Document Debian 8 / Ubuntu 14.04 OpenSSL compatibility issues

[ncoghlan]

BPO	34009
Nosy	@ncoghlan, @pitrou, @tiran, @ned-deily, @ambv, @miss-islington
PRs	bpo-34009: Expand on platform support changes #8022 [3.7] bpo-34009: Expand on platform support changes (GH-8022) #8227

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2018-07-10.13:31:02.950>
created_at = <Date 2018-06-30.09:26:42.844>
labels = ['3.8', 'type-feature', '3.7']
title = 'Document Debian 8 / Ubuntu 14.04 OpenSSL compatibility issues'
updated_at = <Date 2018-07-10.13:31:02.948>
user = 'https://github.com/ncoghlan'

bugs.python.org fields:

activity = <Date 2018-07-10.13:31:02.948>
actor = 'ncoghlan'
assignee = 'none'
closed = True
closed_date = <Date 2018-07-10.13:31:02.950>
closer = 'ncoghlan'
components = []
creation = <Date 2018-06-30.09:26:42.844>
creator = 'ncoghlan'
dependencies = []
files = []
hgrepos = []
issue_num = 34009
keywords = ['patch']
message_count = 11.0
messages = ['320762', '320764', '320767', '320770', '320822', '320862', '320871', '321035', '321385', '321387', '321388']
nosy_count = 7.0
nosy_names = ['ncoghlan', 'pitrou', 'christian.heimes', 'ned.deily', 'lukasz.langa', 'David MacIver', 'miss-islington']
pr_nums = ['8022', '8227']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue34009'
versions = ['Python 3.7', 'Python 3.8']

[ncoghlan]

As noted in travis-ci/travis-ci#9069, Travis CI's Ubuntu 14.04 environment includes an OpenSSL that's too old to meet Python 3.7's security requirements.

According to travis-ci/travis-ci#9069 (comment), setting "dist: xenial" instead (giving Ubuntu 16.04) provides a testing environment with a new enough OpenSSL for 3.7 to work.

I'm thinking it would make the most sense as a subsection under https://docs.python.org/dev/whatsnew/3.7.html#platform-support-removals

(https://docs.python.org/dev/whatsnew/3.7.html#ssl does mention this information in a note, but that uses the OpenSSL version numbers directly, which folks aren't necessarily going to know to go to distrowatch to check which Travis environment they need to select: https://distrowatch.com/table.php?distribution=Ubuntu )

[DavidMacIver]

According to travis-ci/travis-ci#9069 (comment), setting "dist: xenial" instead (giving Ubuntu 16.04) provides a testing environment with a new enough OpenSSL for 3.7 to work.

No, this doesn't work either. The xenial environment is an experimental feature and doesn't work at all reliably. At the time of this writing setting "dist: xenial" actually puts you into Trusty.

Currently the viable ways of making it work on Travis are to either run a custom docker image (which requires you to opt out of their containerized builds and thus makes everything slower), or to build OpenSSL yourself (and making the latter work correctly is a far from straightforward process).

[ncoghlan]

OK, given the above feedback, the PR I've created isn't right yet, but it at least shows where any information that we can provide on this point will end up.

[ncoghlan]

Also adding Łukasz to the nosy list, since it was his comment from a few weeks ago on the Travis CI ticket that prompted my "dist: xenial" suggestion.

[ncoghlan]

I've updated the PR to match my current understanding of the situation with Debian 8 and Ubuntu 14.04.

[DavidMacIver]

Anthony Sottile has pointed out to me that I'm wrong about the xenial thing, and that actually it does work it's just that you need to get multiple things right in order for it to do so. https://github.com/deadsnakes/travis-ci-python3.7-example is a good example of making it work.

[pitrou]

Why should we mention Travis-CI at all? It's Travis-CI's job to document the binaries and runtimes they provide on each of their build environments.

[ncoghlan]

Given the update in https://github.com/deadsnakes/travis-ci-python3.7-example#update-2018-07-03, I've simplified the PR to remove any references to Travis CI, and instead just mention the code names for the relevant Debian and Ubuntu releases.

I've also kept the pointer to our CI config for building your own Python against OpenSSL 1.1.0, regardless of the host OS state.

[ncoghlan]

New changeset 5fe7c98 by Nick Coghlan in branch 'master':
bpo-34009: Expand on platform support changes (GH-8022)
5fe7c98

[miss-islington]

New changeset 5cca6f9 by Miss Islington (bot) in branch '3.7':
bpo-34009: Expand on platform support changes (GH-8022)
5cca6f9

[ncoghlan]

Merged to master and 3.7 - any further wording tweaks can be handled as a trivial docs-only PR, without needing additional tracker issues.