gh-131423: Update to OpenSSL 3.0.16. #131839
Conversation
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix pythongh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
zooba
added
OS-windows
needs backport to 3.12
| @@ -4427,6 +4427,12 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath) | |||
| FILE *f; | |||
| DH *dh; | |||
|
|
|||
| #if defined(MS_WINDOWS) && defined(_DEBUG) | |||
There was a problem hiding this comment.
Is _DEBUG the canonical "NDEBUG" for Windows builds? (just asking)
There was a problem hiding this comment.
They're opposite. _DEBUG basically means linking to the debug CRT (and asserts are enabled), while NDEBUG means linking to the non-debug CRT (and asserts are disabled).
There was a problem hiding this comment.
Ah yes, what I meant is "is it common to use the _DEBUG macro instead of the !defined(NDEBUG) one" (I think I've only seen Py_DEBUG and NDEBUG usage but not _DEBUG)
There was a problem hiding this comment.
I guess it's personal preference? _DEBUG is defined by the compiler based on the runtime library which is what I wanted, while NDEBUG controls the behaviour of assert.
So it's technically possible to define them both at once, but generally you don't, and I wouldn't suggest it in a codebase like ours because it's almost certainly assuming they are mutually exclusive.
Windows CI should pick up the change from |
|
Ah no my bad, I forgot that Ubuntu also tested the 3.0.x versions but they are not related to the Windows ones (namely, we don't have a Windows build only with OpenSSL) |
|
Thanks @zooba for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12, 3.13. |
|
Sorry, @zooba, I could not cleanly backport this to |
|
Sorry, @zooba, I could not cleanly backport this to |
|
GH-131848 is a backport of this pull request to the 3.13 branch. |
|
GH-131849 is a backport of this pull request to the 3.12 branch. |
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix pythongh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix pythongh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix pythongh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix gh-131804.
This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
The PCbuild/openssl.vcxproj project is updated, even though it is not used by our own builds.