[DO NOT MERGE] Investigating SSL error in GitHub Action

[uranusjr]

Checks in recent PRs are failing weirdly, see e.g. #11634 (comment) #11639 (comment)

[uranusjr]

Yeah, I’m assuming something’s wrong with how setup-python’s 3.7 installation. I wonder this is related to the 3.7.16 security release.

[uranusjr]

Downgrading Python does not work, so this is probably in the base system. 😞

[q0w]

3.7.16 is not supported yet https://github.com/actions/python-versions/blob/main/versions-manifest.json, so you did not downgrade

[uranusjr]

Hmm in that case it’s probably not the cause anyway, 3.7.15 has been in use since October, and the failure didn’t start until early December or at most later November. I’m tempted to say it’s related to the base Ubuntu setup, but other CI jobs are passing fine so that’s unlikely :(

[pradyunsg]

Spent some time looking into this.

• https://github.com/pypa/pip/actions/runs/3607220683 was the first failure. That's "9 days ago" at this point.

• (3.7)

  Run python -c "import ssl; print( ssl.OPENSSL_VERSION )"
  OpenSSL 3.0.2 15 Mar 2022
  

  That seems to be OK.

• https://github.com/actions/python-versions/releases/tag/3.8.15-3601364564 is the only tag at 9 days ago; and we're seeing failures on 3.7.

• https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20221204.2 was 6 days ago. https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20221127.1 and friends were 13 days ago.

[pradyunsg]

Found it: https://github.blog/changelog/2022-12-01-github-actions-larger-runners-using-ubuntu-latest-label-will-now-use-ubuntu-22-04/

I'm guessing it's the OpenSSL version that's causing issues here.

[pradyunsg]

Yup, that differs and I'm guessing this is some OpenSSL 3.0-related incompatibility.

[pradyunsg]

All the tests failing are related to cert_factory. https://github.com/DragonFlyBSD/DragonFlyBSD/blob/97e3ace094001c5b9cbd63f152cb406cd3ca6754/crypto/libressl/ssl/ssl_err.c#L271 suggests this might be related to kerberos initialisation?

[uranusjr]

Considering Python 3.7 is going away in six months according to the release schedule, would it make sense to simply skip the failing tests? Those are still covered by other Python versions anyway.

[pradyunsg]

Yea, let's do that on 3.7.