bpo-43811: Test multiple OpenSSL versions on GHA by tiran · Pull Request #25360 · python/cpython · GitHub

The new checks are only executed when one or more OpenSSL-related files are modified. The checks run a handful of networking and hashing test suites. All SSL checks are optional. This PR also introduces ccache to speed up compilation. In common cases it speeds up configure and compile time from about 90 seconds to less than 30 seconds.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue43811

Automerge-Triggered-By: GH:tiran

#25361 addresses the unrelated test failures.

Don't we have an accepted PEP which requires OpenSSL 1.1.1 or newer?

Each additional CI increases the error rate since we still have unstable tests in asyncio and multiprocessing tests. I would prefer to not add too many CIs. At least, don't make them mandatory (allow to merge a PR even if they fail).

Rather than pre-commit CI jobs run on every since PR and at every PR update, can't we use a post-commit CI, like a buildbot worker? Issues in pre-commit are way more annoying.

cc @pablogsal @zware

Don't we have an accept PEP which requires OpenSSL 1.1.1 or newer?

Yes, but the PEP applies to 3.10 only. You want OpenSSL 3.0.0 compatibility in 3.8 and 3.9, don't you?

Rather than pre-commit CI jobs run on every since PR and at every PR update, can't we use a post-commit CI, like a buildbot worker? Issues in pre-commit are way more annoying.

I need an easy and reliable way to ensure that Python works with all supported OpenSSL versions. Post-commit CI is too late.

You can add OpenSSL < 1.1.1 in the CI jobs when you backport this PR to 3.9 and older. But this PR targets master, so I expect not see OpenSSL < 1.1.1 in this branch.

Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done.

Each additional CI increases the error rate since we still have unstable tests in asyncio and multiprocessing tests. I would prefer to not add too many CIs. At least, don't make them mandatory (allow to merge a PR even if they fail).

The additional SSL tests are now only executed when any OpenSSL or GHA related file is modified. The SSL tests only execute a couple of selected tests. Multiprocessing tests are skipped. The CI steps are not mandatory.

"Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done."

Ok.

Please don't add a new CI until all issues are fixed, like this one:

"GitHub Actions / Ubuntu SSL tests with OpenSSL 3.0.0-alpha14
‘ERR_func_error_string’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]"

Please don't add a new CI until all issues are fixed, like this one:

"GitHub Actions / Ubuntu SSL tests with OpenSSL 3.0.0-alpha14
‘ERR_func_error_string’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]"

This is a chicken and egg problem. #25329 needs this PR to verify that the code works.

This is a chicken and egg problem. #25329 needs this PR to verify that the code works.

I'm spending a lot of time to fix every single warning in Python. I would prefer to not add new warnings, especially if you know that a lot of will be needed to fix them.

Can't you run this CI job locally, fix warnings, and then automate checks on PRs?

I would prefer not annoy contributors who don't work on OpenSSL support with these new deprecation warnings.

This is a chicken and egg problem. #25329 needs this PR to verify that the code works.

I'm spending a lot of time to fix every single warning in Python. I would prefer to not add new warnings, especially if you know that a lot of will be needed to fix them.

Can't you run this CI job locally, fix warnings, and then automate checks on PRs?

I would prefer not annoy contributors who don't work on OpenSSL support with these new deprecation warnings.

I prefer to add CI first, so I have a stable baseline. Then I can fix deprecation warnings.

I have added a new check_source instruction. The additional OpenSSL tests are skipped unless the commit touches any file with ssl, hmac, hashlib or ^.github in the file name.

Signed-off-by: Christian Heimes <christian@python.org>

@vstinner @pablogsal I have reworked the PR. Additional checks are optional and only executed when GHA detects a modification of an OpenSSL-related file or a file in .github directory. I'm postponing PEP 644 PR until I have finalized OpenSSL 3.0.0 support. It should be ready by next week.

LGTM.

Additional checks are optional and only executed when GHA detects a modification of an OpenSSL-related file

Ok, I'm fine with this PR in this case.

"Master still supports OpenSSL 1.1.0 and 1.0.2. I have not finished and pushed the PEP 644 PR. I deliberately postponed PEP 644 changes until OpenSSL 3.0.0 support is done."

Ok.

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

The new checks are only executed when one or more OpenSSL-related files are modified. The checks run a handful of networking and hashing test suites. All SSL checks are optional. This PR also introduces ccache to speed up compilation. In common cases it speeds up configure and compile time from about 90 seconds to less than 30 seconds. Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 8fa1489) Co-authored-by: Christian Heimes <christian@python.org>

GH-25391 is a backport of this pull request to the 3.9 branch.

