From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.web10.12647.1626103955702910058 for ; Mon, 12 Jul 2021 08:32:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@sakoman-com.20150623.gappssmtp.com header.s=20150623 header.b=19kAmsO5; spf=softfail (domain: sakoman.com, ip: 209.85.215.175, mailfrom: steve@sakoman.com) Received: by mail-pg1-f175.google.com with SMTP id h4so18633057pgp.5 for ; Mon, 12 Jul 2021 08:32:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sakoman-com.20150623.gappssmtp.com; s=20150623; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=1nOZ/bF7ggjhJ+Gh3lyrjHBbFfZzLY9gnTW7k3g86EQ=; b=19kAmsO5Vymj/2khT+OE0jV2BVUXtTON9cvQyzFWNI4IPCREzKcAaK6rctQuHKhv++ /v15oMbbc+4IHWCKyZSJ0CA/Amz4KsMXTkwotsILBNGuH612+AYOF4eq69uUsaS9DXbU pf2n+CSEln0UpJ0OY+An25+k1L621Ouy4Rn3mpWEwMMnXeByWEAgEgLTqKBIWMtfdxvX fU77L0FRJLv4WYRBJXOQ6cbWX+VqMCgEHr8FvJNFTdJph0JDTCcd0n/YBZQmTo/iR7NZ h9l8puRtBvujXG7tcb1ebxQBtnPvkkk3HIwgkQMNgidSqmSX5QdTxB0uRVjqdO0g+sQq A82Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=1nOZ/bF7ggjhJ+Gh3lyrjHBbFfZzLY9gnTW7k3g86EQ=; b=RveQqPCir/Tw9drNOjGhX9Bfw7qYBcQwUx8MvxsqMXfow0ajNZJnuHtCPxQTqWqFbq tBquVNZ/WJahHmpv+woYUyk6iA5nHgk9IGxYpPo8W4OtNrCVMysI6YobN17b5FG9MgxM +N9rNslY0aweHzYvhpY085t1mvKoPVm8dFbTJlpeeDTfTqLnX+YFcIb09E4YKZVjoYJ3 swu6542okk7xLlS9xrlTrZt983SgTJK82cy7NAYU+goTI6G1Zwo9SAAvXpV5FrZG0Sdq Wi0PKepXG1T4zpJBcX88kqWukUWDXvHHPHi0BMnii4GtQAtS2zB7YGsrufr9nYK4jyN+ srGA== X-Gm-Message-State: AOAM533yZN9fZ/eDE/Rxy7rld+M3VR21VqP/446zx/DkvdMrc/AxSk50 JKKhMqdGszEQxp5xx/GohBTRNij+O2fiKsqx X-Google-Smtp-Source: ABdhPJxMBRc/XfKhifyJjUOcDi8Dvyu1J61HT3buMNJ50jT5gG+iTpqbp5ZE7UZP9kfEHi9FKfdXww== X-Received: by 2002:aa7:941b:0:b029:301:ec00:eed9 with SMTP id x27-20020aa7941b0000b0290301ec00eed9mr53599509pfo.44.1626103954671; Mon, 12 Jul 2021 08:32:34 -0700 (PDT) Return-Path: Received: from hexa.router0800d9.com (rrcs-66-91-142-162.west.biz.rr.com. [66.91.142.162]) by smtp.gmail.com with ESMTPSA id n3sm16765942pfn.216.2021.07.12.08.32.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Jul 2021 08:32:34 -0700 (PDT) From: "Steve Sakoman" To: openembedded-core@lists.openembedded.org Subject: [OE-core][dunfell 01/12] python3: upgrade 3.8.10 -> 3.8.11 Date: Mon, 12 Jul 2021 05:31:54 -1000 Message-Id: <1ba51ee2d52ee92bbdede9f2cd2f9ed9ff04ddb6.1626103708.git.steve@sakoman.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Tim Orling Release Date: June 28, 2021 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.11, a security bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Get the latest release of 3.9.x here. Security content in this release contains three fixes. There's also two fixes for 3.8.10 regressions. Take a look at the change log for details. According to the release calendar specified in PEP 569, Python 3.8 is now in security fixes only stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bugfixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers. References: https://docs.python.org/release/3.8.11/whatsnew/changelog.html#python-3-8-11-final Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman --- .../recipes-devtools/python/python3_3.8.11.bb | 362 ++++++++++++++++++ 1 file changed, 362 insertions(+) create mode 100644 meta/recipes-devtools/python/python3_3.8.11.bb diff --git a/meta/recipes-devtools/python/python3_3.8.11.bb b/meta/recipes-devtools/python/python3_3.8.11.bb new file mode 100644 index 0000000000..f549bb2205 --- /dev/null +++ b/meta/recipes-devtools/python/python3_3.8.11.bb @@ -0,0 +1,362 @@ +SUMMARY = "The Python Programming Language" +HOMEPAGE = "http://www.python.org" +DESCRIPTION = "Python is a programming language that lets you work more quickly and integrate your systems more effectively." +LICENSE = "PSF-2.0 & BSD-0-Clause" +SECTION = "devel/python" + +LIC_FILES_CHKSUM = "file://LICENSE;md5=c22d2438294c784731bf9dd224a467b7" + +SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ + file://run-ptest \ + file://create_manifest3.py \ + file://get_module_deps3.py \ + file://python3-manifest.json \ + file://check_build_completeness.py \ + file://cgi_py.patch \ + file://0001-Do-not-add-usr-lib-termcap-to-linker-flags-to-avoid-.patch \ + ${@bb.utils.contains('PACKAGECONFIG', 'tk', '', 'file://avoid_warning_about_tkinter.patch', d)} \ + file://0001-Do-not-use-the-shell-version-of-python-config-that-w.patch \ + file://python-config.patch \ + file://0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch \ + file://0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch \ + file://0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch \ + file://0001-Lib-sysconfig.py-fix-another-place-where-lib-is-hard.patch \ + file://0001-Makefile-fix-Issue36464-parallel-build-race-problem.patch \ + file://0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch \ + file://crosspythonpath.patch \ + file://reformat_sysconfig.py \ + file://0001-Use-FLAG_REF-always-for-interned-strings.patch \ + file://0001-test_locale.py-correct-the-test-output-format.patch \ + file://0017-setup.py-do-not-report-missing-dependencies-for-disa.patch \ + file://0001-setup.py-pass-missing-libraries-to-Extension-for-mul.patch \ + file://0001-Makefile-do-not-compile-.pyc-in-parallel.patch \ + file://0001-configure.ac-fix-LIBPL.patch \ + file://0001-python3-Do-not-hardcode-lib-for-distutils.patch \ + file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \ + " + +SRC_URI_append_class-native = " \ + file://0001-distutils-sysconfig-append-STAGING_LIBDIR-python-sys.patch \ + file://12-distutils-prefix-is-inside-staging-area.patch \ + file://0001-Don-t-search-system-for-headers-libraries.patch \ + " + +SRC_URI[md5sum] = "5840ba601128f48fee4e7c98fbdac65d" +SRC_URI[sha256sum] = "fb1a1114ebfe9e97199603c6083e20b236a0e007a2c51f29283ffb50c1420fb2" + +# exclude pre-releases for both python 2.x and 3.x +UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" + +CVE_PRODUCT = "python" + +# Upstream consider this expected behaviour +CVE_CHECK_WHITELIST += "CVE-2007-4559" +# This is not exploitable when glibc has CVE-2016-10739 fixed. +CVE_CHECK_WHITELIST += "CVE-2019-18348" + +# This is windows only issue. +CVE_CHECK_WHITELIST += "CVE-2020-15523" + +PYTHON_MAJMIN = "3.8" + +S = "${WORKDIR}/Python-${PV}" + +BBCLASSEXTEND = "native nativesdk" + +inherit autotools pkgconfig qemu ptest multilib_header update-alternatives + +MULTILIB_SUFFIX = "${@d.getVar('base_libdir',1).split('/')[-1]}" + +ALTERNATIVE_${PN}-dev = "python3-config" +ALTERNATIVE_LINK_NAME[python3-config] = "${bindir}/python${PYTHON_MAJMIN}-config" +ALTERNATIVE_TARGET[python3-config] = "${bindir}/python${PYTHON_MAJMIN}-config-${MULTILIB_SUFFIX}" + + +DEPENDS = "bzip2-replacement-native libffi bzip2 openssl sqlite3 zlib virtual/libintl xz virtual/crypt util-linux libtirpc libnsl2 autoconf-archive" +DEPENDS_append_class-target = " python3-native" +DEPENDS_append_class-nativesdk = " python3-native" + +EXTRA_OECONF = " --without-ensurepip --enable-shared" +EXTRA_OECONF_append_class-native = " --bindir=${bindir}/${PN}" + +export CROSSPYTHONPATH="${STAGING_LIBDIR_NATIVE}/python${PYTHON_MAJMIN}/lib-dynload/" + +EXTRANATIVEPATH += "python3-native" + +CACHED_CONFIGUREVARS = " \ + ac_cv_file__dev_ptmx=yes \ + ac_cv_file__dev_ptc=no \ + ac_cv_working_tzset=yes \ +" +python() { + # PGO currently causes builds to not be reproducible, so disable it for + # now. See YOCTO #13407 + if bb.utils.contains('MACHINE_FEATURES', 'qemu-usermode', True, False, d) and d.getVar('BUILD_REPRODUCIBLE_BINARIES') != '1': + d.setVar('PACKAGECONFIG_PGO', 'pgo') + else: + d.setVar('PACKAGECONFIG_PGO', '') +} + +PACKAGECONFIG_class-target ??= "readline ${PACKAGECONFIG_PGO} gdbm" +PACKAGECONFIG_class-native ??= "readline gdbm" +PACKAGECONFIG_class-nativesdk ??= "readline gdbm" +PACKAGECONFIG[readline] = ",,readline" +# Use profile guided optimisation by running PyBench inside qemu-user +PACKAGECONFIG[pgo] = "--enable-optimizations,,qemu-native" +PACKAGECONFIG[tk] = ",,tk" +PACKAGECONFIG[gdbm] = ",,gdbm" + +do_configure_prepend () { + mkdir -p ${B}/Modules + cat > ${B}/Modules/Setup.local << EOF +*disabled* +${@bb.utils.contains('PACKAGECONFIG', 'gdbm', '', '_gdbm _dbm', d)} +${@bb.utils.contains('PACKAGECONFIG', 'readline', '', 'readline', d)} +EOF +} + +CPPFLAGS_append = " -I${STAGING_INCDIR}/ncursesw -I${STAGING_INCDIR}/uuid" + +EXTRA_OEMAKE = '\ + STAGING_LIBDIR=${STAGING_LIBDIR} \ + STAGING_INCDIR=${STAGING_INCDIR} \ + LIB=${baselib} \ +' + +do_compile_prepend_class-target() { + if ${@bb.utils.contains('PACKAGECONFIG', 'pgo', 'true', 'false', d)}; then + qemu_binary="${@qemu_wrapper_cmdline(d, '${STAGING_DIR_TARGET}', ['${B}', '${STAGING_DIR_TARGET}/${base_libdir}'])}" + cat >pgo-wrapper <