linux/poky.git/meta/recipes-devtools/python/python3, branch walnascar

python3: fix CVE-2025-8194

2025-08-13T15:42:58+00:00

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8194 Upstream-patch: https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe (From OE-Core rev: c0f1143ca3f189fc6346a445a381829aed78aae8) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

python3: upgrade 3.13.3 -> 3.13.4

2025-06-13T16:01:26+00:00

Refresh patches. * https://www.python.org/downloads/release/python-3134/ Security content in this release * gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330] [CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. * gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler. * gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. gh-133767 got meawhile CVE-2025-4516 assigned. (From OE-Core rev: 55a9cd748531c75d46f5d6d53af692a38c6b6716) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: upgrade 3.13.2 -> 3.13.3

2025-06-13T16:01:26+00:00

This adds some security fixes and many new changes to the library. Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-13-3-final Modify 0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch to remove 'test_types' from the pgo-wrapper call, since that fails now under qemu. Reproducibility looks OK. ptest results OK: |== Tests result: SUCCESS == | |29 tests skipped: | test.test_asyncio.test_windows_events | test.test_asyncio.test_windows_utils test.test_gdb.test_backtrace | test.test_gdb.test_cfunction test.test_gdb.test_cfunction_full | test.test_gdb.test_misc test.test_gdb.test_pretty_print | test_android test_apple test_asdl_parser test_clinic test_devpoll | test_free_threading test_generated_cases test_idle test_ioctl | test_kqueue test_launcher test_msvcrt test_startfile test_tcl | test_tkinter test_ttk test_ttk_textonly test_turtle test_winapi | test_winconsoleio test_winreg test_wmi | |9 tests skipped (resource denied): | test_curses test_peg_generator test_pyrepl test_smtpnet | test_socketserver test_urllib2net test_urllibnet test_winsound | test_zipfile64 | |442 tests OK. | |Total duration: 2 min 48 sec |Total tests: run=43,896 skipped=2,268 |Total test files: run=471/480 skipped=29 resource_denied=9 |Result: SUCCESS |DURATION: 169 |END: /usr/lib/python3/ptest |2025-05-12T12:34 |STOP: ptest-runner |TOTAL: 1 FAIL: 0 |root@qemux86-64:~# (From OE-Core rev: 063d5a5fb2f71b523f378b95167553b28804c3ad) (From OE-Core rev: 6587dc1fc62de79c4599761af59ebd385244cb57) Signed-off-by: Trevor Gamblin Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: backport the full fix for importlib scanning invalid distributions

2025-06-13T16:01:26+00:00

Even with our fixes in deterministic_imports.patch the importlib.metadata package scan was still returning Distribution objects for empty directories. This interacts badly with rebuilds when recipes are changing as when a recipe is removed from the sysroot directories are not removed[1]. In particular this breaks python3-meson-python-native rebuilds when Meson upgrades from 1.7 to 1.8: the site-packages directory has an empty meson-1.7.dist-info/ and populated meson-1.8.dist-info/. Whilst it's deterministic to return the empty 1.7 first, this breaks pypa/build as it looks through the distributions in order. We had discussed this with upstream previously and there's a more comprehensive fix upstream (actually in importlib_metadata, not cpython) which ensures that valid distribution objects are listed first. So we can drop our patch and replace it with a backport to fix these rebuilds. [1] oe-core 4f94d929639 ("sstate/staging: Handle directory creation race issue") (From OE-Core rev: 73de8daa6293403f5b92d313af32882c47bce396) (From OE-Core rev: 1c1b651038e15445c495d87c38beeb92f00d9919) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

python3: Skip test_write_read_append

2025-02-20T11:57:49+00:00

We use editline by default and test_write_read_append also fails especially on musl since this needs to be fixed upstream, extend the skip for test_write_read_append along with other history manipulation tests being skipped. (From OE-Core rev: fbafd942e6c78d1298fa64129149ff311b61fcf8) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

