Use openSSL 3.0.x for Python 3.8+

[marcelotduarte]

No description provided.

[mayeut]

Thanks for the PR
Mostly waiting for OpenSSL 1.1.1 EOL (2023-09-11) to switch to OpenSSL 3.x
If I'm not mistaken, there were some issues with OpenSSL 3 with older CPython versions. I think CPython 3.7 received some back ports (CPython 3.8 should have full support) but not CPython 3.6 (which is EOL).
I do have a branch locally to test OpenSSL 3.x build.
I went to a dynamic build on that branch so I have a bit more changes than in this PR.

One of the changes missing here is the change to update_native_dependencies.py to get the update workflow checking for OpenSSL 3.0.x updates rather than 1.1.1 updates.

[h-vetinari]

I think CPython 3.7 received some back ports (CPython 3.8 should have full support)

Indeed 3.7 is not fully ready for OpenSSL 3.0 AFAIK, but OTOH, it will become end of life this month.

[marcelotduarte]

@mayeut Sorry, I didn't have time to continue this PR. For me personally, it would be interesting to have openssl3 in Python 3.10+, but I see that in CPython, for macOS and Windows they only release installers for 3.11+ (even because they no longer produce installers for version 3.10, which is under security fix).
python/cpython#107565

I think CPython 3.7 received some back ports (CPython 3.8 should have full support)

Indeed 3.7 is not fully ready for OpenSSL 3.0 AFAIK, but OTOH, it will become end of life this month.

In CPython there are tests since 3.8:
python/cpython#108124

[marcelotduarte]

@mayeut I will make the changes by tomorrow at the latest.

[marcelotduarte]

@mayeut Can I squash and rebase the PR?

[mayeut]

@marcelotduarte,

I will open a PR to use system openssl for python 3.6 & 3.7 (it will downgrade openssl from 1.1.1 to 1.0.2 for python 3.6 & 3.7 but given they will still be functional and are EOL, I think that's completely fine).

Please wait a bit to rebase in order to rebase on this PR.
I'll let the PR opened about 1-2 weeks in order to give a chance to downstream users to comment.
The other option would be to build 3.6 & 3.7 with openssl 3.x as well (in case system does not provide 1.1.1) given it seems to pass some basic functionality (i.e., pip install).

[mayeut]

I think all commits related to dual openssl versions shall be removed.
The only thing that had an action in the previous review was to restore the minimum version to 1.1.1

[pelson]

I will open a PR to use system openssl for python 3.6 & 3.7 (it will downgrade openssl from 1.1.1 to 1.0.2 for python 3.6 & 3.7 but given they will still be functional and are EOL, I think that's completely fine).

Just a comment to say that this caught me out last week. I put some details in #1535 (comment).

I think calling Python 3.7 EoL is totally reasonable, but it is difficult to call the Python 3.7 shipped as fully "functional". I also appreciate that the case in the attached comment relates to a third-party package (albeit the second-most popular, by download, package on PyPI).