Repository navigation
github CI blocked by the Ubuntu CI with an SSL error #87548
Description
| BPO | 43382 |
|---|---|
| Nosy | @nascheme, @gpshead, @vstinner, @tiran, @ned-deily, @ambv, @xnox, @pganssle, @brandtbucher, @martonivan |
| PRs |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = 'https://github.com/tiran'
closed_at = <Date 2021-03-18.08:32:27.271>
created_at = <Date 2021-03-03.04:29:04.400>
labels = ['3.7', '3.8', '3.9', 'release-blocker', 'build', 'tests', 'expert-SSL', 'type-bug', '3.10']
title = 'github CI blocked by the Ubuntu CI with an SSL error'
updated_at = <Date 2021-03-18.08:32:27.270>
user = 'https://github.com/gpshead'bugs.python.org fields:
activity = <Date 2021-03-18.08:32:27.270>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2021-03-18.08:32:27.271>
closer = 'christian.heimes'
components = ['Build', 'Tests', 'SSL']
creation = <Date 2021-03-03.04:29:04.400>
creator = 'gregory.p.smith'
dependencies = []
files = []
hgrepos = []
issue_num = 43382
keywords = ['patch']
message_count = 21.0
messages = ['387998', '388000', '388001', '388002', '388004', '388006', '388007', '388009', '388010', '388011', '388019', '388031', '388035', '388043', '388045', '388047', '388048', '388052', '388055', '388060', '388999']
nosy_count = 10.0
nosy_names = ['nascheme', 'gregory.p.smith', 'vstinner', 'christian.heimes', 'ned.deily', 'lukasz.langa', 'xnox', 'p-ganssle', 'brandtbucher', 'martonivan']
pr_nums = ['24715']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue43382'
versions = ['Python 3.7', 'Python 3.8', 'Python 3.9', 'Python 3.10']
Activity
gpshead commentedon Mar 3, 2021
https://github.com/python/cpython/pull/20442/checks?check_run_id=2018900756
ssl.SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA] tlsv1 alert unknown ca (_ssl.c:1122)
[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1122)
ssl.SSLError: [SSL: SSLV3_ALERT_BAD_CERTIFICATE] sslv3 alert bad certificate (_ssl.c:1122)
ssl.SSLError: [SSL] internal error (_ssl.c:1122)
ssl.SSLError: [SSL] called a function you should not call (_ssl.c:1122)
ssl.SSLEOFError: EOF occurred in violation of protocol (_ssl.c:1122)
ssl.SSLError: [SSL: UNEXPECTED_MESSAGE] unexpected message (_ssl.c:1122)
ssl.SSLError: [SSL: TLSV1_ALERT_INTERNAL_ERROR] tlsv1 alert internal error (_ssl.c:1122)
[SSL: NO_PROTOCOLS_AVAILABLE] no protocols available (_ssl.c:1122)
... and so on ...
This CI failure is preventing any PR from being merged.
Do we have a bad test certificate in the tree we need to update?
Or did some Ubuntu CI infrastructure just fall over and start rejecting a certificate it used to accept?
I believe this started around ~20210302T1500 UTC.
14 remaining items
tiran commentedon Mar 3, 2021
I have backported the workaround to 3.7, 3.8, and 3.9. There was some issue with the backport bot and I didn't have time to investigate. PRs are:
#24716
#24717
#24718
tiran commentedon Mar 3, 2021
Downstream has asked me to file a separate bug for internal error during handshake. The problem is tracked at https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 .
brandtbucher commentedon Mar 3, 2021
@ned.deily, I think the 3.7 backport needs RM approval (or something?):
#24716
The others branches are fine now... thanks, Christian!
ned-deily commentedon Mar 3, 2021
3.7 backport is now merged, too.
gpshead commentedon Mar 3, 2021
How do I get a CI run on a PR to actually pickup this change? clicking rerun failed.
ned-deily commentedon Mar 3, 2021
You may have to refresh the PR so that is uses the latest HEAD that includes the config change.
tiran commentedon Mar 3, 2021
Yeah, that's the annoying part. Users have to rebase all their PRs in order to make CI pass. It's going to be painful. :(
brandtbucher commentedon Mar 3, 2021
Closing and reopening may work, or pushing an empty commit. I know that's helped appease some GitHub CI weirdness in the past.
gpshead commentedon Mar 3, 2021
yeah i figured it might require a rebase. if anyone has the appropriate git command to do that to a branch, creating a 2-4 step CLI playbook for people to apply to pending PR branches would be useful.
gpshead commentedon Mar 3, 2021
we may not need that: Closing and reopening the PR worked. I suspect the github CI "rerun" button was "rerun in the exact same config".
nascheme commentedon Mar 3, 2021
It seems it is enough to make a new commit. The CI seems to re-base and re-run the PR. At least, it worked on two of my PRs.
tiran commentedon Mar 18, 2021
CI is passing again.