The new checks are only executed when one or more OpenSSL-related files are modified. The checks run a handful of networking and hashing test suites. All SSL checks are optional. This PR also introduces ccache to speed up compilation. In common cases it speeds up configure and compile time from about 90 seconds to less than 30 seconds. Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 8fa1489) Co-authored-by: Christian Heimes <christian@python.org>

GH-25392 is a backport of this pull request to the 3.8 branch.

…-25391) The new checks are only executed when one or more OpenSSL-related files are modified. The checks run a handful of networking and hashing test suites. All SSL checks are optional. This PR also introduces ccache to speed up compilation. In common cases it speeds up configure and compile time from about 90 seconds to less than 30 seconds. Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 8fa1489) Co-authored-by: Christian Heimes <christian@python.org> Automerge-Triggered-By: GH:tiran

…-25392) The new checks are only executed when one or more OpenSSL-related files are modified. The checks run a handful of networking and hashing test suites. All SSL checks are optional. This PR also introduces ccache to speed up compilation. In common cases it speeds up configure and compile time from about 90 seconds to less than 30 seconds. Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 8fa1489) Co-authored-by: Christian Heimes <christian@python.org> Automerge-Triggered-By: GH:tiran

tiran added needs backport to 3.8 labels Apr 12, 2021

tiran requested review from vstinner and zooba April 12, 2021 10:02

the-knights-who-say-ni added the CLA signed label Apr 12, 2021

bedevere-bot added the awaiting core review label Apr 12, 2021

tiran force-pushed the bpo-43811-gha-multissl branch from a741341 to 302c398 Compare April 12, 2021 11:13

vstinner reviewed Apr 12, 2021

View reviewed changes

tiran added 2 commits April 13, 2021 08:45

bpo-43811: Test multiple OpenSSL versions on GHA

771ad62

Signed-off-by: Christian Heimes <christian@python.org>

Only run ssl tests when OpenSSL related files are changed

3669c9f

tiran force-pushed the bpo-43811-gha-multissl branch from 7e18dda to 3669c9f Compare April 13, 2021 06:46

tiran requested a review from vstinner April 13, 2021 16:26

vstinner approved these changes Apr 13, 2021

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting core review labels Apr 13, 2021

tiran added the 🤖 automerge label Apr 13, 2021

miss-islington merged commit 8fa1489 into python:master Apr 13, 2021

bedevere-bot removed the awaiting merge label Apr 13, 2021

bedevere-bot removed the needs backport to 3.9 label Apr 13, 2021

bedevere-bot removed the needs backport to 3.8 label Apr 13, 2021

bpo-43811: Test multiple OpenSSL versions on GHA by tiran · Pull Request #25360 · python/cpython · GitHub

Repository navigation

bpo-43811: Test multiple OpenSSL versions on GHA - #25360

bpo-43811: Test multiple OpenSSL versions on GHA#25360miss-islington merged 2 commits intopython:masterpython/cpython:masterfrom tiran:bpo-43811-gha-multissltiran/cpython:bpo-43811-gha-multisslCopy head branch name to clipboard

Conversation

tiran commented Apr 12, 2021 • edited by miss-islington Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tiran commented Apr 12, 2021

Uh oh!

vstinner Apr 12, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tiran Apr 12, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vstinner Apr 12, 2021

Choose a reason for hiding this comment

Uh oh!

tiran Apr 12, 2021

Choose a reason for hiding this comment

Uh oh!

tiran Apr 12, 2021

Choose a reason for hiding this comment

Uh oh!

vstinner Apr 13, 2021

Choose a reason for hiding this comment

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

tiran commented Apr 12, 2021

Uh oh!

vstinner commented Apr 12, 2021

Uh oh!

tiran commented Apr 12, 2021

Uh oh!

tiran commented Apr 12, 2021

Uh oh!

tiran commented Apr 13, 2021

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

vstinner Apr 13, 2021

Choose a reason for hiding this comment

Uh oh!

miss-islington commented Apr 13, 2021

Uh oh!

bedevere-bot commented Apr 13, 2021

Uh oh!

bedevere-bot commented Apr 13, 2021

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

bpo-43811: Test multiple OpenSSL versions on GHA#25360
miss-islington merged 2 commits into
python:masterfrom
tiran:bpo-43811-gha-multissl

tiran commented Apr 12, 2021 •
edited by miss-islington
Loading

vstinner Apr 12, 2021 •
edited
Loading

tiran Apr 12, 2021 •
edited
Loading