macos-13 20230731.2 image has broken python 3.7

[alex]

Description

  using: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
  with:
    python-version: 3.7
    architecture: x64
    cache: pip
    cache-dependency-path: ci-constraints-requirements.txt

Produces the following output/error:

Version 3.7 was not found in the local cache
  Version 3.7 is available for downloading
  Download from "https://github.com/actions/python-versions/releases/download/3.7.[17](https://github.com/pyca/cryptography/actions/runs/5728698641/job/15524172021#step:4:18)-5356448435/python-3.7.17-darwin-x64.tar.gz"
  Extract downloaded archive
  /usr/bin/tar xz -C /Users/runner/work/_temp/e9bd789d-c91e-4567-9854-0f1a50db88bf -f /Users/runner/work/_temp/cf421e15-6a49-4e76-bf05-ff2d5f741ede
  Execute installation script
  Check if Python hostedtoolcache folder exist...
  Create Python 3.7.17 folder
  Copy Python binaries to hostedtoolcache folder
  Create additional symlinks (Required for the UsePythonVersion Azure Pipelines task and the setup-python GitHub Action)
  Upgrading pip...
  Looking in links: /var/folders/cn/nkrr6l5n0jz01kq9jbtb9tg00000gn/T/tmpy5uz5i2j
  Requirement already satisfied: setuptools in /Users/runner/hostedtoolcache/Python/3.7.17/x64/lib/python3.7/site-packages (47.1.0)
  Requirement already satisfied: pip in /Users/runner/hostedtoolcache/Python/3.7.17/x64/lib/python3.7/site-packages ([23](https://github.com/pyca/cryptography/actions/runs/5728698641/job/15524172021#step:4:24).0.1)
  Error: WARNING: pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.
  Error: WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError("Can't connect to HTTPS URL because the SSL module is not available.")': /simple/pip/
  Error: WARNING: Retrying (Retry(total=3, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError("Can't connect to HTTPS URL because the SSL module is not available.")': /simple/pip/
  Error: WARNING: Retrying (Retry(total=2, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError("Can't connect to HTTPS URL because the SSL module is not available.")': /simple/pip/
  Error: WARNING: Retrying (Retry(total=1, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError("Can't connect to HTTPS URL because the SSL module is not available.")': /simple/pip/
  Error: WARNING: Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by 'SSLError("Can't connect to HTTPS URL because the SSL module is not available.")': /simple/pip/
  Could not fetch URL https://pypi.org/simple/pip/: There was a problem confirming the ssl certificate: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/pip/ (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available.")) - skipping
  Error: ERROR: Could not find a version that satisfies the requirement pip (from versions: none)
  Error: ERROR: No matching distribution found for pip
  Error: The process '/bin/bash' failed with exit code 1

This was working fine with the previous version of the macos-13 image.

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• macOS 11
• macOS 12
• macOS 13
• Windows Server 2019
• Windows Server 2022

Image version and build link

Image: macos-13
Version: 20230731.2

Is it regression?

Yes

Expected behavior

Python 3.7 is setup properly

Actual behavior

See error.

Repro steps

See provided action invocation.

[mikhailkoliada]

@dmitry-shibanov @MaksimZhukov could you please take a look?

[alex]

FWIW, notwithstanding that this uses actions/setup-python, and that the Python version is not cached, the variable that changes to cause this issue is the macOS image.

I strongly suspect the issue here is that Python 3.7's ssl module links against a library that's no longer present in the new image. Likely candidate is brew's openssl@3 vs. openssl@1.1.

[alex]

Confirmed in pyca/cryptography#9329 that by manually brew install openssl@1.1 the issue is resolved, which strongly indicates that the issue is that the Python version's SSL module links against that, but its no longer present in the image.

[rajivshah3]

Is it possible that actions/runner-images#8017 is somewhat related? Previously the macOS 13 image was using LibreSSL, now it's using OpenSSL 3

FWIW, we are also running into this issue when attempting to set up Python 3.10, so I don't think this is just an issue with 3.7. I'm not sure why 3.10 is not found in the cache though, because it's listed as a cached version on the macOS 13 image. It was working about an hour ago

[alex]

I do not believe its LibreSSL related, as I noted I'm able to mitigate this with brew install openssl@1.1.

[testableapple]

Just faced this issue on GitHub Actions. Looks like bumping the Python version to 3.11 solved it for us.

[rfc-hv]

We also see the same issue causing github actions CI failure during actions/setup-python@v4 across python 3.9 and 3.10, with the macos-13 version 20230731.2 runner image. It was working ~ 16 hours ago with the macos-13 version 20230611.2 runner image.

edit: alex's mitigation works for us for actions/setup-python@v4 with python-version python 3.9 and python 3.10

[dusan-trickovic]

Hello everyone! Thanks for pointing out the issue, we will investigate it and see what can be done

[mikhailkoliada]

Shall be fixed with openssl-1.1.1 pining in macOS-13 hosted runner, the fix is now rolled out!