python3: upgrade 3.13.1 -> 3.13.2

2025-02-11T11:44:19+00:00

Release notes: https://docs.python.org/release/3.13.2/whatsnew/changelog.html#python-3-13-2 Solves CVE-2025-0938, CVE-2024-12254 and 3 other vulnerabilities without CVE number assigment. Remove patch which is included in new release. (From OE-Core rev: 4b91478d47db319af847a45b7d57bb7223da55f8) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

python3: Fix typo in create_manifest3.py

2025-02-05T13:00:45+00:00

Fixed a misspelled "posible" to "possible". (From OE-Core rev: 7e2d743e4809d6cbaa8e441dc42624eb65daad63) Signed-off-by: Omri Sarig Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

python3: Fix typo in python3-manifest.json

2025-02-05T13:00:45+00:00

Fix a wrong "the" to be the intended "that". (From OE-Core rev: fe55f05a7068ba7b277a253058fdcc8964222bc1) Signed-off-by: Omri Sarig Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

python3: Update stringold summary

2025-01-29T13:15:31+00:00

The string package in python currently contains common string operations. This package is still in full use. However, the old summary line of the package marked it as deprecated. As this is not the case, this commit updates the summary line to better represent this Python package. The new summary line was taken from Python's documentation for the package (https://docs.python.org/3.13/library/string.html). In the past, the string library used to contain functionality that later was moved to the str object in Python. The assumption is that during this change, this library was marked as deprecated here. However, as this package contains more functionality, which is still relevant and used by python, the package itself should not be marked as deprecated. This commit changes the description of the package, but does not change the name of the package. The proper name for this package should be "string" (instead of "stringold"). However, changing the package's name will break compatibility with anyone using the string package in their project. As this is a big change, it is decided not to be done yet. The change in description, as well as this commit message, should be enough to let users understand that the string package in python is still valid, and should not be treated as deprecated. (From OE-Core rev: 7602a9013d6c61959ec293ee29285c90257b5fbb) Signed-off-by: Omri Sarig Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

python3: upgrade 3.13.0 -> 3.13.1

2025-01-03T11:05:03+00:00

Changelog: https://docs.python.org/3/whatsnew/changelog.html#python-3-13-1-final - Patch 'fix-armv5.patch' is in 3.13.1, so no longer needed: |tgamblin@megalith ~/workspace/git/pythonsrc/cpython ((HEAD detached from v3.13.1))$ git tag --contains 18b9079ddbc149d6b99c922630c246812e4d8ae7 |v3.13.1 - While patch 'crosspythonpath.patch' is listed as 'Inappropriate [OE-Core integration specific]' specific in the commit message, it is now breaking the build, while removing it allows python3 to build OK. It appears that there is a similar change in upstream 3.13.1: https://github.com/python/cpython/commit/909d5ac2959e - gcc-symlinks had to be added to ptest RDEPENDS so that 'gcc' could be found on the path for the test_ctypes.test_dlerror.TestNullDlsym.test_null_dlsym test. - Also reformat the DEPENDS and RDEPENDS lists to be alphabetical and one-per-line, since that's easier to read and modify. - buildall-qemu output: |BUILDALL-QEMU LOG FOR python3 |START TIME: 2024-12-18_20:38:01 |HOSTNAME: megalith |HOST OS: Debian GNU/Linux 12 (bookworm) |HOST KERNEL: 6.1.0-28-amd64 |=============== |BUILD RESULTS: |[glibc] |FAIL: qemuloongarch64 |PASS: qemuriscv32 |PASS: qemuarmv5 |PASS: qemuppc |PASS: qemumips64 |PASS: qemuriscv64 |PASS: qemuarm64 |PASS: qemuarm |PASS: qemux86-64 |PASS: qemuppc64 |PASS: qemux86 |PASS: qemumips |[musl] |FAIL: qemuloongarch64 |FAIL: qemuriscv32 |PASS: qemuarmv5 |PASS: qemuppc |PASS: qemumips64 |PASS: qemuriscv64 |PASS: qemuarm64 |PASS: qemuarm |PASS: qemux86-64 |PASS: qemuppc64 |PASS: qemux86 |PASS: qemumips |=============== |PASSED: 21 |FAILED: 3 (From OE-Core rev: 08c44d3b140b220ead6334db26097b28612d445a) Signed-off-by: Trevor Gamblin Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie