astral-sh / astral-sh/python-build-standalone

Issues calling `ssl.create_default_context()` from within threads while using Fedora.

Open
#207 5 comments 1 reaction 0 assignees View on GitHub
bug external
Dominant language
Python
Stars
4.4k
Forks
314
Avg merge
1d 9h
Merged PRs (30d)
27

Description

Calling `ssl.create_default_context()` in version [20240107](https://github.com/indygreg/python-build-standalone/releases/tag/20240107) and [20231002](https://github.com/indygreg/python-build-standalone/releases/tag/20231002) from within a `threading.Thread()` will error with `pythonX.Y: unknown error (_ssl.c:ZZZZ)`

Observances:
- This only seems to occur on Fedora systems (Fedora 37 and 39 tested)
- The issue was introduced in version 20231002 and exists in 20240107
- The issue can be entirely avoided by just calling `ssl.create_default_context()` in the primary thread (but, see below WRT openSSL documentation)
- I cannot reproduce the issue with any of the python versions distributed by Fedora.

The issue was found from the Pants project (which runs Pex within a PBS runtime) https://github.com/pantsbuild/pants/issues/20467

I've created a repository with a Dockerfile and a script that can reproduce the issue here: https://github.com/xlevus/pants-issue-20467/tree/main (see `simple/repro.sh`)

I have no idea where the issue actually sits. The OpenSSL documentation on SSL_CTX is somewhat ambiguous too:

> An SSL_CTX object should not be changed after it is used to create any SSL objects or from multiple threads concurrently, since the implementation does not provide serialization of access for these cases.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.