summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/python
Commit message (Collapse)AuthorAgeFilesLines
* python-pip: CVE-2021-3572 Incorrect handling of unicode separators in git ↵Hitendra Prajapati2022-06-242-0/+49
| | | | | | | | | | | | | | | | | | references Source: https://github.com/pypa/pip MR: 113864 Type: Security Fix Disposition: Backport from https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b ChangeID: 717948e217d6219d1f03afb4d984342d7dea4636 Description: CVE-2021-3572 python-pip: Incorrect handling of unicode separators in git references. (From OE-Core rev: 841a8fb5b6351f79a4d756232a544d1a6480c562) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: ignore CVE-2015-20107Ross Burton2022-05-091-0/+3
| | | | | | | | | | | | | | | | | | | CVE-2015-20107 describes an arbitrary command execution in the mailcap module, but this is by design in mailcap and needs to be worked around by the calling application. Upstream Python will be documenting this flaw in the library reference, and it is likely that the mailcap module will be deprecated and removed in the future. (From OE-Core rev: 1ed7bb74d35f08af3babf73c68ee01af5f28a50b) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 85fac8408baf92d8b71946f5bfea92952b7eab01) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-jinja2: Correct HOMEPAGEPeter Kjellerstedt2022-04-091-1/+1
| | | | | | | | | | | (From OE-Core rev: 7d429e8385ca01728d797abe8ab9575140734476) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 261778c1e3665b34c0d4e49bda63b520d5335587) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: ignore CVE-2022-26488Ross Burton2022-03-311-1/+1
| | | | | | | | | | | | This CVE is specific to Microsoft Windows, so we can ignore it. (From OE-Core rev: d966a07d1f04aa76a4970d4af141f817197be0d2) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2bd3c5a93988140d9927340b3af68785ae03db65) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.12 -> 3.8.13Tim Orling2022-03-232-22/+26
| | | | | | | | | | | | | | | | | | | | Security and bug fixes (including upgrades for security and bug fixes to bundled components). For changes see: https://docs.python.org/release/3.8.13/whatsnew/changelog.html#python-3-8-13-final CVE: CVE-2022-26488 License-Update: Add 2022 to copyright years * Update bpo-36852 patch to apply after change in 3.8.13 (From OE-Core rev: bcad36b6d34b3176dc313ed6af99897cc442bf2b) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.11 -> 3.8.12Marta Rybczynska2021-12-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: Aug. 30, 2021 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.12, a security bugfix release for the legacy 3.8 series. Python 3.10 is now the latest feature release series of Python 3. Get the latest release of 3.10.x here. Security content in this release contains four fixes. There are also four additional fixes for bugs that might have lead to denial-of-service attacks. Finally, while we're not providing binary installers anymore, for those users who produce installers, we upgraded the OpenSSL version used to 1.1.1l. Take a look at the change log for details. According to the release calendar specified in PEP 569, Python 3.8 is now in the "security fixes only" stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bug fixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers. This release includes a fix for CVE-2021-29921. References: https://docs.python.org/release/3.8.12/whatsnew/changelog.html#changelog (From OE-Core rev: ff52cf448c5e26246f8637d0b8957c5c479fa389) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-magic: add missing DEPENDSSteve Sakoman2021-11-151-0/+2
| | | | | | | | | | | | | | Since file-native is ASSUME_PROVIDED magic.mgc is not being staged. As a result diffoscope-native is failing with: magic.MagicException: b'could not find any valid magic files! Fix this by adding dependency on file-replacement-native (From OE-Core rev: dcd8294f826f6e061cdd01c6c3594789ed46732e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-magic: add the missing rdependsMingli Yu2021-11-151-1/+4
