CentOS 7 tests fail due to not being able to access PyPI anymore (SSL failure) about ansible HOT 7 CLOSED

Files identified in the description:

None

If these files are incorrect, please update the component name section of the description or use the component bot command.

from ansible.

I guess either there's a way to work around this from ansible-test's side, or it's dropping CentOS 7 from CI matrixes...

from ansible.

@felixfontein I'm looking into this. Do you happen to know what changed on PyPI to cause the SSL validation issue?

from ansible.

No idea, my guess is that they got issued a new certificate whose root is no longer in root store that comes with the Python on CentOS 7.

In fact I think I see the problem: pypi.python.org is simply a redirect to pypi.org. The latter's certificate is likely OK, but the former is using a Let's Encrypt certificate that got issued today. It uses the IRSG X1 root which was only added to cert root stores in 2016, and is probably not included in CentOS 7's root store. (https://www.ssllabs.com/ssltest/analyze.html?d=pypi.python.org&s=2a04%3a4e42%3a5000%3a0%3a0%3a0%3a0%3a223&hideResults=on&latest)

So I guess there are two possible solutions:

1. Add the IRSG root manually.
2. Tell pip to use https://pypi.org/ directly instead of https://pypi.python.org/

I guess (or better: would hope that!) the second option is the easiest to implement.

from ansible.

@felixfontein I opened #83226 to address this without updating the container.

from ansible.

@mattclay setting PIP_INDEX_URL to https://pypi.org/simple might also work. But the proxy should work as well.

from ansible.

The PR and both backports have been merged, closing.

from ansible.