Skip to content

Commit c8659d9

Browse files
Edward-KnightEdward-Knight
committed
Add OpenSSL 3.5, build with instead of 3.0
This means all supported Unix platforms (CPython 3.9+), and Windows from CPython 3.11+. This initial attempt copies what we did for OpenSSL 3.0.
1 parent 4ec8e29 commit c8659d9

File tree

7 files changed

+95
-33
lines changed

7 files changed

+95
-33
lines changed

‎cpython-unix/Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,9 @@ $(OUTDIR)/openssl-1.1-$(OPENSSL_1.1_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP
177177
$(OUTDIR)/openssl-3.0-$(OPENSSL_3.0_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.0.sh
178178
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.0
179179

180+
$(OUTDIR)/openssl-3.5-$(OPENSSL_3.5_VERSION)-$(PACKAGE_SUFFIX).tar: $(PYTHON_DEP_DEPENDS) $(HERE)/build-openssl-3.5.sh
181+
$(RUN_BUILD) --docker-image $(DOCKER_IMAGE_BUILD) openssl-3.5
182+
180183
LIBEDIT_DEPENDS = \
181184
$(PYTHON_DEP_DEPENDS) \
182185
$(OUTDIR)/ncurses-$(NCURSES_VERSION)-$(PACKAGE_SUFFIX).tar \
@@ -263,6 +266,7 @@ PYTHON_DEPENDS_$(1) := \
263266
$$(if $$(NEED_NCURSES),$$(OUTDIR)/ncurses-$$(NCURSES_VERSION)-$$(PACKAGE_SUFFIX).tar) \
264267
$$(if $$(NEED_OPENSSL_1_1),$$(OUTDIR)/openssl-1.1-$$(OPENSSL_1.1_VERSION)-$$(PACKAGE_SUFFIX).tar) \
265268
$$(if $$(NEED_OPENSSL_3_0),$$(OUTDIR)/openssl-3.0-$$(OPENSSL_3.0_VERSION)-$$(PACKAGE_SUFFIX).tar) \
269+
$$(if $$(NEED_OPENSSL_3_5),$$(OUTDIR)/openssl-3.5-$$(OPENSSL_3.5_VERSION)-$$(PACKAGE_SUFFIX).tar) \
266270
$$(if $$(NEED_PATCHELF),$$(OUTDIR)/patchelf-$$(PATCHELF_VERSION)-$$(PACKAGE_SUFFIX).tar) \
267271
$$(if $$(NEED_SQLITE),$$(OUTDIR)/sqlite-$$(SQLITE_VERSION)-$$(PACKAGE_SUFFIX).tar) \
268272
$$(if $$(NEED_TCL),$$(OUTDIR)/tcl-$$(TCL_VERSION)-$$(PACKAGE_SUFFIX).tar) \

‎cpython-unix/build-openssl-3.5.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/usr/bin/env bash
2+
# This Source Code Form is subject to the terms of the Mozilla Public
3+
# License, v. 2.0. If a copy of the MPL was not distributed with this
4+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
5+
6+
set -ex
7+
8+
ROOT=`pwd`
9+
10+
export PATH=${TOOLS_PATH}/${TOOLCHAIN}/bin:${TOOLS_PATH}/host/bin:$PATH
11+
12+
tar -xf openssl-${OPENSSL_3_5_VERSION}.tar.gz
13+
14+
pushd openssl-${OPENSSL_3_5_VERSION}
15+
16+
# Otherwise it gets set to /tools/deps/ssl by default.
17+
case "${TARGET_TRIPLE}" in
18+
*apple*)
19+
EXTRA_FLAGS="--openssldir=/private/etc/ssl"
20+
;;
21+
*)
22+
EXTRA_FLAGS="--openssldir=/etc/ssl"
23+
;;
24+
esac
25+
26+
# musl is missing support for various primitives.
27+
# TODO disable secure memory is a bit scary. We should look into a proper
28+
# workaround.
29+
if [ "${CC}" = "musl-clang" ]; then
30+
EXTRA_FLAGS="${EXTRA_FLAGS} no-async -DOPENSSL_NO_ASYNC -D__STDC_NO_ATOMICS__=1 no-engine -DOPENSSL_NO_SECURE_MEMORY"
31+
fi
32+
33+
# The -arch cflags confuse Configure. And OpenSSL adds them anyway.
34+
# Strip them.
35+
EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch arm64/}
36+
EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch x86_64/}
37+
38+
EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"
39+
40+
/usr/bin/perl ./Configure \
41+
--prefix=/tools/deps \
42+
--libdir=lib \
43+
${OPENSSL_TARGET} \
44+
no-legacy \
45+
no-shared \
46+
no-tests \
47+
${EXTRA_FLAGS}
48+
49+
make -j ${NUM_CPUS}
50+
make -j ${NUM_CPUS} install_sw install_ssldirs DESTDIR=${ROOT}/out

‎cpython-unix/build.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ def simple_build(
274274

275275
add_target_env(env, host_platform, target_triple, build_env)
276276

277-
if entry in ("openssl-1.1", "openssl-3.0"):
277+
if entry.startswith("openssl-"):
278278
settings = get_targets(TARGETS_CONFIG)[target_triple]
279279
env["OPENSSL_TARGET"] = settings["openssl_target"]
280280

@@ -1114,6 +1114,7 @@ def main():
11141114
"ncurses",
11151115
"openssl-1.1",
11161116
"openssl-3.0",
1117+
"openssl-3.5",
11171118
"patchelf",
11181119
"sqlite",
11191120
"tcl",

‎cpython-unix/targets.yml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ aarch64-apple-darwin:
102102
- libffi
103103
- m4
104104
- mpdecimal
105-
- openssl-3.0
105+
- openssl-3.5
106106
- sqlite
107107
- tcl
108108
- tk
@@ -149,7 +149,7 @@ aarch64-apple-ios:
149149
- libffi
150150
- m4
151151
- mpdecimal
152-
- openssl-3.0
152+
- openssl-3.5
153153
- sqlite
154154
- xz
155155
- zstd
@@ -190,7 +190,7 @@ aarch64-unknown-linux-gnu:
190190
- m4
191191
- mpdecimal
192192
- ncurses
193-
- openssl-3.0
193+
- openssl-3.5
194194
- patchelf
195195
- sqlite
196196
- tcl
@@ -244,7 +244,7 @@ arm64-apple-tvos:
244244
- expat
245245
- m4
246246
- mpdecimal
247-
- openssl-3.0
247+
- openssl-3.5
248248
- sqlite
249249
- xz
250250
- zstd
@@ -279,7 +279,7 @@ armv7-unknown-linux-gnueabi:
279279
- m4
280280
- mpdecimal
281281
- ncurses
282-
- openssl-3.0
282+
- openssl-3.5
283283
- patchelf
284284
- sqlite
285285
- tcl
@@ -320,7 +320,7 @@ armv7-unknown-linux-gnueabihf:
320320
- m4
321321
- mpdecimal
322322
- ncurses
323-
- openssl-3.0
323+
- openssl-3.5
324324
- patchelf
325325
- sqlite
326326
- tcl
@@ -361,7 +361,7 @@ mips-unknown-linux-gnu:
361361
- m4
362362
- mpdecimal
363363
- ncurses
364-
- openssl-3.0
364+
- openssl-3.5
365365
- patchelf
366366
- sqlite
367367
- tcl
@@ -402,7 +402,7 @@ mipsel-unknown-linux-gnu:
402402
- m4
403403
- mpdecimal
404404
- ncurses
405-
- openssl-3.0
405+
- openssl-3.5
406406
- patchelf
407407
- sqlite
408408
- tcl
@@ -443,7 +443,7 @@ ppc64le-unknown-linux-gnu:
443443
- m4
444444
- mpdecimal
445445
- ncurses
446-
- openssl-3.0
446+
- openssl-3.5
447447
- patchelf
448448
- sqlite
449449
- tcl
@@ -484,7 +484,7 @@ riscv64-unknown-linux-gnu:
484484
- m4
485485
- mpdecimal
486486
- ncurses
487-
- openssl-3.0
487+
- openssl-3.5
488488
- patchelf
489489
- sqlite
490490
- tcl
@@ -525,7 +525,7 @@ s390x-unknown-linux-gnu:
525525
- m4
526526
- mpdecimal
527527
- ncurses
528-
- openssl-3.0
528+
- openssl-3.5
529529
- patchelf
530530
- sqlite
531531
- tcl
@@ -574,7 +574,7 @@ thumb7k-apple-watchos:
574574
- expat
575575
- m4
576576
- mpdecimal
577-
- openssl-3.0
577+
- openssl-3.5
578578
- sqlite
579579
- xz
580580
- zstd
@@ -627,7 +627,7 @@ x86_64-apple-darwin:
627627
- libffi
628628
- m4
629629
- mpdecimal
630-
- openssl-3.0
630+
- openssl-3.5
631631
- sqlite
632632
- tcl
633633
- tk
@@ -674,7 +674,7 @@ x86_64-apple-ios:
674674
- libffi
675675
- m4
676676
- mpdecimal
677-
- openssl-3.0
677+
- openssl-3.5
678678
- sqlite
679679
- xz
680680
- zstd
@@ -717,7 +717,7 @@ x86_64-apple-tvos:
717717
- expat
718718
- m4
719719
- mpdecimal
720-
- openssl-3.0
720+
- openssl-3.5
721721
- sqlite
722722
- xz
723723
- zstd
@@ -760,7 +760,7 @@ x86_64-apple-watchos:
760760
- expat
761761
- m4
762762
- mpdecimal
763-
- openssl-3.0
763+
- openssl-3.5
764764
- sqlite
765765
- xz
766766
- zstd
@@ -799,7 +799,7 @@ x86_64-unknown-linux-gnu:
799799
- m4
800800
- mpdecimal
801801
- ncurses
802-
- openssl-3.0
802+
- openssl-3.5
803803
- patchelf
804804
- sqlite
805805
- tcl
@@ -846,7 +846,7 @@ x86_64_v2-unknown-linux-gnu:
846846
- m4
847847
- mpdecimal
848848
- ncurses
849-
- openssl-3.0
849+
- openssl-3.5
850850
- patchelf
851851
- sqlite
852852
- tcl
@@ -893,7 +893,7 @@ x86_64_v3-unknown-linux-gnu:
893893
- m4
894894
- mpdecimal
895895
- ncurses
896-
- openssl-3.0
896+
- openssl-3.5
897897
- patchelf
898898
- sqlite
899899
- tcl
@@ -940,7 +940,7 @@ x86_64_v4-unknown-linux-gnu:
940940
- m4
941941
- mpdecimal
942942
- ncurses
943-
- openssl-3.0
943+
- openssl-3.5
944944
- patchelf
945945
- sqlite
946946
- tcl
@@ -985,7 +985,7 @@ x86_64-unknown-linux-musl:
985985
- mpdecimal
986986
- musl
987987
- ncurses
988-
- openssl-3.0
988+
- openssl-3.5
989989
- patchelf
990990
- sqlite
991991
- tcl
@@ -1030,7 +1030,7 @@ x86_64_v2-unknown-linux-musl:
10301030
- mpdecimal
10311031
- musl
10321032
- ncurses
1033-
- openssl-3.0
1033+
- openssl-3.5
10341034
- patchelf
10351035
- sqlite
10361036
- tcl
@@ -1075,7 +1075,7 @@ x86_64_v3-unknown-linux-musl:
10751075
- mpdecimal
10761076
- musl
10771077
- ncurses
1078-
- openssl-3.0
1078+
- openssl-3.5
10791079
- patchelf
10801080
- sqlite
10811081
- tcl
@@ -1120,7 +1120,7 @@ x86_64_v4-unknown-linux-musl:
11201120
- mpdecimal
11211121
- musl
11221122
- ncurses
1123-
- openssl-3.0
1123+
- openssl-3.5
11241124
- patchelf
11251125
- sqlite
11261126
- tcl
@@ -1167,7 +1167,7 @@ aarch64-unknown-linux-musl:
11671167
- mpdecimal
11681168
- musl
11691169
- ncurses
1170-
- openssl-3.0
1170+
- openssl-3.5
11711171
- patchelf
11721172
- sqlite
11731173
- tcl