| | | | | | | | | | | | | | | | | | Add the missing rdepends to fix below error: # python3 [snip] >>> import magic [snip] ModuleNotFoundError: No module named 'ctypes' ModuleNotFoundError: No module named 'tempfile' (From OE-Core rev: ba5562d34653fa6b5819dbc8ca80a42167c38c96) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 115791844124bdddfbaec9d75bb887ef35c41f20) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Add a fix for a make install raceRichard Purdie2021-10-232-0/+24
| | | | | | | | | | | | Add a fix for reproducibility issues where pyc files for python-config.py may not always be generated. (From OE-Core rev: 917f800368c6d452670d3ccf74057afae98013b0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d1c3a87c48b598b6e5624d0affe8bd89320631bf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Remove unused python3 recipePurushottam Choudhary2021-08-261-363/+0
| | | | | | | | | | | | Currently in dunfell branch python3 version is 3.8.11. so, python3_3.8.10.bb is not needed. Hence, removed. (From OE-Core rev: 2b44de6e7b3e02b78e2b09294ac37799ad4cfadb) Signed-off-by: Purushottam Choudhary <purushottamchoudhary29@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.10 -> 3.8.11Tim Orling2021-07-151-0/+362
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: June 28, 2021 This is a security release of Python 3.8 Note: The release you're looking at is Python 3.8.11, a security bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Get the latest release of 3.9.x here. Security content in this release contains three fixes. There's also two fixes for 3.8.10 regressions. Take a look at the change log for details. According to the release calendar specified in PEP 569, Python 3.8 is now in security fixes only stage of its life cycle: 3.8 branch only accepts security fixes and releases of those are made irregularly in source-only form until October 2024. Python 3.8 isn't receiving regular bugfixes anymore, and binary installers are no longer provided for it. Python 3.8.10 was the last full bugfix release of Python 3.8 with binary installers. References: https://docs.python.org/release/3.8.11/whatsnew/changelog.html#python-3-8-11-final (From OE-Core rev: 1ba51ee2d52ee92bbdede9f2cd2f9ed9ff04ddb6) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: apply test skipping patch unconditionallyAlexander Kanavin2021-07-101-1/+1
| | | | | | | | | | | | | | | | Testing IMAGE_FEATURES from component recipes cannot possibly work; adjusting the test to soft-fail if needed items are not available is not trivial, so let's just skip unconditionally for now. (From OE-Core rev: 68b816cb90badddd0aafa2a5c6633e000cb21a21) (From OE-Core rev: 0bb221206c55564fd5cfe1d2452a6abe5e86d2c3) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 01b41f7deed48b33b35c84e32ef55de3e63b9bc1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: skip tests requiring tools-sdkTim Orling2021-07-102-0/+34
| | | | | | | | | | | | | | | | Conditionally skip test_ctypes.test_find unless IMAGE_FEATURES contains 'tools-sdk' as these test cases require full packagegroup-core-buildessential Fixes: AssertionError: Failed ptests: {'python3': ['test_find_library_with_gcc', 'test_find_library_with_ld']} (From OE-Core rev: 63bc36dbd93c46be8adf7db00e3fc22897eb1846) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-ptest: add newly discovered missing rdepsTim Orling2021-07-021-1/+2
| | | | | | | | | | | | | | | | | Making ptest images based on core-image-minimal uncovered quite a few missing depenendcies from various recipes, here they are. (From OE-Core rev: 2cda6242f2f0f6f9c6bdef72bbb271eab7e5e1f5) (From OE-Core rev: 9423ad8f0f42d249c2fcb1b86ec9abb75854f011) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Backport to Python 3.8.10 (only python3 portion of patch) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.9 -> 3.8.10Tim Orling2021-07-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: May 3, 2021 This is the tenth and final regular maintenance release of Python 3.8 Note: The release you're looking at is Python 3.8.10, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. FIXME: AssertionError: Failed ptests: {'python3': ['test_record_extensions', 'test_build_ext']} References: https://www.python.org/downloads/release/python-3810/ https://docs.python.org/release/3.8.10/whatsnew/changelog.html (From OE-Core rev: 471d19fa70c4c2b43a039909c9538e2223996335) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.8 -> 3.8.9Tim Orling2021-07-022-14/+16
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: April 2, 2021 Note: The release you're looking at is Python 3.8.9, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Refresh test_local.py patch for upstream changes * Add DEPENDS on autoconf-archive: - bpo-43617: Improve configure.ac: Check for presence of autoconf-archive package and remove our copies of M4 macros. References: https://www.python.org/downloads/release/python-389/ https://docs.python.org/release/3.8.9/whatsnew/changelog.html#python-3-8-9 https://bugs.python.org/issue43617 (From OE-Core rev: fe037d895e045c5de7ea834c38d09a1c08d8b8a2) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.7 -> 3.8.8Tim Orling2021-07-022-195/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: Feb. 19, 2021 Note: The release you're looking at is Python 3.8.8, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.8 Earlier Python versions allowed using both ; and & as query parameter separators in urllib.parse.parse_qs() and urllib.parse.parse_qsl(). Due to security concerns, and to conform with newer W3C recommendations, this has been changed to allow only a single separator key, with & as the default. This change also affects cgi.parse() and cgi.parse_multipart() as they use the affected functions internally. For more details, please see their respective documentation. (Contributed by Adam Goldschmidt, Senthil Kumaran and Ken Jin in bpo-42967.) License-Update: update copyright years Drop patches fixed in 3.8.8: - CVE-2021-3177 Fixes: CVE: CVE-2021-3426 CVE: CVE-2021-23336 References: https://www.python.org/downloads/release/python-388/ https://docs.python.org/release/3.8.8/whatsnew/changelog.html#changelog https://docs.python.org/3/whatsnew/3.8.html#notable-changes-in-python-3-8-8 https://nvd.nist.gov/vuln/detail/CVE-2021-3177 https://nvd.nist.gov/vuln/detail/CVE-2021-3426 (From OE-Core rev: fdfc3340b58e1af0c231eedaa07358f7d9c6483e) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.6 -> 3.8.7Tim Orling2021-07-022-73/+2
| | | | | | | | | | | | | | | | | | | | | Release Date: Dec. 21, 2020 Note: The release you're looking at is Python 3.8.7, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-27619 fixed in 3.8.7 References: https://nvd.nist.gov/vuln/detail/CVE-2020-27619 https://www.python.org/downloads/release/python-387/ https://docs.python.org/release/3.8.7/whatsnew/changelog.html (From OE-Core rev: a90dde9b1800acf364fa272177945e0a4cbf6560) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.5 -> 3.8.6Tim Orling2021-07-021-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: Sept. 24, 2020 Note: The release you're looking at is Python 3.8.6, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. References: https://www.python.org/downloads/release/python-386/ https://docs.python.org/release/3.8.6/whatsnew/changelog.html#changelog License-Update: PSFv2 -> PSF-2.0 and BSD-0-Clause Starting with Python 3.8.6, examples, recipes, and other code in the documentation are dual licensed under the PSF License Version 2 and the Zero-Clause BSD license. (From OE-Core rev: 2fd24949d3eda9e89239f63d1c5034b96eb2756f) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.4 -> 3.8.5Tim Orling2021-07-023-152/+2
| | | | | | | | | | | | | | | | | | | | | | | | Release Date: July 20, 2020 Note: The release you're looking at is Python 3.8.5, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Drop patches fixed in 3.8.5: - CVE-2019-20907 - CVE-2019-26116 References: https://nvd.nist.gov/vuln/detail/CVE-2019-20907 https://nvd.nist.gov/vuln/detail/CVE-2020-26116 https://www.python.org/downloads/release/python-385/ https://docs.python.org/release/3.8.5/whatsnew/changelog.html#changelog (From OE-Core rev: c68cc11071cfa49d9d986bf7a9e6e1dfff514a39) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.3 -> 3.8.4Tim Orling2021-07-022-80/+2
| | | | | | | | | | | | | | | | | | | | | | Release Date: July 13, 2020 Note: The release you're looking at is Python 3.8.4, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. * Drop patch for CVE-2020-14422 fixed in 3.8.4 * Refresh CVE-2021-23336 patch References: https://nvd.nist.gov/vuln/detail/CVE-2020-14422 https://www.python.org/downloads/release/python-384/ https://docs.python.org/release/3.8.4/whatsnew/changelog.html#changelog (From OE-Core rev: c2c6df391a2634e83930219d1b574dbf64066d8a) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: upgrade 3.8.2 -> 3.8.3Tim Orling2021-07-022-251/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Release Date: May 13, 2020 Note: The release you're looking at is Python 3.8.3, a bugfix release for the legacy 3.8 series. Python 3.9 is now the latest feature release series of Python 3. Notable changes in Python 3.8.3: The constant values of future flags in the __future__ module are updated in order to prevent collision with compiler flags. Previously PyCF_ALLOW_TOP_LEVEL_AWAIT was clashing with CO_FUTURE_DIVISION. (Contributed by Batuhan Taskaya in bpo-39562) * Drop patch for CVE-2020-3492 fixed since 3.8.1 References: https://nvd.nist.gov/vuln/detail/CVE-2020-8492 https://www.python.org/downloads/release/python-383/ https://docs.python.org/release/3.8.3/whatsnew/changelog.html#changelog (From OE-Core rev: 2aec1b2b679d607f3b7760b87403aa39465cc1b7) Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "python3: fix CVE-2021-23336"yocto-3.1.9dunfell-23.0.9Steve Sakoman2021-06-202-531/+0
| | | | | | | | Causes build failures on autobuilder This reverts commit 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2021-23336Lee Chee Yang2021-06-192-0/+531
| | | | | | | | | | | | | | | | | | | | | | | | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. References: https://nvd.nist.gov/vuln/detail/CVE-2021-23336 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336 (From OE-Core rev: 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Tim Orling <timothy.t.orling@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-jinja2: 2.11.2 -> 2.11.3Lee Chee Yang2021-05-201-1/+1
| | | | | | | | | | | | | updates include fix for CVE-2020-28493 changelog: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3 (From OE-Core rev: 9485d568b2b9e2143e1f46859a5c1de644c69b94) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda Bassey2021-03-183-0/+4
| | | | | | | | | | | | | | | Added missing HOMEPAGE and DESCRIPTION found using the test command `oe-selftest -r distrodata.Distrodata.test_missing_homepg` [YOCTO #13471] (From OE-Core rev: a6f1da03c9534c3ea1607d479e08d1037688a59f) Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7290b773486da3888f848abf0dba747f2d9f42e1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-jinja2: set CVE_PRODUCTChen Qi2021-03-181-0/+2
| | | | | | | | | | | | Set CVE_PRODUCT for more accurate CVE scanning. (From OE-Core rev: af50558e2505f2e96bd213cd45bcdd5d33161b77) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aefcc7a7dd012530ed846292caaed70d20589a3a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda2021-03-101-0/+1
| | | | | | | | | | | | | | Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] (From OE-Core rev: bd3352880322598b0ba6dc439ff08c2e4c592e36) Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bb05814335e7101bfd8df0a11dc18a044e867bed) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2021-3177Anuj Mittal2021-03-102-0/+192
| | | | | | | | | (From OE-Core rev: 489ef4207141aa8527be95a5ba86aa30540357a4) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 25d1cae49e56797c4c9e91c01697c4de02dee046) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-pycairo: use python3targetconfigAlexander Kanavin2021-02-181-1/+1
| | | | | | | | | | (From OE-Core rev: ba32302980f3885acc97f1aa85bfcede29099b47) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dadf001c85938b831def8da5851a40dc0977e3d0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Use addtask statement instead of task dependenciesTomasz Dziendzielski2021-02-101-4/+1
| | | | | | | | | | | | | | | | | | | The externalsrc class deletes do_patch task which results with: | ERROR: Task do_create_manifest in <PATH>/python3_3.8.2.bb depends upon | non-existent task do_patch in <PATH>/python3_3.8.2.bb Use addtask to define correct order to prevent this error, since addtask mechanism accepts deleted tasks. [YOCTO #14151] (From OE-Core rev: 35ca0a401e62a8a8b88c3089929eda401a90f762) Signed-off-by: Tomasz Dziendzielski <tomasz.dziendzielski@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a746d034fa7eaad4f4876fa61c5a8c3c15e211c8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Avoid installing test data into recipe-sysrootRichard Purdie2021-02-051-0/+6
| | | | | | | | | | | | | | There are several thousand files in the test directory which we don't need. Adding these for the native and target sysroots is a crazy amount of files to be throwing around needlessly. Delete the files from the sysroot side of things to tidy up the sysroots and improve performance. (From OE-Core rev: f73ac290617e89b80e10dc700c0e90efddc8e1b2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6bced03011ad1663d68b0322a2f8aeb4d836646) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2019-20907Andrej Valek2020-12-183-0/+45
| | | | | | | | | | - move fixing patch for CVE-2020-8492 to the right location (From OE-Core rev: f7e7378ea7099af8555de809787cf8e2cb5208fd) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: add CVE-2007-4559 to whitelistRoss Burton2020-12-091-0/+2
| | | | | | | | | | | | | This issue describes expected behaviour, do not use tarfile with untrusted data. (From OE-Core rev: 267130c66dde462a0a1043ab5dffdb86781389a0) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f4c22e83f2e68ff157da5ea1303acc2931d63f5f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2020-27619Lee Chee Yang2020-11-242-0/+71
| | | | | | | | (From OE-Core rev: 001ee91818642ddac7c1b8e5236baa5c4c542b72) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: whitelist CVE-2020-15523Lee Chee Yang2020-11-241-0/+3
| | | | | | | | | | | | | This CVE is issue on _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath. Since it is .dll issue (on windows only), hence whitelist it. https://bugs.python.org/issue29778 (From OE-Core rev: c216431d0704bd8be237e860bbdc32be34a82aee) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: add ldconfig rdepends for python3-ctypesMingli Yu2020-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The ctypes module needs to use "ldconfig -p" to find the library path and it simply has below logic if no ldconfig installed. except OSError: pass Before the patch: >>> from ctypes.util import find_library >>> lib_path = find_library('archive') >>> print(lib_path) None After the patch: >>> from ctypes.util import find_library >>> lib_path = find_library('archive') >>> print(lib_path) libarchive.so.13 (From OE-Core rev: 84e1a32096db9deb98d282a652beec95dbfe80f1) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ddb96902a124a6e1f035f0fd868b0139989bc1bc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2020-26116Lee Chee Yang2020-10-272-0/+105
| | | | | | | | (From OE-Core rev: 2f607a61a820bfbc369f779c3161a339f088d04f) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: add/fix invalid Upstream-Status tagsRoss Burton2020-10-061-1/+1
| | | | | | | | | | (From OE-Core rev: 4dbae5c7c28a2cd6ebb601f984a54ca33d19afaf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 630ce8130598e2bca7231ac28a7cc18b5b942544) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-jinja2: Import from meta-oe/meta-pythonRichard Purdie2020-10-062-0/+48
| | | | | | | | | | | | | | | | | This is used by some of the results handling code and needed as part of buildtools tarball on various autobuilder worker for testing. ptest is disabled for OE-Core, at least for now since it depends on python3-pytest which in turn has may other dependencies. Acked-by: Tim Orling <ticotimo@gmail.com> (From OE-Core rev: cc0f56a788c33ad3fd2bb5402dee497234fb06bb) Signed-off-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b5156e95e9e80e3e0f7eea181cd12f85e03a111d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-markupsafe: Import from meta-oe/meta-pythonRichard Purdie2020-10-062-0/+31
| | | | | | | | | | | | | | | Needed as a dependency of python3-jinja2. ptest is disabled for OE-Core, at least for now since it depends on python3-pytest which in turn has may other dependencies. Acked-by: Tim Orling <ticotimo@gmail.com> (From OE-Core rev: ec222f6af5f8629453ac8e71a1dd6c44ec9a88c8) Signed-off-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a6f2727fd309b8b46a7ac1b8d99ae1d77a6ee74c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2020-14422Lee Chee Yang2020-07-072-0/+78
| | | | | | | | (From OE-Core rev: 0400d217d0891ee553926c10d7caaabc8bebc22e) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-libarchive-c: add the missing rdependsMingli Yu2020-07-071-1/+5
| | | | | | | | | | | | | | | | | | Add the missing rdepends to fix below error: # python3 [snip] >>> import libarchive [snip] ModuleNotFoundError: No module named 'ctypes' ModuleNotFoundError: No module named 'mmap' (From OE-Core rev: 347e6fafea8bd9c715d87882159fc2d4bbde0cc7) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b3a2615878bc7515a7bdace525dc27be45f158e2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-pyelftools: Upgrade 0.25 -> 0.26Joshua Watt2020-06-051-2/+2
| | | | | | | | | | (From OE-Core rev: b2306d00dc82cb780a439b569104c0f526e6e4d5) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0323e12624ef45e64e7a8ba6384c06e4d42df064) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-pycryptodome(x): Upgrade 3.9.4 -> 3.9.7Joshua Watt2020-06-054-7/+6
| | | | | | | | | | | | | Also splits apart the SRC_URI checksums to make automatic upgrades easier (From OE-Core rev: 03b27d56272a4815ead04da08cfaa738b450ae59) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ae1f210546396b761ea86d9e32bf90c0867ff845) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pyelftools: Import from meta-pythonJoshua Watt2020-06-051-0/+14
| | | | | | | | | | | | | | | | Imports the pyelftools recipes from meta-python, as of 7c02c7d41 ("gnome-themes-extra: correct the recipe name"). This recipe is commonly used by other layers, so moving it into OE-core helps to cut down on layer dependencies. (From OE-Core rev: 0a8cdaa90f4dd2d09b0b471dafd868a4dcad4ed3) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 910ffaf5beed42936588c95b0c7c1b1ad67f99d3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pycryptodome: Import from meta-pythonJoshua Watt2020-06-053-0/+41
| | | | | | | | | | | | | | | | Imports the pycryptodome recipes from meta-python, as of 7c02c7d41 ("gnome-themes-extra: correct the recipe name"). These recipes are commonly used by other layers, so moving them into OE-core helps to cut down on layer dependencies. (From OE-Core rev: 27798f3da506fcae19b74deb17ef199131cff405) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a96f815c53364b119b5743b8b7100eb5588d5cf5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-setuptools: add the missing rdependsMingli Yu2020-05-281-0/+2
| | | | | | | | | | | | | | | | | | | Add the missing rdepends to fix below error: # python3 [snip] >>> import setuptools.lib2to3_ex [snip] ModuleNotFoundError: No module named 'lib2to3' ModuleNotFoundError: No module named 'pickle' (From OE-Core rev: d19d1ccca3f86a59a72023727d3d804c2e9d18dc) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit be5c3c989d75290863cc7aef9949cf6e82d3070f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3-setuptools: add the missing rdependsMingli Yu2020-05-221-0/+1
| | | | | | | | | | | | | | | | Add the missing rdepends to fix below error: # python3 [snip] >>> import setuptools [snip] ModuleNotFoundError: No module named 'json' (From OE-Core rev: 5733811eeba9fd88f4a621c705a2de61b197c3d7) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: fix CVE-2020-8492Trevor Gamblin2020-05-072-0/+249
| | | | | | | | | | | CVE: CVE-2020-8492 (From OE-Core rev: c9ee462bb606b34ab31cfb90f84a5302d15135cf) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-21 11:17:47 +0000