Skip to content

[3.13] gh-158010: Update OpenSSL in binaries and CI from 3.0 to 3.5 - #158015

Open
zware wants to merge 9 commits into
python:3.13from
zware:openssl-35_3.13
Open

[3.13] gh-158010: Update OpenSSL in binaries and CI from 3.0 to 3.5#158015
zware wants to merge 9 commits into
python:3.13from
zware:openssl-35_3.13

Conversation

@zware

@zware zware commented Sep 23, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

Includes updates to Modules/_ssl_data_31.h backported from 3.14's Modules/_ssl_data_35.h along with Windows, macOS, Android, and CI updates.

@bedevere-app bedevere-app Bot mentioned this pull request Sep 23, 2026
Open
@zware
zware requested a review from Yhg1s September 23, 2026 17:16
@zware
zware requested a review from sethmlarson as a code owner September 23, 2026 17:24
@zware

zware commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

AFAICT, the failing CIFuzz tests are not related to the changes in this PR.

@mhsmith

mhsmith commented Sep 23, 2026

Copy link
Copy Markdown
Member

The Android update looks fine.

ned-deily
ned-deily reviewed Sep 24, 2026
View reviewed changes

@ned-deily ned-deily left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The macOS changes LGTM, thanks!

hugovk
hugovk approved these changes Sep 24, 2026
View reviewed changes

@hugovk hugovk left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

News files:

"Updated macOS installer to use OpenSSL 3.5.8."

Perhaps also mention the 3.0->3.5 bump?

The configure docs for building from source recommends 3.0, do we want to recommend 3.5 here to match?

cpython/Doc/using/configure.rst

Lines 25 to 26 in 2fa3dcb

* OpenSSL 1.1.1 is the minimum version and OpenSSL 3.0.18 is the recommended
minimum version for the :mod:`ssl` and :mod:`hashlib` extension modules.

AFAICT, the failing CIFuzz tests are not related to the changes in this PR.

Yep, unrelated, see #152211. Backporting #145429 would help.

@hugovk hugovk mentioned this pull request Sep 24, 2026
Merged
zware
zware commented Sep 25, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/macOS/2026-09-23-12-08-52.gh-issue-158010.Q8fLPe.rst
@@ -0,0 +1 @@
Updated macOS installer to use OpenSSL 3.5.8.

@zware zware Sep 25, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Updated macOS installer to use OpenSSL 3.5.8.
Updated macOS installer to use OpenSSL 3.5.8, jumping from the 3.0 series to 3.5
after 3.0's end of public support in September 2026.

@hugovk Something like so? Too much detail?

@hugovk hugovk Sep 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, exactly this sort of thing. 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hugovk hugovk hugovk approved these changes
@ned-deily ned-deily ned-deily left review comments
@mhsmith mhsmith Awaiting requested review from mhsmith mhsmith is a code owner
@freakboy3742 freakboy3742 Awaiting requested review from freakboy3742 freakboy3742 is a code owner
@ezio-melotti ezio-melotti Awaiting requested review from ezio-melotti ezio-melotti is a code owner
@webknjaz webknjaz Awaiting requested review from webknjaz webknjaz is a code owner
@Yhg1s Yhg1s Awaiting requested review from Yhg1s
@sethmlarson sethmlarson Awaiting requested review from sethmlarson sethmlarson is a code owner

Assignees

No one assigned

Labels

awaiting merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@zware @mhsmith @hugovk @ned-deily @encukou