linux/poky.git/meta/recipes-devtools/python, branch thud-20.0.4

python3: Fix CVEs

2019-10-08T21:52:28+00:00

Fixes CVE-2018-14647, CVE-2018-20406, CVE-2018-20852, CVE-2019-9636, CVE-2019-9740, and CVE-2019-9747. (From OE-Core rev: 5862716f22ca9f5745d3bca85c6ed0d8c35c437b) Signed-off-by: Dan Tran Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: Fix 3 CVEs

2019-10-08T21:52:28+00:00

Fixes CVE-2018-20852, CVE-2019-9740, and CVE-2019-9747 (From OE-Core rev: 3f1c02aa7b7d485e64503d601124c335d4b7299f) Signed-off-by: Dan Tran Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python3: fix CVE-2019-9740

2019-10-08T21:52:27+00:00

CVE-2019-9947 is same as CVE-2019-9740 and mark it as such. See: https://bugs.python.org/issue30458 (From OE-Core rev: ad90312adabbad951f62e3bd4ad95fcc763ad0c4) Signed-off-by: Anuj Mittal Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: add a fix for CVE-2019-9948 and CVE-2019-9636

2019-07-27T17:05:18+00:00

Source: OpenEmbedded.org MR: 98320, 98319 Type: Security Fix Disposition: Backport from https://git.openembedded.org/openembedded-core/commit/meta/recipes-devtools/python/python_2.7.16.bb?id=9d23b982fa4e0290761b3d15f6959779fed72ad6 ChangeID: e79b6fe3b7b4253bf0d76b029070ae869d5234bd Description: Fixes: CVE-2019-9948 CVE-2019-9636 CVE-2019-9940 is a dup of 9948 per python.org CVE-2019-9947 appears to be a dup of 9940 per https://bugs.python.org/issue30458#msg295067 (From OE-Core rev: e7bdff05da6075efc21c5ac9492b06e481e5a239) Signed-off-by: Martin Jansa Signed-off-by: Richard Purdie [Minor clean up for thud] Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: Update to 2.7.16

2019-07-27T17:05:18+00:00

Source: Python.org MR: 98220 Type: Security Fix & Integration Disposition: Backport from python.org ChangeID: 96fdd2dee9fe9317eb72584583ae0100c0be9eaa Description: Bug fix update per Python.org https://www.python.org/downloads/release/python-2716/ drop backported patch License-update: copyright years Helps prepare Thud for 2.7 EOL support moving forward. Update includes: CVE-CVE-2019-5010 https://github.com/python/cpython/commit/06b15424b0dcacb1c551b2a36e739fffa8d0c595 (From OE-Core rev: 592e7de7f5208940fbcfcad3371f93f8ce2ca738) Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: fix CVE-2018-14647 in python-native too

2019-05-21T23:31:48+00:00

(From OE-Core rev: 65042ebf07afad2922dcdfceb6e8931c05255649) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python-native: fix one do_populate_sysroot warning

2019-05-21T23:31:48+00:00

Fix below warning: WARNING: Skipping RPATH /usr/lib64 as is a standard search path for work/x86_64-linux/python-native/2.7.15-r1.1/recipe-sysroot-native/ usr/lib/python2.7/lib-dynload/_bsddb.so setup.py will check db.h under include_dirs, for native build, /usr/lib64 will be insert to postion 0 of include_dirs, so it's priority is higher then our sysroot, cause db.h sysroot is ignored, and rpath set to /usr/lib64. and this cause warning when do_populate_sysroot. use append to fix it. (From OE-Core rev: 12df5392afb8446507bb73f4d33ee42e06a17b82) Signed-off-by: Changqing Li Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: time.tzset missing

2019-05-21T23:31:48+00:00

import time time.tzset() Traceback (most recent call last): File "", line 1, in AttributeError: module 'time' has no attribute 'tzset' enable tzset in both python versions (From OE-Core rev: e7721ee7e7942570ebab793f5870d7a021154a92) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie [Fix up for Thud context ie python3_3.5.6] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

meta: remove True option to getVar calls (again)

2019-02-06T16:38:31+00:00

A couple have still been missed in the past despite multiple attempts at doing so (or simply have re-appeared?). Search & replace made using the following command: sed -e 's|$d\.getVar \?$( \?$[^,()]*$, \?True)|\1(\2)|g' \ -i $(git grep -E 'getVar ?$ ?([^,()]*), ?True$' \ | cut -d':' -f1 \ | sort -u) (From OE-Core rev: 9f551d588693328e4d99d33be94f26684eafcaba) (From OE-Core rev: 2da88ecbbf118bb7440f48184d4b39c273ab57e9) Signed-off-by: André Draszik Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python3: drop redundant patch

2019-01-08T20:14:44+00:00

This patch altered the clean target's behaviour to skip the ipkg-install directory. However this directory isn't created by opkg, opkg-utils, or the package_ipk class; and we don't invoke the clean target as we perform out-of-tree builds. (From OE-Core rev: 9f8bd475701e5d797d3ffc1ba97647101ba0b9b0) (From OE-Core rev: e147baad7ab722b8319225561eb23cd4442629e1) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie