gh-89532: Remove LibreSSL workarounds by ramikg · Pull Request #28728 · python/cpython · GitHub

Python 3.10 drops support for LibreSSL (as per PEP 644), but there are still a few workarounds & mentions of LibreSSL in the source code.

The related PR cleans the code of any LibreSSL workarounds or mentions.

https://bugs.python.org/issue45369

Issue: Remove LibreSSL workarounds #89532

Fixes #89532

Thanks for your PR.

Python 3.10 didn't actively drop support for LibreSSL. For a lack of better wording, we passively removed compatibility with forks that don't provide OpenSSL 1.1.1 API. I still like to keep some code so we can re-add LibreSSL support later.

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

Co-authored-by: Christian Heimes <christian@python.org>

Thanks for the quick fix!

I have made the requested changes; please review again

Thanks for making the requested changes!

@tiran: please review the changes made to this pull request.

This PR is stale because it has been open for 30 days with no activity.

For a lack of better wording, we passively removed compatibility with forks that don't provide OpenSSL 1.1.1 API. I still like to keep some code so we can re-add LibreSSL support later.

Some time has passed, and I guess this patch sort of reflects the state of Python v3.10 with LibreSSL v3.5.
It looks like the next version will support SSL_CTX_get_security_level too.
What's left then are those four hash functions, which probably won't be added anytime soon.

Does that change anything for Python w.r.t. LibreSSL support?

Of course I stumble upon this just after posting.
That sounds like it can solve the issue about the missing hashing functions?

It is unlikely that we will officially support LibreSSL. Even if LibreSSL would become feature compatible with OpenSSL, we just don't have to resources to test and verify that Python works correctly with LibreSSL.

Is LibreSSL still relevant? AFAIK only OpenBSD uses it. All Linux distros have dropped support for LibreSSL, even Gentoo. FreeBSD uses OpenSSL and NetBSD seems to prefer OpenSSL as well (they have OpenSSL 1.1.1n and LibreSSL 2.7.4 from 2018).

@ramikg, can you resolve the conflicts and update the PR?

@ramikg, can you resolve the conflicts and update the PR?

Sure, done.

This PR should not remove RAND_egd, that is something OpenSSL provides.

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

This PR should not remove RAND_egd, that is something OpenSSL provides.

True. I've brought it back, and reworded the comment to be relevant to OpenSSL.
I've kept the try clause so that OpenSSL builds with OPENSSL_NO_EGD won't break.

(By the way, RAND_egd has already been mostly removed from CPython, as I've mentioned here.)

I have made the requested changes; please review again

Remove LibreSSL specific workaround ifdefs from `_ssl.c` and delete the non-version-specific `_ssl_data.h` file (relevant for OpenSSL < 1.1.1, which we no longer support per PEP 644). Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Gregory P. Smith <greg@krypto.org>

ramikg added 2 commits September 30, 2021 20:36

Delete _ssl_data.h (relevant for OpenSSL < 1.1.1)

a6c710e

Remove LibreSSL comment from SSL docs

70ecc30

bedevere-bot added the awaiting review label Oct 5, 2021

the-knights-who-say-ni added the CLA signed label Oct 5, 2021

ramikg changed the title bpo-45369: Remove libressl support bpo-45369: Remove LibreSSL support Oct 5, 2021

tiran changed the title bpo-45369: Remove LibreSSL support bpo-45369: Remove LibreSSL workarounds Oct 5, 2021

tiran requested changes Oct 5, 2021

View reviewed changes

Comment thread Lib/test/test_ssl.py Outdated

Comment thread Misc/NEWS.d/next/Core and Builtins/2021-10-05-05-00-16.bpo-45369.tluk_X.rst Outdated

Comment thread Tools/ssl/multissltests.py Outdated

bedevere-bot added awaiting changes and removed awaiting review labels Oct 5, 2021

tiran added the needs backport to 3.10 only security fixes label Oct 5, 2021

ramikg and others added 4 commits October 7, 2021 11:40

Remove LIBRESSL_VERSION_NUMBER macro from _ssl.c

156303b

Remove ssl.RAND_egd

2cbea53

📜🤖 Added by blurb_it.

