Finalize TLS1.0/1.1 removal on PyPI

[alex]

We've been conducting a series of brownouts to make sure people are aware of the need to make sure their clients are up to date. This issue is to track the current schedule of updates to the brownout window (which may change as time goes on):

• March 22nd, brownouts begin :00-:10 every hour
• March 25th, :00-:15 every hour
• March 28th, :00-:15, :30-:35 every hour
• March 31st, :00-:15, :30-:40 every hour
• April 3rd, :00-:15, :30-:45 every hour
• April 6th, :00-:20, :30-:50 every hour
• April 8th, TLS 1.0/1.1 disabled
• April 10th, TLS1.0/1.1 disabled at fastly handshake

[dstufft]

Just bumped the brownout to the first 15 minutes.

[jvanasco]

FYI, I got locked out for well over an hour with a pip 9.0.1 client (no proxy, traffic from NYC).

Would it be possible to provide a (temporary) whitelisted migration package to assist in upgrades, like offering pip by a name like 'pip-brownout' during this time?

It's a bit of a pain distributing and installing a downloaded .tgz of pip onto Test and CI servers (multiple virtualenvs and the system version need to be installed).

Also as a suggestion: it would make sense to scatter the brownout window as some automated systems might not try to call pip/etc until the 2nd half of the hour.

[alex]

@jvanasco for issues with the brownout, please file bugs on https://github.com/pypa/packaging-problems/issues. This bug is just for tracking the ops side of it.

[jvanasco]

@alex will do. you may want to change the message on https://status.python.org/incidents/629scscfypvt , which is hotlinked from pipi, that redirects here.

[dstufft]

I think Ernest was doing more load testing earlier, which also has the effect of mandating TLSv1.2

…

Sent from my iPhone

On Mar 25, 2018, at 6:15 PM, Jonathan Vanasco ***@***.***> wrote: @alex will do. you may want to change the message on https://status.python.org/incidents/629scscfypvt , which is hotlinked from pipi, that redirects here. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[brainwane]

Sometime between now and April 8th, could we have a few days where the brownout starts at the half-hour or includes the half-hour? I'm thinking about India, where (I presume) some substantial chunk of our traffic originates, and where timezones are a half-hour off from most other timezones.

[alex]

The next milestone will be 20 minutes outage per hour, maybe we should do :00-:10 and :30-:40?

[dstufft]

We can do that, it's pretty easy.

[pradyunsg]

Maybe OP can be updated -- to mention the :00-:10 and :30-:40 plan?

[alex]

I've updated. @dstufft of note, I switched from :00-:10 + :30-:40 to :00-:15 + :30-:35, which is the same number of minutes of brownout, but avoids any "regressions" in coverage.

[brainwane]

@alex just to be clear, since you added this to the launch/redirect milestone -- you believe that completing this is a blocker to the redirect? (So, even if we finish all the other Warehouse features/infra in that milestone before April 8th, we should wait for this?) I'm fine with it if that's your assessment, but I just want to check.

[alex]

Redirecting to warehouse for downloads has the effect of requiring TLS1.2 so we can't cut over unitl we're ready to drop 1.0/1.1.

…

On Wed, Mar 28, 2018, 8:56 AM Sumana Harihareswara ***@***.***> wrote: @alex <https://github.com/alex> just to be clear, since you added this to the launch/redirect milestone <https://github.com/pypa/warehouse/milestone/1> -- you believe that completing this is a blocker to the redirect? (So, even if we finish all the other Warehouse features/infra in that milestone before April 8th, we should wait for this?) I'm fine with it if that's your assessment, but I just want to check. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3411 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAADBMMpAiJZ7Iz2g1wwk9Iv_nbapq6tks5ti4h_gaJpZM4S6IvR> .

[dstufft]

Brownout updated for :00-:15, :30-:35 every hour