Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers
to cause a denial of service via HTML in a crafted package or custom PackageIndex
page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
CVE: CVE-2022-40897
Upstream-Status: Backport [43a9c9bfa6]
cherry-pick and modify from OE-Core rev: f574d8d57ff3fbc38e350e7a90913993081c4fdf
(From OE-Core rev: f2230ead6c145efc902336b2b9d5a4f0ecb749de)
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Check if the module object has attribute '__file__' to fix and
avoid errors like:
AttributeError: module '_abc' has no attribute '__file__'. Did you mean: '__name__'?
(From OE-Core rev: ede7452e6dcb202952b85b76eecbd2e1760b11e9)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 8acce12c1a4cf37ac312c92d62a6ae93a349dddf)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Released: Thu Sep 22 2022
* bug
- [bug] [lexer]
* Fixed issue in lexer in the same category as that of #366 where the regexp
used to match an end tag didn’t correctly organize for matching characters
surrounded by whitespace, leading to high memory / interpreter hang if a
closing tag incorrectly had a large amount of unterminated space in it.
Credit to Sebastian Chnelik for locating the issue.
As Mako templates inherently render and directly invoke arbitrary Python
code from the template source, it is never appropriate to create templates
that contain untrusted input.
References: #367
[1] https://docs.makotemplates.org/en/latest/changelog.html#change-1.2.3
[2] https://github.com/sqlalchemy/mako/issues/366
[3] https://github.com/sqlalchemy/mako/issues/367
(From OE-Core rev: ce8d8fb1052eb45c0a4a860cb59c53c93430d6bf)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 49ad6f031458e1f48f24547dc88e41abc4ec41a6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The zoneinfo module provides a concrete time zone implementation
to support the IANA time zone database as originally specified in
PEP 615.
(From OE-Core rev: 668bb1c3828bb66fcd3ed8d0fc16fb11eef3a45f)
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
setup.py in latest release is broken after move to flit-core
was released by the project.
This broke the version detection in consuming libs like requests.
Remove the not needed egg.info removal as well
(From OE-Core rev: 399c324e9a30ab63e0c5d653dba5bf9354ec70f7)
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License checksum change due to a url change, license itself unchanged.
(From OE-Core rev: 6112c30c49da478cd2b3496a7df0211acda1944e)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
editline is a BSD alternative for readline which is GPLv3.
(From OE-Core rev: 33c1dc903a0908dc9796ddf03a90f1e23e5d1405)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The :append can not be removed via bbappends if needed. Thus it's better
for open source layers to use += append if possible.
(From OE-Core rev: 1e09be9455fb054b3f74f088b355116828cb4626)
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Import this recipe from meta-python, as it is needed by many recipes
from different layers e.g. wireplumber from meta-multimedia,
opengl-es-cts and vulkan-cts in meta-oe, yelp-tools in meta-gnome to
name a few, the real issue is that newer vulkan-cts has added this
dependency which is in meta-oe, and meta-oe can not depend on
meta-python
(From OE-Core rev: 19e87e03234245c522d63f14365885ab5369a54c)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Changelog:
==========
Bug fixes:
------------
Fix documentation on pathspec.pattern.RegexPattern.match_file().
Issue #60: Remove redundant wheel dep from pyproject.toml.
Issue #61: Dist failure for Fedora, CentOS, EPEL.
Issue #62: Since version 0.10.0 pure wildcard does not work in some cases.
Improvements:
-------------
Restore support for legacy installations using setup.py. See Issue #61.
(From OE-Core rev: 3fb525887c7e8a6c043c5b11b8e1d7ebc19ac28c)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since "python_pep517: use installer instead of pip" pip is no longer
used in builds, and therefore doesn't need to behave reproducibly.
I have submitted the patch upstream; upstream have suggested that the
way it had been used previously is non-reproducible by design, and
if pip is again brought into builds in the future, we should use
specific options for reproducibility:
https://github.com/pypa/pip/issues/11424
(From OE-Core rev: 654f9d5088d00ee27b4d2f7b3bb371195de52247)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
python3-requests makes use of 'zipfile' module, so we need to add
python3-compression as a dependency, otherwise 'import requests'
errors out.
(From OE-Core rev: 6cfe2ed2234a76a3f9da194097781e8d6ce1353b)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This package was broken since it was upgraded to 6.48, because
it started using 'exceptiongroup' since then, which is missing
in any meta layer. On target, when importing hypothesis, we meet
the following error:
Traceback (most recent call last):
File "/usr/lib64/python3.10/site-packages/hypothesis/internal/compat.py", line 18, in <module>
BaseExceptionGroup = BaseExceptionGroup
NameError: name 'BaseExceptionGroup' is not defined. Did you mean: 'BaseException'?
ModuleNotFoundError: No module named 'exceptiongroup'
The related codes as below:
try:
BaseExceptionGroup = BaseExceptionGroup
ExceptionGroup = ExceptionGroup # pragma: no cover
except NameError:
from exceptiongroup import (
BaseExceptionGroup as BaseExceptionGroup,
ExceptionGroup as ExceptionGroup,
)
We can see that it tries to use ExceptionGroup and falls back to
use an import from exceptiongroup module.
Looking at the https://github.com/agronholm/exceptiongroup, it says:
"""
This is a backport of the BaseExceptionGroup and ExceptionGroup classes from Python 3.11.
"""
So instead of adding a new recipe for exception group, it might be
better to revert to a working version and wait for python 3.11 to release.
(From OE-Core rev: 37c5b171d7de25b131e77b80d37f8481308bd6fe)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Match the changes to debug prefixes in bitbake.conf.
(From OE-Core rev: ccbbed323b5a96bbdaec4411fdd26cb9dca583e8)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
reproducible.patch
refreshed for new version.
0001-change-shebang-to-python3.patch
removed as not needed since upstream has removed the shebang lines.
License-Update:
src/pip/_vendor/html5lib/LICENSE: removed since it's not it new version
src/pip/_vendor/chardet/LICENSE: file format modified, change St to Street
src/pip/_vendor/pygments/LICENSE: Copyright year updated to 2022
(From OE-Core rev: d69f360bb48001a4ec9220c8f935bb5fe43b4f7a)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
