Drop upstreamed patch and refresh remaining patches.
Release information:
* https://www.python.org/downloads/release/python-31212/
* The release you're looking at is Python 3.12.12, a security bugfix
release for the legacy 3.12 series.
Handles CVE-2025-59375.
(From OE-Core rev: f1234b8451ba843b5f9ec1d2066c21f54d6bc3b8)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Drop upstreamed patch and refresh remaining patches.
* https://www.python.org/downloads/release/python-31210/
Python 3.12.10 is the latest maintenance release of Python 3.12, and
the last full maintenance release. Subsequent releases of 3.12 will be
security-fixes only.
* https://www.python.org/downloads/release/python-31211/
Security content in this release
* gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330]
[CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed
tarfile extraction filters (filter="data" and filter="tar") to be
bypassed using crafted symlinks and hard links.
* gh-133767: Fix use-after-free in the “unicode-escape” decoder with a
non-“strict” error handler.
* gh-128840: Short-circuit the processing of long IPv6 addresses early
in ipaddress to prevent excessive memory consumption and a minor
denial-of-service.
gh-133767 got meawhile CVE-2025-4516 assigned.
(From OE-Core rev: 6cca08b2857efd5481e837ecd6bb295cb8a99ee1)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
importlib.metadata is part of -core, but that will import zipfile which
is part of -compression.
Obviously this shows that our packaging of the Python modules is not
optimal. I plan to follow up with a redesign of the splitting which
focuses on simply pulling out the larger or esoteric modules and
having a more featureful core.
(From OE-Core rev: 05166eafb99cf8c7adb6879277069ab384a2f8df)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
The fix brought by this patch is already part of python 3.12.3
therefore drop it.
(From OE-Core rev: 555623d2378138fdcfae95c04e06ba384cebab5b)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Includes security fixes for CVE-2024-7592, CVE-2024-8088, CVE-2024-6232,
CVE-2023-27043 and other bug fixes.
Removed below patches, as the fix is included in 3.12.6 upgrade:
1. CVE-2024-7592.patch
2. CVE-2024-8088.patch
Release Notes:
https://www.python.org/downloads/release/python-3126/
(From OE-Core rev: aa492b1fd5973c37b8fa2cd17d28199eba46afcc)
(From OE-Core rev: 6688a8ff2e1cbf6ad8ebd1b89ec6c929caf6a161)
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Python 3.12.5 is failing a newer ptest for reading/writing limited
history when editline (default) is set in PACKAGECONFIG. Skip it for now
until a proper fix (if any) is determined.
A bug has been opened upstream: https://github.com/python/cpython/issues/123018
(From OE-Core rev: de569ddffd5ea36b70c56df21dec9c892e5dee7d)
(From OE-Core rev: 98b3a3e3f79a3edaa4cf2cfbf58eb84553d65e1e)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module. When iterating over names of entries in a zip archive (for example,
methodsof "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()",
etc) the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-8088
Upstream-Patch:
7ae310c56a
(From OE-Core rev: 2d98276ba70ed6c44afecd42a7352f1b3030438f)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module. When parsing cookies that contained
backslashes for quoted characters in the cookie value, the parser would use
an algorithm with quadratic complexity, resulting in excess CPU resources
being used while parsing the value.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-7592
Upstream-Patch:
dcc3eaef98
(From OE-Core rev: 3bb9684eef5227e7b1280ee9051884310b0d0b7f)
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This test is causing problems on the Autobuilder, so disable it for now.
(From OE-Core rev: 9eafd0c56b279a7c3025b0dcd00745baead15bb6)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ac000b00ec615b3e51dda8d819015d5e7110ed88)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These tests are causing hangs on the Autobuilder, so disable them for
now.
(From OE-Core rev: 141c348ce83552beae88e115d9c4db5802c6e0f4)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 291f37808f1a2b2fdc8190696867f974994457c0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
These tests are causing hangs on the Autobuilder, so disable them for
now.
