I've been digging into: https://github.com/pantsbuild/pants/issues/20467 And it looks like the change was introduced when the PBS build moved to libssl 3.x.x I think the easiest fix is what John suggested, and just stick a

ssl.create_default_context()

somewhere at the top of

fetcher.py

But I'm wary because it's a somewhat esoteric error, caused by threading, and the SSL documentation is kinda ambiguous on what you're meant to do: > An SSL_CTX object should not be changed after it is used to create any SSL objects or from multiple threads concurrently, since the implementation does not provide serialization of access for these cases.