git failing on TIger buildbots due to github.com security changes
As of several days ago, github.com finally removed support for obsolete crypto standards:
https://github.com/blog/2507-weak-cryptographic-standards-removed
That appears to be the root cause of git failures on the macOS 10.4 Tiger buildbots. David, you have been doing a great service over many years in setting up and keeping those buildbots running: thank you! I know they have been a bit of a pain to other core-developers because the version of macOS is so old and its Posix compliance is "challenging" (e.g. Apple made big improvement in 10.5 and subsequent releases). My take has been that, as long as someone is willing to keep the buildbots running and the work to fix failing tests isn't too much, continuing to test with such an older and stable system is a good thing. But I dunno, perhaps it is time to retire 10.4 testing? Another issue is that the dmg buildbots are fine for testing the installer build - assuming the third-party libs also still build on 10.4 - but the dmgs produced are no longer installable on current macOS systems since the macOS installer app dropped support for the old bundle installer format a few release ago and building the newer flat installer package format is not supported on 10.4 (AFAIK).
So I guess there are a couple of separate issues here:
David, if you are willing and able to put a newer version of git that links with a newer version of OpenSSL (or some such) so that github pulls work again, that would be swell but not mandatory.
We should look at moving the installer builds to a newer version of macOS. I have a machine or two here that I have been intending to set up with some VMs for buildbots that could be used. But I may not have time to do that for a bit.
I need to document the flat package build process; currently, it is a magic transformation and doesn't really fit well into the current build-installer. I will track that along with Issue24502.
-- Ned Deily nad@python.org -- []
You beat me to the punch, but I was near to sending a similar note. As far as the Tiger buildbots, I think it's probably time to just shut them down.
Even if I fix the more recent git problem, I had already been looking at an OpenSSL 1.1.0 build issue, for which I had gotten a static build to work under 10.4, but not shared. The installer builds had already been failing for the 3.7 and 3.x branches, and the regular workers were not performing SSL testing for those branches.
I think we're in sync that the value proposition of 10.4 has been marginal for a while now; while it has surprisingly helped identify some real issues even recently, I think the effort to remain operational at this point is not worth the benefits.
-- David
On Tue, Feb 27, 2018 at 11:13 AM, Ned Deily nad@python.org wrote:
As of several days ago, github.com finally removed support for obsolete crypto standards:
https://github.com/blog/2507-weak-cryptographic-standards-removed
That appears to be the root cause of git failures on the macOS 10.4 Tiger buildbots. David, you have been doing a great service over many years in setting up and keeping those buildbots running: thank you! I know they have been a bit of a pain to other core-developers because the version of macOS is so old and its Posix compliance is "challenging" (e.g. Apple made big improvement in 10.5 and subsequent releases). My take has been that, as long as someone is willing to keep the buildbots running and the work to fix failing tests isn't too much, continuing to test with such an older and stable system is a good thing. But I dunno, perhaps it is time to retire 10.4 testing? Another issue is that the dmg buildbots are fine for testing the installer build - assuming the third-party libs also still build on 10.4 - but the dmgs produced are no longer installable on current macOS systems since the macOS installer app dropped support for the old bundle installer format a few release ago and building the newer flat installer package format is not supported on 10.4 (AFAIK).
So I guess there are a couple of separate issues here:
David, if you are willing and able to put a newer version of git that links with a newer version of OpenSSL (or some such) so that github pulls work again, that would be swell but not mandatory.
We should look at moving the installer builds to a newer version of macOS. I have a machine or two here that I have been intending to set up with some VMs for buildbots that could be used. But I may not have time to do that for a bit.
I need to document the flat package build process; currently, it is a magic transformation and doesn't really fit well into the current build-installer. I will track that along with Issue24502.
-- Ned Deily nad@python.org -- []
On Feb 27, 2018, at 14:01, David Bolen db3l.net@gmail.com wrote:
I think we're in sync that the value proposition of 10.4 has been marginal for a while now; while it has surprisingly helped identify some real issues even recently, I think the effort to remain operational at this point is not worth the benefits.
Sniff! Alas, poor Tiger, we knew ye well!
Thanks for all of your help keeping it running, David! I've really appreciated your help!
Zach, perhaps you can deconfigure the Tiger buildbots in the buildbot config?
Thanks, all!
-- Ned Deily nad@python.org -- []
On Tue, Feb 27, 2018 at 1:09 PM, Ned Deily nad@python.org wrote:
On Feb 27, 2018, at 14:01, David Bolen db3l.net@gmail.com wrote:
I think we're in sync that the value proposition of 10.4 has been marginal for a while now; while it has surprisingly helped identify some real issues even recently, I think the effort to remain operational at this point is not worth the benefits.
Sniff! Alas, poor Tiger, we knew ye well!
Thanks for all of your help keeping it running, David! I've really appreciated your help!
Zach, perhaps you can deconfigure the Tiger buildbots in the buildbot config?
Can do. Is that both the Tiger (bolen-tiger, [1]) and dmg (bolen-dmg, [2]) builders?
[1] https://github.com/python/buildmaster-config/blob/master/master/master.cfg#L... [2] https://github.com/python/buildmaster-config/blob/master/master/master.cfg#L...
Zach
On Feb 27, 2018, at 14:25, Zachary Ware zachary.ware@gmail.com wrote:
On Tue, Feb 27, 2018 at 1:09 PM, Ned Deily nad@python.org wrote:
Zach, perhaps you can deconfigure the Tiger buildbots in the buildbot config? Can do. Is that both the Tiger (bolen-tiger, [1]) and dmg (bolen-dmg, [2]) builders?
Yep, thanks!
[1] https://github.com/python/buildmaster-config/blob/master/master/master.cfg#L... [2] https://github.com/python/buildmaster-config/blob/master/master/master.cfg#L...
-- Ned Deily nad@python.org -- []
participants (3)
-
David Bolen -
Ned Deily -
Zachary Ware