(From OE-Core rev: e3b4a05f19e3ba8f84b5d892b787e67bef565e48)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
bitbake python3 -c create_manifest revealed several changes that were missing.
This commit contains a manual cherry-picked version of those, making sure that
new RDEPENDS are reflected since the last time this was updated.
In this case its taking out unnecessary dependencies to python3-profile and
python3-shell.
(From OE-Core rev: 692013b9aa5106561afb4c6506661bab41d88461)
Signed-off-by: Alejandro Enedino Hernandez Samaniego <alejandro@enedino.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
For some reason dataclasses was being packaged in the -profile subpackage,
which doesn't make sense as this is a core piece of the runtime support.
(From OE-Core rev: bc17d33b30a6d5d970f390becf726e852fd0cc16)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop distutils and smtpd modules from packaging, as both are gone in 3.12.
Rebase:
0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch
(drop setup.py chunk as the file is gone)
Drop patches:
0001-Do-not-add-usr-lib-termcap-to-linker-flags-to-avoid-.patch
(setup.py gone, lib/termcap not mentioned anywhere else)
0001-Don-t-search-system-for-headers-libraries.patch
(setup.py gone, usr/lib64 not mentioned anywhere else)
0001-Makefile-do-not-compile-.pyc-in-parallel.patch
(replaced with COMPILEALL_OPTS= in EXTRA_OEMAKE)
0001-setup.py-Do-not-detect-multiarch-paths-when-cross-co.patch
(setup.py gone, add_multiarch_paths not mentioned anywhere else)
0017-setup.py-do-not-report-missing-dependencies-for-disa.patch
(has been superseded by Setup.local tweak in do_configure:prepend)
12-distutils-prefix-is-inside-staging-area.patch
(distutils has been removed upstream, so this old, unplesant hack can be finally dropped)
avoid_warning_about_tkinter.patch
(setup.py gone, tkinter detection logic performed in configure.ac)
(From OE-Core rev: 716d82352545d3667a658b69d65d6127678dd150)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[YOCTO #14933]
test_storlines is yet another Python ptest that fails intermittently on
the Yocto AB, so disable it during ptests for now.
(From OE-Core rev: d7b9f8157e6214a83b5495e8a32e11540ae65ff8)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[YOCTO #15210]
test_input_no_stdout_fileno has been seen failing on AB workers under
heavy load. Skip it while leaving the rest of the test_builtin suite
alone.
(From OE-Core rev: cf8927737690bf21dd3fb57474e09b71078e354c)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adjust locale dependencies to help run tests sadly, tr-tr is not
available yet in musl-locale so keep that specific to glibc
Add an exclusion list for tests and populate it for musl for the failing
tests
(From OE-Core rev: db76ac9968ceddc01e48069dbacc212eb4f88574)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The following tests have been seen failing intermittently on the
autobuilder:
test.test_multiprocessing_forkserver.WithManagerTestBarrier.test_timeout
test.test_time.TimeTestCase.test_thread_time
Since these could be affected by AB systems under heavy load, disable
them. New test outputs:
test_timeout (test.test_multiprocessing_fork.WithProcessesTestBarrier.test_timeout)
SKIP: Test wait(timeout) 'timing related test, dependent on load'
...
SKIP: test_thread_time (test.test_time.TimeTestCase.test_thread_time) 'timing related test, dependent on load'
[YOCTO # 15131]
[YOCTO # 15177]
(From OE-Core rev: 4da3b653e0fad52e7af97328b49e40d5179ddfe5)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a conditional echo statement to make sure that there is a
FAIL emitted when python3 ptests regress in a way sed doesn't
catch.
(From OE-Core rev: 2100c588863b9da64ea8f2eb6be4ff445e26b5f0)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is based on a previous patch from Alex Kanavin (thanks Alex),
but it retains our use of sed to parse the test output into a usable
form. The intent was to use the test module's --junit-xml feature and
parse the resulting log instead of using sed, but various errors were
encountered when testing this method, so that will need further
investigation before we can consider adopting it. Two missing ptest
dependencies on python3-cgitb and python3-zipapp were already merged
in a previous patch, so only gcc, g++, and binutils were left to add
as ptest RDEPENDS.
ptest output and runtime with this change:
== Tests result: SUCCESS ==
405 tests OK.