‎cpython-windows/build.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,7 @@ def hack_props(
470470
raise Exception("unhandled architecture: %s" % arch)
471471

472472
try:
473-
# CPython 3.11+ builds with OpenSSL 3.0 by default.
473+
# CPython 3.11+ builds with OpenSSL 3.x by default.
474474
static_replace_in_file(
475475
openssl_props,
476476
b"<_DLLSuffix>-3</_DLLSuffix>",
@@ -1874,7 +1874,7 @@ def main() -> None:
18741874
if args.python in ("cpython-3.9", "cpython-3.10"):
18751875
openssl_entry = "openssl-1.1"
18761876
else:
1877-
openssl_entry = "openssl-3.0"
1877+
openssl_entry = "openssl-3.5"
18781878

18791879
openssl_archive = BUILD / (
18801880
"%s-%s-%s.tar" % (openssl_entry, target_triple, build_options)

‎pythonbuild/downloads.py‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -247,9 +247,6 @@
247247
"licenses": ["OpenSSL"],
248248
"license_file": "LICENSE.openssl-1.1.txt",
249249
},
250-
# We use OpenSSL 3.0 because it is an LTS release and has a longer support
251-
# window. If CPython ends up gaining support for 3.1+ releases, we can consider
252-
# using the latest available.
253250
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
254251
"openssl-3.0": {
255252
"url": "https://www.openssl.org/source/openssl-3.0.16.tar.gz",
@@ -260,6 +257,16 @@
260257
"licenses": ["Apache-2.0"],
261258
"license_file": "LICENSE.openssl-3.txt",
262259
},
260+
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
261+
"openssl-3.5": {
262+
"url": "https://github.com/openssl/openssl/releases/download/openssl-3.5.2/openssl-3.5.2.tar.gz",
263+
"size": 53180161,
264+
"sha256": "c53a47e5e441c930c3928cf7bf6fb00e5d129b630e0aa873b08258656e7345ec",
265+
"version": "3.5.2",
266+
"library_names": ["crypto", "ssl"],
267+
"licenses": ["Apache-2.0"],
268+
"license_file": "LICENSE.openssl-3.txt",
269+
},
263270
"nasm-windows-bin": {
264271
"url": "https://github.com/python/cpython-bin-deps/archive/nasm-2.11.06.tar.gz",
265272
"size": 384826,

‎src/verify_distribution.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -147,12 +147,12 @@ def test_ssl(self):
147147
self.assertTrue(ssl.HAS_TLSv1_2)
148148
self.assertTrue(ssl.HAS_TLSv1_3)
149149

150-
# OpenSSL 1.1 on older CPython versions on Windows. 3.0 everywhere
150+
# OpenSSL 1.1 on older CPython versions on Windows. 3.5 everywhere
151151
# else.
152152
if os.name == "nt" and sys.version_info[0:2] < (3, 11):
153153
wanted_version = (1, 1, 1, 23, 15)
154154
else:
155-
wanted_version = (3, 0, 0, 16, 0)
155+
wanted_version = (3, 5, 0, 2, 0)
156156

157157
self.assertEqual(ssl.OPENSSL_VERSION_INFO, wanted_version)
158158

0 commit comments

Comments
 (0)