Staging
v0.8.1
Revision 2614ed4c6e4b32eafb683f2378ed20e87d42976d authored by Miss Islington (bot) on 27 February 2018, 08:17:49 UTC, committed by GitHub on 27 February 2018, 08:17:49 UTC

* bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and
TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2. Other tests currently
fail because the threaded or async test servers stop after failure.

I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 05d9fe32a1245b9a798e49e0c1eb91f110935b69)

Co-authored-by: Christian Heimes <christian@python.org>
1 parent a93e3dc
Raw File
.travis.yml
language: c
dist: trusty
sudo: false
group: beta

# To cache doc-building dependencies and C compiler output.
cache:
  - pip
  - ccache
  - directories:
    - $HOME/multissl

env:
  global:
    - OPENSSL=1.1.0g
    - OPENSSL_DIR="$HOME/multissl/openssl/${OPENSSL}"
    - PATH="${OPENSSL_DIR}/bin:$PATH"
    # Use -O3 because we don't use debugger on Travis-CI
    - CFLAGS="-I${OPENSSL_DIR}/include -O3"
    - LDFLAGS="-L${OPENSSL_DIR}/lib"
    # Set rpath with env var instead of -Wl,-rpath linker flag
    # OpenSSL ignores LDFLAGS when linking bin/openssl
    - LD_RUN_PATH="${OPENSSL_DIR}/lib"

branches:
  only:
    - master
    - /^\d\.\d$/
    - buildbot-custom

matrix:
  fast_finish: true
  allow_failures:
    - env: OPTIONAL=true
  include:
    - os: linux
      language: c
      compiler: clang
      # gcc also works, but to keep the # of concurrent builds down, we use one C
      # compiler here and the other to run the coverage build. Clang is preferred
      # in this instance for its better error messages.
      env: TESTING=cpython
    - os: linux
      language: python
      # Build the docs against a stable version of Python so code bugs don't hold up doc-related PRs.
      python: 3.6
      env: TESTING=docs
      before_script:
        - cd Doc
        # Sphinx is pinned so that new versions that introduce new warnings won't suddenly cause build failures.
        # (Updating the version is fine as long as no warnings are raised by doing so.)
        - python -m pip install sphinx~=1.6.1 blurb
      script:
        - make check suspicious html SPHINXOPTS="-q -W -j4"
    - os: linux
      language: c
      compiler: gcc
      env: OPTIONAL=true
      before_script:
        - ./configure
        - make -s -j4
        # Need a venv that can parse covered code.
        - ./python -m venv venv
        - ./venv/bin/python -m pip install -U coverage
        - ./venv/bin/python -m test.pythoninfo
      script:
        # Skip tests that re-run the entire test suite.
        - ./venv/bin/python -m coverage run --pylib -m test --fail-env-changed -uall,-cpu -x test_multiprocessing_fork -x test_multiprocessing_forkserver -x test_multiprocessing_spawn -x test_concurrent_futures
      after_script:  # Probably should be after_success once test suite updated to run under coverage.py.
        # Make the `coverage` command available to Codecov w/ a version of Python that can parse all source files.
        - source ./venv/bin/activate
        - bash <(curl -s https://codecov.io/bash)


before_install:
  - set -e
  - |
      # Check short-circuit conditions
      if [ "${TESTING}" != "docs" ]
      then
        if [ "$TRAVIS_PULL_REQUEST" = "false" ]
        then
          echo "Not a PR, doing full build."
        else
          # Pull requests are slightly complicated because $TRAVIS_COMMIT_RANGE
          # may include more changes than desired if the history is convoluted.
          # Instead, explicitly fetch the base branch and compare against the
          # merge-base commit.
          git fetch -q origin +refs/heads/$TRAVIS_BRANCH
          changes=$(git diff --name-only HEAD $(git merge-base HEAD FETCH_HEAD))
          echo "Files changed:"
          echo "$changes"
          if ! echo "$changes" | grep -qvE '(\.rst$)|(^Doc)|(^Misc)'
          then
            echo "Only docs were updated, stopping build process."
            exit
          fi
        fi
      fi

install:
  - |
      # Install OpenSSL as necessary
      if [ "${TESTING}" != "docs" ]
      then
        # clang complains about unused-parameter a lot, redirect stderr
        python3 Tools/ssl/multissltests.py --steps=library \
            --base-directory ${HOME}/multissl \
            --openssl ${OPENSSL} >/dev/null 2>&1
      fi
  - openssl version

# Travis provides only 2 cores, so don't overdo the parallelism and waste memory.
before_script:
  - ./configure --with-pydebug
  - make -j4 regen-all
  - changes=`git status --porcelain`
  - |
      # Check for changes in regenerated files
      if ! test -z "$changes"
      then
        echo "Generated files not up to date"
        echo "$changes"
        exit 1
      fi
  - make -j4
  - make pythoninfo

script:
  # Using the built Python as patchcheck.py is built around the idea of using
  # a checkout-build of CPython to know things like what base branch the changes
  # should be compared against.
  # Only run on Linux as the check only needs to be run once.
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then ./python Tools/scripts/patchcheck.py --travis $TRAVIS_PULL_REQUEST; fi
  # Check that all symbols exported by libpython start with "Py" or "_Py"
  - make smelly
  # `-r -w` implicitly provided through `make buildbottest`.
  - make buildbottest TESTOPTS="-j4 -uall,-cpu"

notifications:
  email: false
  irc:
    channels:
      # This is set to a secure variable to prevent forks from notifying the
      # IRC channel whenever they fail a build. This can be removed when travis
      # implements https://github.com/travis-ci/travis-ci/issues/1094.
      # The actual value here is: irc.freenode.net#python-dev
      - secure: "s7kAkpcom2yUJ8XqyjFI0obJmhAGrn1xmoivdaPdgBIA++X47TBp1x4pgDsbEsoalef7bEwa4l07KdT4qa+DOd/c4QxaWom7fbN3BuLVsZuVfODnl79+gYq/TAbGfyH+yDs18DXrUfPgwD7C5aW32ugsqAOd4iWzfGJQ5OrOZzqzGjYdYQUEkJFXgxDEIb4aHvxNDWGO3Po9uKISrhb5saQ0l776yLo1Ur7M4oxl8RTbCdgX0vf5TzPg52BgvZpOgt3DHOUYPeiJLKNjAE6ibg0U95sEvMfHX77nz4aFY4/3UI6FFaRla34rZ+mYKrn0TdxOhera1QOgPmM6HzdO4K44FpfK1DS0Xxk9U9/uApq+cG0bU3W+cVUHDBe5+90lpRBAXHeHCgT7TI8gec614aiT8lEr3+yH8OBRYGzkjNK8E2LJZ/SxnVxDe7aLF6AWcoWLfS6/ziAIBFQ5Nc4U72CT8fGVSkl8ywPiRlvixKdvTODMSZo0jMqlfZSNaAPTsNRx4wu5Uis4qekwe32Fz4aB6KGpsuuVjBi+H6v0RKxNJNGY3JKDiEH2TK0UE2auJ5GvLW48aUVFcQMB7euCWYXlSWVRHh3WLU8QXF29Dw4JduRZqUpOdRgMHU79UHRq+mkE0jAS/nBcS6CvsmxCpTSrfVYuMOu32yt18QQoTyU="
    on_success: change
    on_failure: always
    skip_join: true
back to top