29 tests skipped:
test_asdl_parser test_check_c_globals test_clinic test_curses
test_devpoll test_gdb test_idle test_ioctl test_kqueue
test_launcher test_msilib test_ossaudiodev test_readline
test_smtpnet test_socketserver test_startfile test_tcl test_tix
test_tk test_ttk_guionly test_ttk_textonly test_turtle
test_urllib2net test_urllibnet test_winconsoleio test_winreg
test_winsound test_xmlrpc_net test_zipfile64
Total duration: 5 min 3 sec
[YOCTO #13298]
(From OE-Core rev: 50a719d3002a4119e8b2be43aec8fe01aa0c2a40)
Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a
preplace() call, add it.
That said, calling replace() with one argument results in a TypeError,
so this is obviously dead code.
(From OE-Core rev: 9b2e2c8d809e7ca34451ec9702b029a00dfb410b)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Extend the manifest with definitions for the turtle package from the
Python standard library. Currently this package cannot be imported at
run-time because python3-misc doesn't pull the required dependencies.
(From OE-Core rev: 09476b2be0c8a155dc6494442cc3caca97782595)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Extend the manifest with definitions for the zipapp package from the
Python standard library. Currently this package cannot be imported at
run-time because python3-misc doesn't pull the required dependencies.
(From OE-Core rev: 30186af3a3c46d9349940d952a0d8d1826b0dd4a)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Extend the manifest with definitions for the cgitb package from the
Python standard library. Currently this package cannot be imported at
run-time because python3-misc doesn't pull the required dependencies.
(From OE-Core rev: b9428ccad6238e33dc7bb344e06f4f8cf73b2ef8)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add the pip bootstrapping module from the standard library to the
manifest. This module is a run-time requirement of python3-build.
(From OE-Core rev: 7013ddda8f249377c00bc4efb40c34dd5fcfe15a)
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The python3-modules package should depend on zoneinfo, and gdbm if it
was enabled.
(From OE-Core rev: 0e0a5a635f44931dd490ae6a99548f05bd5205a8)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Unfortunately, sysconfig is used by:
- setuptools to find out where to install new headers
- autoconf-archive to find where Python.h is
In the first case we want the target location, in the second case we want
the sysroot location. The second case is not yet used in the wild
(as projects such as gpgpme are using outdated distutils-based m4 macros),
but it will become a problem once python 3.12 is out, and
said projects are forced to migrate to sysconfig. Let's deal with it
then in a more careful manner, and hopefully convince upstream that
there is a general problem too.
(From OE-Core rev: 499b152bf63749be18fc252978a6cc632254b325)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-bpo-36852-proper-detection-of-mips-architecture-for-.patch:
the patch has been rejected upstream (see the bug), and does quite a
bit more than just fix the mips softfloat problem. If the problem
still exists, then the fix needs to be re-done, and re-submitted.
The other two patches have been merged upstream.
License-Update: http->https
(From OE-Core rev: 9b6e8c173162798428cf8627b596ca81cd8ab855)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without this, sysconfig would report the target location, which is not
what we want in cross-builds. This is used in particular by
latest autoconf-archive m4 macros, which have migrated from
(removed in py 3.12) distutils to setuptools.
(From OE-Core rev: df8303ab2f0ca4b694b845016c8d7e0279a48fe7)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is no need to patch native python so that it looks in the target
sysroot; the same can be achieved with just an environment variable.
(From OE-Core rev: c9617c03bceee54dc540318cada392799b137bd5)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is really no reason why we can't: it only needs to be available
in two versions (native/target), and the correct one can be picked
via PATH priority order.
This eliminates two un-upstreamable patches, one of which relies
on soon to be removed distutils.
(From OE-Core rev: d0145ead0f80ba4bde8e24617a8725f38eda8339)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
