linux/poky.git/meta/recipes-devtools/python/python3, branch yocto-3.1.23

python3: fix packaging of Windows distutils installer stubs

2023-02-13T07:44:09+00:00

The python3 Windows distutils installer stubs were split into a separate package in poky commit dc1ab6482cfb30c714e7cbb421920943439a3fd6. This has regressed during the upgrade to Python 3.8.2 in yocto-3.1 [YOCTO #13889] https://bugzilla.yoctoproject.org/show_bug.cgi?id=13889 (From OE-Core rev: 4f069121ddb99bb6e2f186724cd60ca07f74f503) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2022-37454

2022-12-23T23:05:44+00:00

Add below patch to fix CVE-2022-37454 CVE-2022-37454.patch Link: https://security-tracker.debian.org/tracker/CVE-2022-37454 Link: https://github.com/python/cpython/commit/948c6794711458fd148a3fa62296cadeeb2ed631 (From OE-Core rev: 6a8ef6cc3604008860dcb6aa5d7155b914d7c391) Signed-off-by: Pawan Badganchi Signed-off-by: pawan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.13 -> 3.8.14

2022-10-27T15:54:43+00:00

Security and bug fixes. * Drop CVE-2021-28861.patch as it was merged in 3.8.14 release. Fixes: * CVE-2020-10735 https://nvd.nist.gov/vuln/detail/CVE-2020-10735 * CVE-2021-28861 https://nvd.nist.gov/vuln/detail/CVE-2021-28861 * CVE-2018-25032 https://nvd.nist.gov/vuln/detail/CVE-2018-25032 Python 3.8.14 Release Date: Sept. 6, 2022 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.14, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Security content in this release CVE-2020-10735: converting between int and str in bases other than 2 (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. gh-87389: http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. gh-93065: Fix contextvars HAMT implementation to handle iteration over deep trees to avoid a potential crash of the interpreter. gh-90355: Fix ensurepip environment isolation for the subprocess running pip. gh-80254: Raise ProgrammingError instead of segfaulting on recursive usage of cursors in sqlite3 converters. (From OE-Core rev: 25fafd35a4698daa0d4abb814a91601e68223128) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Fix CVE-2021-28861 for python3

2022-09-16T16:53:28+00:00

Add patch to fix CVE-2021-28861 CVE-2021-28861.patch Link: https://github.com/python/cpython/commit/4dc2cae3abd75f386374d0635d00443b897d0672 (From OE-Core rev: cbf57b25c78ea9d56863d9546b51fc2c88adb8cf) Signed-off-by: Riyaz Khan Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.12 -> 3.8.13

2022-03-23T23:16:12+00:00

Security and bug fixes (including upgrades for security and bug fixes to bundled components). For changes see: https://docs.python.org/release/3.8.13/whatsnew/changelog.html#python-3-8-13-final CVE: CVE-2022-26488 License-Update: Add 2022 to copyright years * Update bpo-36852 patch to apply after change in 3.8.13 (From OE-Core rev: bcad36b6d34b3176dc313ed6af99897cc442bf2b) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: Add a fix for a make install race

2021-10-23T22:14:17+00:00

Add a fix for reproducibility issues where pyc files for python-config.py may not always be generated. (From OE-Core rev: 917f800368c6d452670d3ccf74057afae98013b0) Signed-off-by: Richard Purdie (cherry picked from commit d1c3a87c48b598b6e5624d0affe8bd89320631bf) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: skip tests requiring tools-sdk

2021-07-10T21:46:19+00:00

Conditionally skip test_ctypes.test_find unless IMAGE_FEATURES contains 'tools-sdk' as these test cases require full packagegroup-core-buildessential Fixes: AssertionError: Failed ptests: {'python3': ['test_find_library_with_gcc', 'test_find_library_with_ld']} (From OE-Core rev: 63bc36dbd93c46be8adf7db00e3fc22897eb1846) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.8 -> 3.8.9

2021-07-02T06:44:59+00:00

Release Date: April 2, 2021 Note: The release you're looking at is Python 3.8.9, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Refresh test_local.py patch for upstream changes * Add DEPENDS on autoconf-archive: - bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros. References: https://www.python.org/downloads/release/python-389/ https://docs.python.org/release/3.8.9/whatsnew/changelog.html#python-3-8-9 https://bugs.python.org/issue43617 (From OE-Core rev: fe037d895e045c5de7ea834c38d09a1c08d8b8a2) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.7 -> 3.8.8

2021-07-02T06:44:59+00:00

Release Date: Feb. 19, 2021 Note: The release you're looking at is Python 3.8.8, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.8 Earlier Python versions allowed using both ; and & as query parameter separators in urllib.parse.parse_qs() and urllib.parse.parse_qsl(). Due to security concerns, and to conform with newer W3C recommendations, this has been changed to allow only a single separator key, with & as the default. This change also affects cgi.parse() and cgi.parse_multipart() as they use the affected functions internally. For more details, please see their respective documentation. (Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in bpo-42967.) License-Update: update copyright years Drop patches fixed in 3.8.8: - CVE-2021-3177 Fixes: CVE: CVE-2021-3426 CVE: CVE-2021-23336 References: https://www.python.org/downloads/release/python-388/ https://docs.python.org/release/3.8.8/whatsnew/changelog.html#changelog https://docs.python.org/3/whatsnew/3.8.html#notable-changes-in-python-3-8-8 https://nvd.nist.gov/vuln/detail/CVE-2021-3177 https://nvd.nist.gov/vuln/detail/CVE-2021-3426 (From OE-Core rev: fdfc3340b58e1af0c231eedaa07358f7d9c6483e) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

python3: upgrade 3.8.6 -> 3.8.7

2021-07-02T06:44:59+00:00

Release Date: Dec. 21, 2020 Note: The release you're looking at is Python 3.8.7, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-27619 fixed in 3.8.7 References: https://nvd.nist.gov/vuln/detail/CVE-2020-27619 https://www.python.org/downloads/release/python-387/ https://docs.python.org/release/3.8.7/whatsnew/changelog.html (From OE-Core rev: a90dde9b1800acf364fa272177945e0a4cbf6560) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie