77 Commits

Author SHA1 Message Date
Hugo van Kemenade
2fcd2830b7 [3.10] gh-145098: Add permissions: {} to all workflows (GH-148126) (#148139)
* [3.10] gh-145098: Use `macos-15-intel` instead of unstable `macos-26-intel` in `{jit,tail-call}.yml` (GH-148126)
(cherry picked from commit bce96a1813)

Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>

* Add 'permissions: {}' to all workflows

---------

Co-authored-by: Stan Ulbrych <stan@python.org>
2026-04-06 01:12:40 +03:00
William Woodruff
ba74c01ac0 [3.10] gh-146488: hash-pin all action references (gh-146489) (#147978) 2026-04-02 11:17:37 +03:00
Hugo van Kemenade
f12346d225 [3.10] Bump GitHub Actions (GH-143757) (#143803) 2026-01-13 17:23:17 +02:00
Hugo van Kemenade
5c19c5bac6 [3.10] gh-138744: GitHub Actions: pin to windows-2022 (GH-138743) (GH-138757)
(cherry picked from commit 6e78a539bf)
2025-09-13 22:37:07 +02:00
Hugo van Kemenade
457b2cac73 [3.10] gh-122544: Change OS image in GitHub Actions to Ubuntu 22.04 (GH-122566) (#130268)
Co-authored-by: Damien <81557462+Damien-Chen@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: James De Bias <81095953+DBJim@users.noreply.github.com>
2025-02-19 14:19:52 +01:00
Miss Islington (bot)
4413f2e3f1 [3.10] gh-107262: Update Tkinter tests for Tcl/Tk 8.6.14 (GH-119322) (#130274)
Co-authored-by: James De Bias <81095953+DBJim@users.noreply.github.com>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
2025-02-19 10:52:03 +02:00
Hugo van Kemenade
e43897c340 [3.10] gh-127359: Pin Tcl/Tk to 8 (8.6) for testing macOS (GH-127365) (#127408) 2024-11-30 18:38:29 +02:00
Petr Viktorin
850189a64e [3.10] gh-89452: GHA: Set --with-dbmliborder to avoid issues with homebrew's gdbm 1.24 (#125112)
Per https://github.com/python/cpython/issues/89452#issuecomment-1116329316,
the issue is fixed in configure for 3.11+, and

> For older Python versions, the workaround is to build with:
>
>     ./configure --with-dbmliborder=gdbm:ndbm

We need this workaround in GitHub Actions, otherwise the tests fail.
2024-10-08 16:37:22 +02:00
Seth Michael Larson
b6535ea7ec [3.10] gh-112160: Add 'regen-configure' make target (#112163)
Add 'regen-configure' make target
2023-11-20 23:38:10 +00:00
Ned Deily
97ce15c5f8 [3.10] gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.11 and multissltests to use 1.1.1w, 3.0.11, and 3.1.3. (#110007)
gh-109991: Update GitHub CI workflows to use OpenSSL 3.0.11 and multissltests to use 1.1.1w, 3.0.11, and 3.1.3.

(cherry picked from commit c88037d137)
2023-09-28 15:34:02 +01:00
Hugo van Kemenade
fc756f61b9 [3.10] CI: Bump GitHub Actions (GH-108879) (#108892)
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
2023-09-05 22:39:13 +02:00
Ned Deily
56e8c87e84 [3.10] gh-107565: Update multissltests and GitHub CI workflows to use OpenSSL 1.1.1v, 3.0.10, and 3.1.2. (GH-108120)
(cherry picked from commit 441797d4ff)
2023-08-18 21:21:19 +00:00
Miss Islington (bot)
073c660707 [3.10] CI: Bump macOS build to use OpenSSL v3.0 (GH-105538) (#105869)
(cherry picked from commit 34e93d3998)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
2023-07-05 13:20:29 +02:00
Gregory P. Smith
cb37100bec [3.10] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) (#105204)
Upgrade builds to OpenSSL 1.1.1u.

This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t.

The Mac/BuildScript/build-installer.py was already updated.

Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9.

Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting).

(cherry picked from commit ede89af).
(cherry picked from commit a5d2b546c1)
(cherry picked from commit f90d3f68db)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
2023-06-05 18:07:30 +02:00
Ned Deily
6cae23662e [3.10] Update GitHub CI workflow for macOS. (GH-105304) 2023-06-05 02:42:02 -04:00
Miss Islington (bot)
9a0116d35c gh-101981: Consolidate macOS configure steps in CI (GH-102131)
(cherry picked from commit e07b304bb0)

Co-authored-by: Erlend E. Aasland <erlend.aasland@protonmail.com>
Automerge-Triggered-By: GH:erlend-aasland
2023-02-23 09:12:13 -08:00
Miss Islington (bot)
95f4e2ca03 gh-101981: Apply HOMEBREW related environment variables (gh-102074)
(cherry picked from commit ed01addb59)

Co-authored-by: Dong-hee Na <donghee.na@python.org>
2023-02-20 08:22:13 -08:00
Dong-hee Na
c218132f93 [3.10] gh-101981: Fix Ubuntu SSL tests with OpenSSL (3.1.0-beta1) CI issue (gh-102079) 2023-02-21 00:43:33 +09:00
Miss Islington (bot)
63877f697d [3.10] gh-101981: Build macOS as recommended by the devguide (GH-102070) (#102073)
gh-101981: Build macOS as recommended by the devguide (GH-102070)

(cherry picked from commit 2713631041)
2023-02-20 15:52:25 +01:00
Steve Dower
b8149a9d7e gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727)
Fixes CVE-2023-0286 (High) and a couple of Medium security issues.
https://www.openssl.org/news/secadv/20230207.txt

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>
2023-02-09 19:29:14 +00:00
sterliakov
db1c3d6316 [3.10] gh-98548: Fix -ne shell operator spelling (#98555) 2022-10-28 12:12:42 +02:00
Dong-hee Na
25eae0b6c2 [3.10] gh-98456: Replace deprecated set-output with up-to-date vers… (gh-98564)
[3.10] gh-98456: Replace deprecated `set-output` with up-to-date version (gh-98457).
(cherry picked from commit 1db2a0cb20)

Co-authored-by: Noam Cohen <noam@noam.me>

Co-authored-by: Noam Cohen <noam@noam.me>
2022-10-25 12:02:47 +09:00
Ezio Melotti
428bd028b3 [3.10] Auto-cancel old builds when new commit pushed to branch (GH-98009) (#98163)
* Auto-cancel old builds when new commit pushed to branch

* Add a fallback

Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>

* Use the same group for all workflows.

Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>
(cherry picked from commit 75751f4aa5)

Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>

Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
2022-10-10 22:26:38 +02:00
Ezio Melotti
64ce2cba98 [3.10] ci: add GitHub token permissions (GH-92999) (#98161)
* ci: add GitHub token permissions (#92999)

(cherry picked from commit b96e20c1d9)

* [3.10] ci: add GitHub token permissions (GH-92999).
(cherry picked from commit b96e20c1d9)

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>

Co-authored-by: Varun Sharma <varunsh@stepsecurity.io>
2022-10-10 21:46:09 +02:00
Christian Heimes
32a45011e7 [3.10] gh-94682: Build and test with OpenSSL 1.1.1q (gh-94683) (gh-96391)
Co-authored-by: Christian Heimes <christian@python.org>
2022-08-29 20:02:00 +02:00
Pablo Galindo Salgado
ee2ddc2d44 [3.10] Add an error message to the ABI-dump file check (#94131) 2022-06-22 22:22:24 +01:00
Jelle Zijlstra
6712022447 [3.10] build(deps): bump actions/cache from 3.0.1 to 3.0.2 (GH-92111) (#92124)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.1...v3.0.2)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>.
(cherry picked from commit eefe6911f4)
2022-05-02 10:07:03 -06:00
Jelle Zijlstra
d8d5db5f10 [3.10] build(deps): bump actions/cache from 2.1.7 to 3.0.1 (GH-32228) (#91746)
Bumps [actions/cache](https://github.com/actions/cache) from 2.1.7 to 3.0.1.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v2.1.7...v3.0.1)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>.
(cherry picked from commit 3ace1034b8)
2022-04-20 18:53:05 -07:00
Jelle Zijlstra
c33524e68b [3.10] build(deps): bump actions/checkout from 2 to 3 (GH-32226) (#91723)
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>.
(cherry picked from commit 1ba63e3a9b)
2022-04-20 07:40:36 -07:00
Miss Islington (bot)
68caef8f8e build(deps): bump actions/setup-python from 2 to 3 (GH-31630)
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 2 to 3.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com>
(cherry picked from commit 74e319239b)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-19 13:41:39 -07:00
Christian Heimes
a59ac1e7d2 [3.10] bpo-47024: Update OpenSSL to 1.1.1n (GH-31895) (GH-31916)
Co-authored-by: Zachary Ware <zachary.ware@gmail.com>.
Co-authored-by: Christian Heimes <christian@python.org>
2022-03-15 21:31:00 +01:00
Ned Deily
cf96c279ac bpo-46106: Update OpenSSL to 1.1.1m (GH-30211) (GH-30224)
Co-authored-by: Ned Deily <nad@python.org>
Co-authored-by: Kumar Aditya <59607654+kumaraditya303@users.noreply.github.com>
2021-12-21 23:24:03 -05:00
Miss Islington (bot)
251d2eadc7 bpo-46114: Fix OpenSSL version check for 3.0.1 (GH-30170)
(cherry picked from commit 2985feac4e)

Co-authored-by: Christian Heimes <christian@python.org>
2021-12-17 07:38:11 -08:00
Miss Islington (bot)
1528d249a5 [3.10] bpo-44035: Check autoconf files thoroughly (GH-29935) (GH-29937)
Co-authored-by: Christian Heimes <christian@python.org>
2021-12-06 13:47:42 +01:00
Miss Islington (bot)
cd85d91bc6 bpo-45893: Add missing extern C to initconfig.h (GH-29761)
Co-authored-by: Steve Dower <steve.dower@python.org>
(cherry picked from commit f4afc53bf6)

Co-authored-by: Christian Heimes <christian@python.org>
2021-11-24 13:57:41 -08:00
Pablo Galindo Salgado
f146ca36f8 bpo-45350: Rerun autoreconf with the pkg-config macros (GH-28707) 2021-10-04 00:39:54 +01:00
Miss Islington (bot)
2fe15dbaad bpo-38820: Test with OpenSSL 3.0.0 final (GH-28205)
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit cc7c680194)

Co-authored-by: Christian Heimes <christian@python.org>
2021-09-08 01:25:58 -07:00
Miss Islington (bot)
8bb4912d94 Check that 'configure' is generated by GNU Autoconf 2.69 (GH-28152) (GH-28155)
(cherry picked from commit 6beaf2ffae)
2021-09-05 15:01:56 +01:00
Łukasz Langa
52bdda50d7 [3.10] bpo-45007: Update to OpenSSL 1.1.1l in Windows build and CI (GH-28009) (GH-28039)
(cherry picked from commit d3bdbbf9a4)

Co-authored-by: Steve Dower <steve.dower@python.org>
2021-08-30 15:19:16 +02:00
Pablo Galindo Salgado
c2e0b131c7 [3.10] Fail the CI if an optional module fails to compile (GH-27466). (GH-27481)
(cherry picked from commit 7cad0bee80)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
2021-07-30 16:14:28 +01:00
Miss Islington (bot)
b631d8d932 Add windows build.bat counterpart for 'make regen-all' in error message (GH-26770)
(cherry picked from commit d61b69f02d)

Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
2021-07-26 20:27:48 -07:00
Miss Islington (bot)
c6cd2ecdb6 [3.10] bpo-38820: Test with OpenSSL 3.0.0-beta1 (GH-26769) (GH-26799)
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 44fb551499)


Co-authored-by: Christian Heimes <christian@python.org>

Automerge-Triggered-By: GH:tiran
2021-06-19 03:44:37 -07:00
Miss Islington (bot)
36843f716d bpo-38820: Test with OpenSSL 3.0.0-alpha17 (GH-26266)
(cherry picked from commit 7109624d45)

Co-authored-by: Christian Heimes <christian@python.org>
2021-05-20 08:10:52 -07:00
Miss Islington (bot)
f8778f96e8 bpo-38820: Test with OpenSSL 3.0.0-alpha16 (GH-25942)
Also use new make target to install FIPS provider.
(cherry picked from commit e8525567dd)

Co-authored-by: Christian Heimes <christian@python.org>
2021-05-06 07:53:11 -07:00
Pablo Galindo
b86ac4c352 Add CI step to check changes in the exported ABI (GH-25868) 2021-05-04 02:15:11 +01:00
Pablo Galindo
4d58730a3a Update CI files to build the 3.10 branch 2021-05-04 01:47:28 +01:00
Brandt Bucher
29282b2825 Fix broken name in build.yml (GH-25759) 2021-05-01 15:02:30 -07:00
Christian Heimes
dcf658157d bpo-38820: Test with OpenSSL 3.0.0-alpha15 (GH-25537)
Signed-off-by: Christian Heimes <christian@python.org>
2021-04-23 14:19:21 +02:00
Christian Heimes
39258d3595 bpo-43669: PEP 644: Require OpenSSL 1.1.1 or newer (GH-23014)
- Remove HAVE_X509_VERIFY_PARAM_SET1_HOST check
- Update hashopenssl to require OpenSSL 1.1.1
- multissltests only OpenSSL > 1.1.0
- ALPN is always supported
- SNI is always supported
- Remove deprecated NPN code. Python wrappers are no-op.
- ECDH is always supported
- Remove OPENSSL_VERSION_1_1 macro
- Remove locking callbacks
- Drop PY_OPENSSL_1_1_API macro
- Drop HAVE_SSL_CTX_CLEAR_OPTIONS macro
- SSL_CTRL_GET_MAX_PROTO_VERSION is always defined now
- security level is always available now
- get_num_tickets is available with TLS 1.3
- X509_V_ERR MISMATCH is always available now
- Always set SSL_MODE_RELEASE_BUFFERS
- X509_V_FLAG_TRUSTED_FIRST is always available
- get_ciphers is always supported
- SSL_CTX_set_keylog_callback is always available
- Update Modules/Setup with static link example
- Mention PEP in whatsnew
- Drop 1.0.2 and 1.1.0 from GHA tests
2021-04-17 11:36:35 +02:00
Christian Heimes
8fa1489365 bpo-43811: Test multiple OpenSSL versions on GHA (GH-25360)
The new checks are only executed when one or more OpenSSL-related files are modified. The checks run a handful of networking and hashing test suites. All SSL checks are optional. This PR also introduces ccache to speed up compilation. In common cases it speeds up configure and compile time from about 90 seconds to less than 30 seconds.

Signed-off-by: Christian Heimes <christian@python.org>
2021-04-13 10:23:45 -07:00