Staging
v0.5.1
https://github.com/python/cpython
Revision 8ab624b17ba656e9af5a79be6af0cf2911a111ba authored by Gregory P. Smith on 29 May 2019, 02:08:28 UTC, committed by Ned Deily on 29 May 2019, 02:08:27 UTC
* [3.6] bpo-35925: Skip SSL tests that fail due to weak external certs. (GH-13124)

Modern Linux distros such as Debian Buster have default OpenSSL system
configurations that reject connections to servers with weak certificates
by default.  This causes our test suite run with external networking
resources enabled to skip these tests when they encounter such a failure.

Fixing the network servers is a separate issue..
(cherry picked from commit 2cc0223f43a1ffd59c887a73e2b0ce5202f3be90)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

* Also skip ssl tests that fail when the system rejects TLSv1.

* Remove the test_httplib change; server was updated.

self-signed.pythontest.net was updated so the test_httplib change is
no longer necessary.
1 parent 3dbc43f
Raw File
Tip revision: 8ab624b17ba656e9af5a79be6af0cf2911a111ba authored by Gregory P. Smith on 29 May 2019, 02:08:28 UTC
[3.6] bpo-35925: Skip SSL tests that fail due to weak external certs or old TLS (GH-13124) (GH-13252)
Tip revision: 8ab624b
.travis.yml
language: c
dist: trusty
sudo: false
group: beta

# To cache doc-building dependencies and C compiler output.
cache:
  - pip
  - ccache

env:
  global:
    # Use -O3 because we don't use debugger on Travis-CI
    - CFLAGS="-O3"

branches:
  only:
    - master
    - /^\d\.\d$/
    - buildbot-custom

matrix:
  fast_finish: true
  allow_failures:
    - env: OPTIONAL=true
  include:
    - os: linux
      language: c
      compiler: clang
      # gcc also works, but to keep the # of concurrent builds down, we use one C
      # compiler here and the other to run the coverage build. Clang is preferred
      # in this instance for its better error messages.
      env: TESTING=cpython
      addons:
        apt:
          packages:
            - xvfb
    - os: linux
      language: python
      python: 3.6
      env: TESTING=docs
      before_script:
        - cd Doc
        # Sphinx is pinned so that new versions that introduce new warnings won't suddenly cause build failures.
        # (Updating the version is fine as long as no warnings are raised by doing so.)
        - python -m pip install sphinx==1.8.2 blurb
      script:
        - make check suspicious html SPHINXOPTS="-q -W -j4"
    - os: linux
      language: c
      compiler: gcc
      env: OPTIONAL=true
      addons:
        apt:
          packages:
            - xvfb
      before_script:
        - ./configure PYTHON_FOR_REGEN=python3
        - make -s -j4
        # Need a venv that can parse covered code.
        - ./python -m venv venv
        - ./venv/bin/python -m pip install -U coverage
        - ./venv/bin/python -m test.pythoninfo
      script:
        # Skip tests that re-run the entire test suite.
        - xvfb-run ./venv/bin/python -m coverage run --pylib -m test -uall,-cpu -x test_multiprocessing_fork -x test_multiprocessing_forkserver -x test_multiprocessing_spawn
      after_script:  # Probably should be after_success once test suite updated to run under coverage.py.
        # Make the `coverage` command available to Codecov w/ a version of Python that can parse all source files.
        - source ./venv/bin/activate
        - bash <(curl -s https://codecov.io/bash)


before_install:
  - set -e
  - |
      # Check short-circuit conditions
      if [ "${TESTING}" != "docs" ]
      then
        if [ "$TRAVIS_PULL_REQUEST" = "false" ]
        then
          echo "Not a PR, doing full build."
        else
          # Pull requests are slightly complicated because $TRAVIS_COMMIT_RANGE
          # may include more changes than desired if the history is convoluted.
          # Instead, explicitly fetch the base branch and compare against the
          # merge-base commit.
          git fetch -q origin +refs/heads/$TRAVIS_BRANCH
          changes=$(git diff --name-only HEAD $(git merge-base HEAD FETCH_HEAD))
          echo "Files changed:"
          echo "$changes"
          if ! echo "$changes" | grep -qvE '(\.rst$)|(^Doc)|(^Misc)'
          then
            echo "Only docs were updated, stopping build process."
            exit
          fi
        fi
      fi

# Travis provides only 2 cores, so don't overdo the parallelism and waste memory.
before_script:
  - ./configure --with-pydebug PYTHON_FOR_REGEN=python3
  - make -j4 regen-all
  - changes=`git status --porcelain`
  - |
      # Check for changes in regenerated files
      if ! test -z "$changes"
      then
        echo "Generated files not up to date"
        echo "$changes"
        exit 1
      fi
  - make -j4
  - make pythoninfo

script:
  # Using the built Python as patchcheck.py is built around the idea of using
  # a checkout-build of CPython to know things like what base branch the changes
  # should be compared against.
  # Only run on Linux as the check only needs to be run once.
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then ./python Tools/scripts/patchcheck.py --travis $TRAVIS_PULL_REQUEST; fi
  # Check that all symbols exported by libpython start with "Py" or "_Py"
  - make smelly
  # `-r -w` implicitly provided through `make buildbottest`.
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then XVFB_RUN=xvfb-run; fi; $XVFB_RUN make buildbottest TESTOPTS="-j4 -uall,-cpu"

notifications:
  email: false
  irc:
    channels:
      # This is set to a secure variable to prevent forks from notifying the
      # IRC channel whenever they fail a build. This can be removed when travis
      # implements https://github.com/travis-ci/travis-ci/issues/1094.
      # The actual value here is: irc.freenode.net#python-dev
      - secure: "s7kAkpcom2yUJ8XqyjFI0obJmhAGrn1xmoivdaPdgBIA++X47TBp1x4pgDsbEsoalef7bEwa4l07KdT4qa+DOd/c4QxaWom7fbN3BuLVsZuVfODnl79+gYq/TAbGfyH+yDs18DXrUfPgwD7C5aW32ugsqAOd4iWzfGJQ5OrOZzqzGjYdYQUEkJFXgxDEIb4aHvxNDWGO3Po9uKISrhb5saQ0l776yLo1Ur7M4oxl8RTbCdgX0vf5TzPg52BgvZpOgt3DHOUYPeiJLKNjAE6ibg0U95sEvMfHX77nz4aFY4/3UI6FFaRla34rZ+mYKrn0TdxOhera1QOgPmM6HzdO4K44FpfK1DS0Xxk9U9/uApq+cG0bU3W+cVUHDBe5+90lpRBAXHeHCgT7TI8gec614aiT8lEr3+yH8OBRYGzkjNK8E2LJZ/SxnVxDe7aLF6AWcoWLfS6/ziAIBFQ5Nc4U72CT8fGVSkl8ywPiRlvixKdvTODMSZo0jMqlfZSNaAPTsNRx4wu5Uis4qekwe32Fz4aB6KGpsuuVjBi+H6v0RKxNJNGY3JKDiEH2TK0UE2auJ5GvLW48aUVFcQMB7euCWYXlSWVRHh3WLU8QXF29Dw4JduRZqUpOdRgMHU79UHRq+mkE0jAS/nBcS6CvsmxCpTSrfVYuMOu32yt18QQoTyU="
    on_success: change
    on_failure: always
    skip_join: true
back to top