Delay import of ssl in pex.fetcher.

CHANGES.md

@@ -1,5 +1,14 @@
 # Release Notes
 
+## 2.3.2
+
+This release fixes a regression for users of gevent monkey patching. The
+fix in #2356 released in Pex 2.1.163 lead to these users receiving
+spurious warnings from the gevent monkey patch system about ssl being
+patched too late.
+
+* Delay import of ssl in `pex.fetcher`. (#2417)
+
 ## 2.3.1
 
 This release fixes Pex to respect lock file interpreter constraints and

pex/fetcher.py

@@ -5,12 +5,10 @@
 
 import contextlib
 import os
-import ssl
 import sys
 import threading
 import time
 from contextlib import closing, contextmanager
-from ssl import SSLContext
 
 from pex import asserts
 from pex.auth import PasswordDatabase, PasswordEntry
@@ -31,6 +29,7 @@
 from pex.version import __version__
 
 if TYPE_CHECKING:
+    from ssl import SSLContext
     from typing import BinaryIO, Dict, Iterable, Iterator, Mapping, Optional, Text
 
     import attr  # vendor:skip
@@ -112,6 +111,13 @@ def create_ssl_context(self):
             ),
         )
         with guard_stdout():
+            # We import ssl lazily as an affordance to PEXes that use gevent SSL monkeypatching,
+            # which requires (and checks) that the `ssl` module is not imported priory to the
+            # `from gevent import monkey; monkey.patch_all()` call.
+            #
+            # See: https://github.com/pex-tool/pex/issues/2415
+            import ssl
+
             ssl_context = ssl.create_default_context(cafile=self.cert)
             if self.client_cert:
                 ssl_context.load_cert_chain(self.client_cert)

pex/version.py

@@ -1,4 +1,4 @@
 # Copyright 2015 Pex project contributors.
 # Licensed under the Apache License, Version 2.0 (see LICENSE).
 
-__version__ = "2.3.1"
+__version__ = "2.3.2"