bug#54096: 27.2; Error retrieving package descriptions when TLS 1.3 is used (macOS)

[Sebastian Boehm]

After upgrading Emacs from 27.1 to 27.2 on my macOS system, I've run into a 
problem with refreshing my package descriptions when TLS 1.3 is enabled.

When I try to upgrade my package descriptions from the package list, the 
following error message appears in the minibuffer:

error in process sentinel: Error retrieving: https://elpa.gnu.org/packages/archive-contents (error 
connection-failed "connect" :host "elpa.gnu.org" :service 443)

The problem goes away if I disable TLS 1.3 by setting gnutls-algorithm-priority:

(setq gnutls-algorithm-priority "NORMAL:-VERS-TLS1.3")

Could this be related to #34341? While #34341 was fixed in Emacs 26.3, the 
symptoms and workaround are the same.

Steps to reproduce:

1. Add a second archive to the package archive list, display package list, 
refresh packages.

(setq package-archives
     '(("gnu"   . "https://elpa.gnu.org/packages/";)
       ("melpa" . "https://melpa.org/packages/";)))
(list-packages)
(package-refresh-contents)

2. Wait for a couple of seconds for the error message to appear.

Additional information:

- I cannot reproduce the problem reliably without following all of the steps 
above.
- I am using packages downloaded from emacsformacosx.com. The problem can be reproduced 
by installing Emacs via Homebrew as well via "brew install homebrew/cask/emacs".
- I am not experiencing any intermittent network failures.
- I can reproduce the problem as a different user with an empty .emacs.d and with 
"emacs -Q".
- The package lists are displayed correctly when using ewww to visit the pages 
mentioned above.
- Only Emacs 27.2 seems to be affected. I cannot reproduce the problem with 
Emacs 26.3, Emacs 27.1 or Emacs 28.0.90.
- Affected version: GNU Emacs 27.2 (build 1, x86_64-apple-darwin18.7.0, NS 
appkit-1671.60 Version 10.14.6 (Build 18G95))
- macOS version: 12.2.1
- Other people seem to be affected by the same issue as well: 
https://clojurians-log.clojureverse.org/emacs/2021-09-03

If I enable toggle-debug-on-error, I get the backtrace below:

Debugger entered--Lisp error: (error "Error retrieving: https://elpa.gnu.org/packages/archive-contents 
(error connection-failed \"connect\" :host \"elpa.gnu.org\" :service 443)")
 signal(error ("Error retrieving: https://elpa.gnu.org/packages/archive-contents (error 
connection-failed \"connect\" :host \"elpa.gnu.org\" :service 443)"))
 #f(compiled-function (status) #<bytecode 0x1ff8e7c2ba21>)((:error (error connection-failed 
"connect" :host "elpa.gnu.org" :service 443)))
 apply(#f(compiled-function (status) #<bytecode 0x1ff8e7c2ba21>) (:error (error connection-failed 
"connect" :host "elpa.gnu.org" :service 443)))
 url-http-activate-callback()
 url-http-async-sentinel(#<process elpa.gnu.org> "connect")

As far as I can tell, the debug messages emitted by GnuTLS when 
gnutls-log-level is set to 1 or 2 are unremarkable, but if there's anything 
specific that I should look out for, just let me know.

Is there anything I can do to help debug this issue?

Best,
Sebastian