351eaea

Reword LibreSSL news entry

c2a66a8

Co-authored-by: Christian Heimes <christian@python.org>

tiran reviewed Oct 7, 2021

View reviewed changes

bedevere-bot removed the awaiting changes label Oct 7, 2021

bedevere-bot added the awaiting change review label Oct 7, 2021

bedevere-bot requested a review from tiran October 7, 2021 08:44

github-actions Bot added the stale Stale PR or inactive for long period of time. label Nov 7, 2021

dhewg mentioned this pull request Nov 8, 2021

tools: switch LibreSSL to OpenSSL 1.1.1 openwrt/openwrt#4749

Closed

serhiy-storchaka added the needs backport to 3.11 only security fixes label May 20, 2022

ezio-melotti removed the CLA signed label Jul 13, 2022

dhewg mentioned this pull request Jul 18, 2022

openssl: add host build recipe openwrt/openwrt#10299

Open

bedevere-bot added the awaiting review label May 6, 2023

arhadthedev mentioned this pull request May 6, 2023

Renaming issues/PRs incorrectly changes awaiting change review and awaiting merge to awaiting review python/bedevere#556

Closed

pquentin mentioned this pull request May 10, 2023

urllib3>=2.0 does not work with system Python on macOS urllib3/urllib3#3020

Closed

ramikg mannequin mentioned this pull request Jan 5, 2024

Remove LibreSSL workarounds #89532

Closed

Merge branch 'main' into remove-libressl-support

8842a39

ramikg requested a review from ericsnowcurrently as a code owner January 5, 2024 18:07

gpshead removed the needs backport to 3.11 only security fixes label Jan 6, 2024

gpshead requested changes Jan 6, 2024

View reviewed changes

bedevere-app Bot added awaiting changes and removed awaiting review labels Jan 6, 2024

erlend-aasland removed pending The issue will be closed if no feedback is provided stale Stale PR or inactive for long period of time. labels Jan 6, 2024

Restore RAND_egd references

b0a2fa4

ramikg requested a review from gpshead January 6, 2024 20:27

switch the other _ssl_data.h reference to _ssl_data_31.h

deabec9

gpshead approved these changes Jan 6, 2024

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting changes labels Jan 6, 2024

gpshead self-assigned this Jan 6, 2024

gpshead enabled auto-merge (squash) January 6, 2024 23:23

gpshead merged commit 84d1f76 into python:main Jan 6, 2024

bedevere-app Bot removed the awaiting merge label Jan 6, 2024

ramikg deleted the remove-libressl-support branch January 7, 2024 06:12

gh-89532: Remove LibreSSL workarounds by ramikg · Pull Request #28728 · python/cpython · GitHub

Uh oh!

Uh oh!

gh-89532: Remove LibreSSL workarounds - #28728

gh-89532: Remove LibreSSL workarounds#28728gpshead merged 15 commits intopython:mainpython/cpython:mainfrom ramikg:remove-libressl-supportCopy head branch name to clipboard

Conversation

ramikg commented Oct 5, 2021 • edited by gpshead Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tiran left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-bot commented Oct 5, 2021

Uh oh!

tiran left a comment

Choose a reason for hiding this comment

Uh oh!

ramikg commented Oct 7, 2021

Uh oh!

bedevere-bot commented Oct 7, 2021

Uh oh!

github-actions Bot commented Nov 7, 2021

Uh oh!

dhewg commented Jul 19, 2022

Uh oh!

dhewg commented Jul 19, 2022

Uh oh!

tiran commented Jul 19, 2022

Uh oh!

erlend-aasland commented Jan 5, 2024

Uh oh!

ramikg commented Jan 5, 2024

Uh oh!

gpshead left a comment

Choose a reason for hiding this comment

Uh oh!

bedevere-app Bot commented Jan 6, 2024

Uh oh!

ramikg commented Jan 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

gh-89532: Remove LibreSSL workarounds#28728
gpshead merged 15 commits into
python:mainfrom
ramikg:remove-libressl-support

ramikg commented Oct 5, 2021 •
edited by gpshead
Loading

ramikg commented Jan 6, 2024 •
edited
Loading