From fed40e731b013510ec2bf49d4af37950c1d45d5f Mon Sep 17 00:00:00 2001
From: Filipe Rosset <rosset.filipe@gmail.com>
Date: Mon, 27 Jul 2026 16:23:08 -0300
Subject: [PATCH] Deal with ssl.PROTOCOL_TLSv1 removal from Python built with
 OpenSSL 4+

OpenSSL 4+ removed TLSv1 and TLSv1.1 support, this patched address this
issue in rawhide, note the upstream already received another patch:

https://github.com/urllib3/urllib3/pull/5097

Resolves: rhbz#2504593

Signed-off-by: Filipe Rosset <rosset.filipe@gmail.com>
---
 python-urllib3-py315-ssl.patch | 67 ++++++++++++++++++++++++++++++++++
 python-urllib3.spec            |  6 ++-
 2 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 python-urllib3-py315-ssl.patch

diff --git a/python-urllib3-py315-ssl.patch b/python-urllib3-py315-ssl.patch
new file mode 100644
index 0000000..ec0d1fb
--- /dev/null
+++ b/python-urllib3-py315-ssl.patch
@@ -0,0 +1,67 @@
+--- a/src/urllib3/contrib/pyopenssl.py
++++ b/src/urllib3/contrib/pyopenssl.py
+@@ -69,9 +69,11 @@
+ _openssl_versions: dict[int, int] = {
+     util.ssl_.PROTOCOL_TLS: OpenSSL.SSL.SSLv23_METHOD,  # type: ignore[attr-defined]
+     util.ssl_.PROTOCOL_TLS_CLIENT: OpenSSL.SSL.SSLv23_METHOD,  # type: ignore[attr-defined]
+-    ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,
+ }
+ 
++if hasattr(ssl, "PROTOCOL_TLSv1") and hasattr(OpenSSL.SSL, "TLSv1_METHOD"):
++    _openssl_versions[ssl.PROTOCOL_TLSv1] = OpenSSL.SSL.TLSv1_METHOD
++
+ if hasattr(ssl, "PROTOCOL_TLSv1_1") and hasattr(OpenSSL.SSL, "TLSv1_1_METHOD"):
+     _openssl_versions[ssl.PROTOCOL_TLSv1_1] = OpenSSL.SSL.TLSv1_1_METHOD
+ 
+--- a/test/test_ssl.py
++++ b/test/test_ssl.py
+@@ -173,15 +173,15 @@
+         "kwargs",
+         [
+             {
+-                "ssl_version": ssl.PROTOCOL_TLSv1,
++                "ssl_version": getattr(ssl, "PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1_2", 1)),
+                 "ssl_minimum_version": ssl.TLSVersion.MINIMUM_SUPPORTED,
+             },
+             {
+-                "ssl_version": ssl.PROTOCOL_TLSv1,
++                "ssl_version": getattr(ssl, "PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1_2", 1)),
+                 "ssl_maximum_version": ssl.TLSVersion.TLSv1,
+             },
+             {
+-                "ssl_version": ssl.PROTOCOL_TLSv1,
++                "ssl_version": getattr(ssl, "PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1_2", 1)),
+                 "ssl_minimum_version": ssl.TLSVersion.MINIMUM_SUPPORTED,
+                 "ssl_maximum_version": ssl.TLSVersion.MAXIMUM_SUPPORTED,
+             },
+@@ -222,10 +222,10 @@
+     @pytest.mark.parametrize(
+         "kwargs",
+         [
+-            {"ssl_version": ssl.PROTOCOL_TLSv1, "ssl_minimum_version": None},
+-            {"ssl_version": ssl.PROTOCOL_TLSv1, "ssl_maximum_version": None},
++            {"ssl_version": getattr(ssl, "PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1_2", 1)), "ssl_minimum_version": None},
++            {"ssl_version": getattr(ssl, "PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1_2", 1)), "ssl_maximum_version": None},
+             {
+-                "ssl_version": ssl.PROTOCOL_TLSv1,
++                "ssl_version": getattr(ssl, "PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1_2", 1)),
+                 "ssl_minimum_version": None,
+                 "ssl_maximum_version": None,
+             },
+--- a/test/test_util.py
++++ b/test/test_util.py
+@@ -982,9 +982,11 @@
+     @pytest.mark.parametrize(
+         "candidate, version",
+         [
+-            (ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1),
+-            ("PROTOCOL_TLSv1", ssl.PROTOCOL_TLSv1),
+-            ("TLSv1", ssl.PROTOCOL_TLSv1),
++            *([
++                (getattr(ssl, "PROTOCOL_TLSv1", None), getattr(ssl, "PROTOCOL_TLSv1", None)),
++                ("PROTOCOL_TLSv1", getattr(ssl, "PROTOCOL_TLSv1", None)),
++                ("TLSv1", getattr(ssl, "PROTOCOL_TLSv1", None)),
++            ] if hasattr(ssl, "PROTOCOL_TLSv1") else []),
+             (ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23),
+         ],
+     )
diff --git a/python-urllib3.spec b/python-urllib3.spec
index b2854a7..b4683e8 100644
--- a/python-urllib3.spec
+++ b/python-urllib3.spec
@@ -31,6 +31,10 @@ Source0:        %{url}/archive/%{version}/urllib3-%{version}.tar.gz
 %global hypercorn_commit d1719f8c1570cbd8e6a3719ffdb14a4d72880abb
 Source1:        %{hypercorn_url}/archive/%{hypercorn_commit}/hypercorn-%{hypercorn_commit}.tar.gz
 
+# Deal with ssl.PROTOCOL_TLSv1 removal from Python built with OpenSSL 4+
+# https://github.com/urllib3/urllib3/pull/5097
+Patch:          python-urllib3-py315-ssl.patch
+
 BuildArch:      noarch
 
 BuildRequires:  python3-devel
@@ -82,7 +86,7 @@ Recommends:     python3-urllib3+socks
 
 
 %prep
-%autosetup -n urllib3-%{version}
+%autosetup -p1 -n urllib3-%{version}
 %setup -q -n urllib3-%{version} -T -D -b 1
 
 # Allow setuptools-scm 10+