There is a HIGH severity vulnerability affecting the CPython "zipfile"
module. When iterating over names of entries in a zip archive (for example,
methodsof "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()",
etc) the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-8088
Upstream-Patch:
7ae310c56a
(From OE-Core rev: 2d98276ba70ed6c44afecd42a7352f1b3030438f)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module. When parsing cookies that contained
backslashes for quoted characters in the cookie value, the parser would use
an algorithm with quadratic complexity, resulting in excess CPU resources
being used while parsing the value.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-7592
Upstream-Patch:
dcc3eaef98
(From OE-Core rev: 3bb9684eef5227e7b1280ee9051884310b0d0b7f)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This test is causing problems on the Autobuilder, so disable it for now.
(From OE-Core rev: 9eafd0c56b279a7c3025b0dcd00745baead15bb6)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ac000b00ec615b3e51dda8d819015d5e7110ed88)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These tests are causing hangs on the Autobuilder, so disable them for
now.
(From OE-Core rev: 141c348ce83552beae88e115d9c4db5802c6e0f4)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 291f37808f1a2b2fdc8190696867f974994457c0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These tests are causing hangs on the Autobuilder, so disable them for
now.
(From OE-Core rev: e3b4a05f19e3ba8f84b5d892b787e67bef565e48)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
bitbake python3 -c create_manifest revealed several changes that were missing.
This commit contains a manual cherry-picked version of those, making sure that
new RDEPENDS are reflected since the last time this was updated.
In this case its taking out unnecessary dependencies to python3-profile and
python3-shell.
(From OE-Core rev: 692013b9aa5106561afb4c6506661bab41d88461)
Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandro@enedino.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For some reason dataclasses was being packaged in the -profile subpackage,
which doesn't make sense as this is a core piece of the runtime support.
(From OE-Core rev: bc17d33b30a6d5d970f390becf726e852fd0cc16)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop distutils and smtpd modules from packaging, as both are gone in 3.12.
Rebase:
0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch
(drop setup.py chunk as the file is gone)
Drop patches:
0001-Do-not-add-usr-lib-termcap-to-linker-flags-to-avoid-.patch
(setup.py gone, lib/termcap not mentioned anywhere else)
0001-Don-t-search-system-for-headers-libraries.patch
(setup.py gone, usr/lib64 not mentioned anywhere else)
0001-Makefile-do-not-compile-.pyc-in-parallel.patch
(replaced with COMPILEALL_OPTS= in EXTRA_OEMAKE)
0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch
(setup.py gone, add_multiarch_paths not mentioned anywhere else)
0017-setup.py-do-not-report-missing-dependencies-for-disa.patch
(has been superseded by Setup.local tweak in do_configure:prepend)
12-distutils-prefix-is-inside-staging-area.patch
(distutils has been removed upstream, so this old, unplesant hack can be finally dropped)
avoid_warning_about_tkinter.patch
(setup.py gone, tkinter detection logic performed in configure.ac)
(From OE-Core rev: 716d82352545d3667a658b69d65d6127678dd150)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[YOCTO #14933]
test_storlines is yet another Python ptest that fails intermittently on
the Yocto AB, so disable it during ptests for now.
(From OE-Core rev: d7b9f8157e6214a83b5495e8a32e11540ae65ff8)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[YOCTO #15210]
test_input_no_stdout_fileno has been seen failing on AB workers under
heavy load. Skip it while leaving the rest of the test_builtin suite
alone.
(From OE-Core rev: cf8927737690bf21dd3fb57474e09b71078e354c)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adjust locale dependencies to help run tests sadly, tr-tr is not
available yet in musl-locale so keep that specific to glibc
Add an exclusion list for tests and populate it for musl for the failing
tests
(From OE-Core rev: db76ac9968ceddc01e48069dbacc212eb4f88574)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The following tests have been seen failing intermittently on the
autobuilder:
test.test_multiprocessing_forkserver.WithManagerTestBarrier.test_timeout
test.test_time.TimeTestCase.test_thread_time
Since these could be affected by AB systems under heavy load, disable
them. New test outputs:
test_timeout (test.test_multiprocessing_fork.WithProcessesTestBarrier.test_timeout)
SKIP: Test wait(timeout) 'timing related test, dependent on load'
...
SKIP: test_thread_time (test.test_time.TimeTestCase.test_thread_time) 'timing related test, dependent on load'
[YOCTO # 15131]
[YOCTO # 15177]
(From OE-Core rev: 4da3b653e0fad52e7af97328b49e40d5179ddfe5)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a conditional echo statement to make sure that there is a
FAIL emitted when python3 ptests regress in a way sed doesn't
catch.
(From OE-Core rev: 2100c588863b9da64ea8f2eb6be4ff445e26b5f0)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is based on a previous patch from Alex Kanavin (thanks Alex),
but it retains our use of sed to parse the test output into a usable
form. The intent was to use the test module's --junit-xml feature and
parse the resulting log instead of using sed, but various errors were
encountered when testing this method, so that will need further
investigation before we can consider adopting it. Two missing ptest
dependencies on python3-cgitb and python3-zipapp were already merged
in a previous patch, so only gcc, g++, and binutils were left to add
as ptest RDEPENDS.
ptest output and runtime with this change:
== Tests result: SUCCESS ==
405 tests OK.
