Trac #32405: sage-bootstrap-python: Prefer pythons that support ssl w…

…ith SNI

(from ticket:32372#comment:10)

This fixes the problem on `ubuntu-trusty-standard` (https://github.com/m
koeppe/sage/runs/4128487418?check_suite_focus=true), which fails to
download from `upstream_url` that points to `pypi.io`

URL: https://trac.sagemath.org/32405
Reported by: mkoeppe
Ticket author(s): Matthias Koeppe
Reviewer(s): Jonathan Kliem

build/bin/sage-bootstrap-python

@@ -40,7 +40,19 @@ if [ "$LC_ALL" = "C" -o "$LANG" = "C" -o "$LC_CTYPE" = "C" ]; then
     export LANG
 fi
 
-PYTHONS="python python3 python3.8 python3.7 python2.7 python3.6 python2"
+PYTHONS="python python3 python3.10 python3.9 python3.8 python3.7 python2.7 python3.6 python2"
+# Trac #32405: Prefer a Python that provides ssl with SNI, which allows developers
+# to download from upstream URLs (configure --enable-download-from-upstream-url),
+# in particular from PyPI, which requires SNI.
+for PY in $PYTHONS; do
+    PYTHON="$(PATH="$SAGE_ORIG_PATH" command -v $PY)"
+    if [ -n "$PYTHON" ]; then
+        if "$PYTHON" -c "import argparse; import urllib; from hashlib import sha1; from ssl import HAS_SNI; assert HAS_SNI; from os import listdir; listdir(\"$(pwd)\");" 2>/dev/null; then
+            exec "$PYTHON" "$@"
+        fi
+    fi
+done
+# Second round, no ssl/SNI test.
 for PY in $PYTHONS; do
     PYTHON="$(PATH="$SAGE_ORIG_PATH" command -v $PY)"
     if [ -n "$PYTHON" ]; then