes[] = {
48604865
#else
48614866
{"MISSING_PARAMETERS", 20, 290},
48624867
#endif
4868+
#ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
4869+
{"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
4870+
#else
4871+
{"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
4872+
#endif
48634873
#ifdef SSL_R_MISSING_RSA_CERTIFICATE
48644874
{"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
48654875
#else
@@ -5065,6 +5075,11 @@ static struct py_ssl_error_code error_codes[] = {
50655075
#else
50665076
{"NULL_SSL_METHOD_PASSED", 20, 196},
50675077
#endif
5078+
#ifdef SSL_R_OCSP_CALLBACK_FAILURE
5079+
{"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
5080+
#else
5081+
{"OCSP_CALLBACK_FAILURE", 20, 294},
5082+
#endif
50685083
#ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
50695084
{"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
50705085
#else

0 commit comments

Comments
 (0)
0