Bump relenv to 0.22.14 (3006.x)#69413
Open
dwoz wants to merge 4 commits into
Open
Conversation
OpenSSL 3.5.x (shipped by relenv 0.22.13+) rejects ASN.1-malformed certs in the Windows root store. CPython's _load_windows_store_certs feeds the whole store to load_verify_locations(cadata=...) as one blob, so a single bad cert aborts the load and any import of salt.ext.tornado.netutil raises SSLError, which in turn breaks 'import salt.config' on Windows. Pin the module-level default contexts to certifi on Windows to bypass the OS store until relenv ships a cpython with the upstream fix.
Workaround 3a (in salt.ext.tornado.netutil) only fixed the import-time SSLContext, but third-party libs in the onedir (aiohttp.connector, etc.) call ssl.create_default_context() themselves and trip the same ASN1 NOT_ENOUGH_DATA load_verify_locations(cadata=blob) failure under OpenSSL 3.5.x. Replace ssl.SSLContext._load_windows_store_certs at salt import time with the iter-and-skip variant proposed upstream. Effective for every caller in the salt process - first- and third-party - as long as 'import salt' runs first, which it does for every salt entry point. Remove once relenv ships a cpython with the upstream fix.
The previous monkey-patch closed over _ssl, then del'd it at the end of the if block. Closures resolve at call time, so the first call to _salt_safe_load_windows_store_certs raised NameError instead of silently skipping a malformed cert. Capture ssl.SSLError as a default argument so the function stays self-contained after _ssl is deleted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.22.11→0.22.14on 3006.x.Test plan