Skip to content

Use TLS 1.2 in Windows builds - #228

Merged
tianon merged 1 commit into
docker-library:masterfrom
StefanScherer:use-tls12-on-windows
Oct 9, 2017
Merged

Use TLS 1.2 in Windows builds#228
tianon merged 1 commit into
docker-library:masterfrom
StefanScherer:use-tls12-on-windows

Conversation

@StefanScherer

Copy link
Copy Markdown
Contributor

I tried to build Python with the microsoft/windowsservercore-insider build and found out that installing PIP aborted with "The request was aborted: Could not create SSL/TLS secure channel." It seems that https://bootstrap.pypa.io enforces TLS 1.2 only.

PowerShell still does not use TLS 1.2 by default, so here's a fix for all Windows Dockerfiles to do so.

Step 7/8 : RUN Write-Host ('Installing pip=={0} ...' -f $env:PYTHON_PIP_VERSION); 	(New-Object System.Net.WebClient).DownloadFile('https://bootstrap.pypa.io/get-pip.py', 'get-pip.py'); 	python get-pip.py 		--disable-pip-version-check 		--no-cache-dir 		('pip=={0}' -f $env:PYTHON_PIP_VERSION) 	; 	Remove-Item get-pip.py -Force; 		Write-Host 'Verifying pip install ...'; 	pip --version; 		Write-Host 'Complete.';
 ---> Running in f1d24a39e5bd
Installing pip==9.0.1 ...
Exception calling "DownloadFile" with "2" argument(s): "The request was 
aborted: Could not create SSL/TLS secure channel."
At line:1 char:101
+ ... P_VERSION); (New-Object System.Net.WebClient).DownloadFile('https://b ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], ParentContainsErrorRecordE 
   xception
    + FullyQualifiedErrorId : WebException
 
The command 'powershell -Command $ErrorActionPreference = 'Stop'; Write-Host ('Installing pip=={0} ...' -f $env:PYTHON_PIP_VERSION); 	(New-Object System.Net.WebClient).DownloadFile('https://bootstrap.pypa.io/get-pip.py', 'get-pip.py'); 	python get-pip.py 		--disable-pip-version-check 		--no-cache-dir 		('pip=={0}' -f $env:PYTHON_PIP_VERSION) 	; 	Remove-Item get-pip.py -Force; 		Write-Host 'Verifying pip install ...'; 	pip --version; 		Write-Host 'Complete.';' returned a non-zero code: 1

@StefanScherer

StefanScherer commented Oct 8, 2017

Copy link
Copy Markdown
Contributor Author

AppVeyor is green, previous build showed the same error https://ci.appveyor.com/project/docker-library/python/build/build-74.master
Travis build error on stretch seems unrelated.

@tianon

tianon commented Oct 9, 2017

Copy link
Copy Markdown
Member

Arg, I was wondering why that build had started failing, but hadn't had a chance to look into it yet. ❤️

Would this also be fixable by switching to Invoke-WebRequest like we've switched to using elsewhere? (instead of instrumenting the .NET bits directly)

(ala https://github.com/docker-library/golang/blob/1116b4262228428be20d7e9413ad277c716adb16/Dockerfile-windows-nanoserver.template#L23)

@StefanScherer

Copy link
Copy Markdown
Contributor Author

No, even after changing to Invoke-WebRequest I had to add the security protocol to switch to TLS 1.2. This is really a quite weird default in current PowerShell.

@tianon

tianon commented Oct 9, 2017

Copy link
Copy Markdown
Member

That's kind of bizarre -- is there an appropriate place for us to file an issue about it?

@StefanScherer

Copy link
Copy Markdown
Contributor Author

Probably https://github.com/PowerShell/PowerShell is a good place.
I'll update to Invoke-WebRequest, looks better :-)

@tianon
tianon merged commit c46e67a into docker-library:master Oct 9, 2017
tianon added a commit to infosiftr/stackbrew that referenced this pull request Oct 9, 2017
- `mariadb`: 10.3.2
- `python`: fix Windows builds (docker-library/python#228)
@StefanScherer
StefanScherer deleted the use-tls12-on-windows branch October 10, 2017 04:31
tao12345666333 pushed a commit to tao12345666333/python that referenced this pull request Jun 28, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants