Newest version cause DeprecationWarning: 'urllib3.contrib.pyopenssl' module is deprecated

Describe the bug

Fresh installation cause warning:

DeprecationWarning: 'urllib3.contrib.pyopenssl' module is deprecated and will be removed in a future release of urllib3 2.x. Read more in this issue: https://github.com/urllib3/urllib3/issues/2680

That warning somehow cause, that pytest does not start tests.

Expected Behavior

import of botocore should not issue that warning

Current Behavior

DeprecationWarning is issued

Reproduction Steps

after fresh installation:

(sf-new) [1]17:00:19:~/workspace/$ python -m botocore.httpsession
/home/darek/workspace/sf-new/lib/python3.10/site-packages/botocore/httpsession.py:41: DeprecationWarning: 'urllib3.contrib.pyopenssl' module is deprecated and will be removed in a future release of urllib3 2.x. Read more in this issue: https://github.com/urllib3/urllib3/issues/2680
  from urllib3.contrib.pyopenssl import orig_util_SSLContext as SSLContext

Possible Solution

avoid import of urllib3.contrib.pyopenssl, for more see: https://github.com/urllib3/urllib3/issues/2680

Additional Information/Context

Workaround: enforcing version urllib3==1.26.9 solve that issue

SDK version used

Python 3.10.4 botocore 1.27.56

Environment details (OS name and version, etc.)

Linux darek-dell 5.4.0-122-generic #138-Ubuntu SMP Wed Jun 22 15:00:31 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

[nateprewitt]

Hi @ddzialak,

Botocore doesn’t use pyopenssl, we have intentionally patched it to always use the standard library version of SSLContext. There’s a lingering import from the pyopenssl module for backwards compatibility which appears to be triggering the warning.

If we were impacted we’re already pinned to urllib3<1.27 but this deprecation won’t take effect until urllib3==2.0. We’ll take a look at getting the warning suppressed, thanks for letting us know!

[nateprewitt]

Why is this lingering import kept at all?

Apologies if my last comment was unclear. This import is specifically to not use pyopenssl and avoid its import if present. We are working around a behavior of older versions of requests/urllib3, botocore has never used pyopenssl.

A simplified example of how this happens in production systems:

$ python -m pip install requests==2.22.0
$ python -m pip install pyopenssl
$ python
>>> import requests
>>> import urllib3
>>> urllib3.util.ssl_.SSLContext
<class 'urllib3.contrib.pyopenssl.PyOpenSSLContext'>

urllib3 patches the value of SSLContext when inject_into_urllib3 is called to use PyOpenSSL if present. This has been fixed in newer versions of requests/urllib3, but not everyone has upgraded. Until urllib3 2.0 is the minimum supported version, this needs to stay in place, otherwise we will be increasing the usage of PyOpenSSL. That’s not an acceptable security regression for botocore.

Also, since when suppressing a deprecation warning fixes anything?

From the urllib3 team’s perspective, we actively test botocore in the urllib3 test suite itself. This is a known import that is safe behavior, so the warning doesn’t apply. Suppressing it is the best option to avoid misleading noise. The code already handles the upcoming removal gracefully.