homebrew: urllib3.exceptions.NotOpenSSLWarning

[mkoeppe]

Seen in the CI stage-2 / local-macos (latest, homebrew-macos-usrlocal-standard)

      File "/Users/runner/work/sage/sage/.tox/local-homebrew-macos-usrlocal-standard/local/lib/python3.9/site-packages/urllib3/__init__.py", line 34, in <module>
        warnings.warn(
      File "/Applications/Xcode_14.2.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/warnings.py", line 109, in _showwarnmsg
        sw(msg.message, msg.category, msg.filename, msg.lineno,
    :
    urllib3.exceptions.NotOpenSSLWarning: urllib3 v2.0 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020

(https://github.com/sagemath/sage/actions/runs/7157804484/job/19492023218#step:9:5272)

[jhpalmieri]

That's https://github.com/urllib3/urllib3/issues/3020, I think. Perhaps we should not accept the system Python on OS X. Furthermore if homebrew's Python is available but not the python-setuptools package, we should recommend its installation. (I am working on setting up a new computer, so I did brew install python3, but Sage rejected it because setuptools was not available, and instead it used the system Python. That led to many doctest failures because of the LibreSSL issue.)

[jhpalmieri]

Perhaps we should not accept the system Python on OS X.

Can we refine the ./configure test to see if the ssl implementation is good enough? It seems to currently check whether ssl is available but no more than that. If python3 -c "import ssl; print(ssl.OPENSSL_VERSION)" returns a string starting with "LibreSSL", then we can tell it's bad. Maybe in fact it has to start with "OpenSSL": https://github.com/urllib3/urllib3/blob/main/src/urllib3/util/ssl_.py#L66.