29 tests skipped:
test_asdl_parser test_check_c_globals test_clinic test_curses
test_devpoll test_gdb test_idle test_ioctl test_kqueue
test_launcher test_msilib test_ossaudiodev test_readline
test_smtpnet test_socketserver test_startfile test_tcl test_tix
test_tk test_ttk_guionly test_ttk_textonly test_turtle
test_urllib2net test_urllibnet test_winconsoleio test_winreg
test_winsound test_xmlrpc_net test_zipfile64
Total duration: 5 min 3 sec
[YOCTO #13298]
(From OE-Core rev: 50a719d3002a4119e8b2be43aec8fe01aa0c2a40)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a
preplace() call, add it.
That said, calling replace() with one argument results in a TypeError,
so this is obviously dead code.
(From OE-Core rev: 9b2e2c8d809e7ca34451ec9702b029a00dfb410b)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Extend the manifest with definitions for the turtle package from the
Python standard library. Currently this package cannot be imported at
run-time because python3-misc doesn't pull the required dependencies.
(From OE-Core rev: 09476b2be0c8a155dc6494442cc3caca97782595)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Extend the manifest with definitions for the zipapp package from the
Python standard library. Currently this package cannot be imported at
run-time because python3-misc doesn't pull the required dependencies.
(From OE-Core rev: 30186af3a3c46d9349940d952a0d8d1826b0dd4a)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Extend the manifest with definitions for the cgitb package from the
Python standard library. Currently this package cannot be imported at
run-time because python3-misc doesn't pull the required dependencies.
(From OE-Core rev: b9428ccad6238e33dc7bb344e06f4f8cf73b2ef8)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add the pip bootstrapping module from the standard library to the
manifest. This module is a run-time requirement of python3-build.
(From OE-Core rev: 7013ddda8f249377c00bc4efb40c34dd5fcfe15a)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The python3-modules package should depend on zoneinfo, and gdbm if it
was enabled.
(From OE-Core rev: 0e0a5a635f44931dd490ae6a99548f05bd5205a8)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Unfortunately, sysconfig is used by:
- setuptools to find out where to install new headers
- autoconf-archive to find where Python.h is
In the first case we want the target location, in the second case we want
the sysroot location. The second case is not yet used in the wild
(as projects such as gpgpme are using outdated distutils-based m4 macros),
but it will become a problem once python 3.12 is out, and
said projects are forced to migrate to sysconfig. Let's deal with it
then in a more careful manner, and hopefully convince upstream that
there is a general problem too.
(From OE-Core rev: 499b152bf63749be18fc252978a6cc632254b325)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch:
the patch has been rejected upstream (see the bug), and does quite a
bit more than just fix the mips softfloat problem. If the problem
still exists, then the fix needs to be re-done, and re-submitted.
The other two patches have been merged upstream.
License-Update: http->https
(From OE-Core rev: 9b6e8c173162798428cf8627b596ca81cd8ab855)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without this, sysconfig would report the target location, which is not
what we want in cross-builds. This is used in particular by
latest autoconf-archive m4 macros, which have migrated from
(removed in py 3.12) distutils to setuptools.
(From OE-Core rev: df8303ab2f0ca4b694b845016c8d7e0279a48fe7)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is no need to patch native python so that it looks in the target
sysroot; the same can be achieved with just an environment variable.
(From OE-Core rev: c9617c03bceee54dc540318cada392799b137bd5)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is really no reason why we can't: it only needs to be available
in two versions (native/target), and the correct one can be picked
via PATH priority order.
This eliminates two un-upstreamable patches, one of which relies
on soon to be removed distutils.
(From OE-Core rev: d0145ead0f80ba4bde8e24617a8725f38eda8339)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
After Python upgrade to 3.11, it requires pkg-config to detect
tcl and tk when configure tkinter, so add tcl depends to fix
below error.
| The necessary bits to build these optional modules were not found:
| _tkinter
(From OE-Core rev: 163966765d57fe38e13d0b6659795a13bc702e2d)
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Following the update from 3.10.6 to 3.11.0, the source code of
module re for regular expression operations has been moved to
Lib/re/. File python3-manifest.json has been modified according
to the new path.
According to the instructions the new python3-manifest.json
version was created by running bitbake python3 -c create_manifest.
Because of this it also updated other files and rdepends in it.
(From OE-Core rev: 830393e7aa0150566d871acd877908e08fa06964)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Check if the module object has attribute '__file__' to fix and
avoid errors like:
AttributeError: module '_abc' has no attribute '__file__'. Did you mean: '__name__'?
(From OE-Core rev: 8acce12c1a4cf37ac312c92d62a6ae93a349dddf)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The semaphore fix has landed and is available from 3.11 onwards:
1ee0f94d16
Drop 0001-Mitigate-the-race-condition-in-testSockName.patch
as it is merged upstream.
(From OE-Core rev: f10cdc155e47af5627ee999c57e1d083f9382a91)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The zoneinfo module provides a concrete time zone implementation
to support the IANA time zone database as originally specified in
PEP 615.
(From OE-Core rev: 668bb1c3828bb66fcd3ed8d0fc16fb11eef3a45f)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This test uses find_unused_port() which is inherently racey, so retry
it a few times before failing.
[ YOCTO #14840 ]
(From OE-Core rev: efac044cabdbe77556a0b9903595fd602f39ac8d)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The native path may be too big, leading to shebang
overflow. Just use the #!/usr/bin/env python3.
(From OE-Core rev: 84783dee09e48cb930c7cd27944eaf3f03997237)
Signed-off-by: Paulo Neves <ptsneves@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
