summaryrefslogtreecommitdiff
path: root/lang/python/python3/patches
Commit message (Collapse)AuthorAgeFilesLines
* python3: Update to 3.7.16, refresh patchesJeffery To2023-03-164-7/+7
| | | | | | | | | | | | | | | Includes fixes: * 3.7.14: * CVE-2020-10735: Prevent DoS by large int<->str conversions * CVE-2021-28861: http.server: Open Redirection if the URL path starts with // * 3.7.16: * CVE-2022-45061: Slow IDNA decoding with large strings * CVE-2022-37454: Buffer overflow in the _sha3 module * CVE-2015-20107: mailcap.findmatch: document shell command Injection danger in filename parameter Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.7.13, refresh patchesJeffery To2022-03-224-6/+6
| | | | | | | | | Includes fixes for: * Windows builds updated to bzip2 1.0.8 to mitigate CVE-2016-3189 and CVE-2019-12900 * CVE-2022-26488: Escalation of privilege via Windows Installer Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.7.10, refresh patchesJeffery To2021-02-221-3/+3
| | | | | | | | | Includes fixes for: * CVE-2021-3177 - ctypes: Buffer overflow in PyCArg_repr * CVE-2021-23336 - urllib parse_qsl(): Web cache poisoning - semicolon as a query args separator Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.7.9, refresh/remove backported patchesJeffery To2020-10-179-389/+6
| | | | Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Backport security fixesJeffery To2020-07-205-0/+383
| | | | | | | | This backports fixes for security issues, including: * CVE-2020-14422: Hash collisions in IPv4Interface and IPv6Interface * CVE-2019-20907: Infinite loop in the tarfile module Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Use default _PYTHON_HOST_PLATFORMJeffery To2020-07-081-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This lets the Python build process set _PYTHON_HOST_PLATFORM instead of forcing an explicit value. Also: * Save the target _PYTHON_HOST_PLATFORM value during Build/InstallDev for use when building target Python packages (in python3-package.mk). * Use the (mostly) default PYTHON_FOR_BUILD value, instead patch configure to remove the platform triplet from the sysconfigdata file name. * Remove the "CROSS_COMPILE=yes" make variable (there is no indication that this variable is necessary). * Force host pip to build packages from source instead of downloading binary wheels. Previously, host pip can download universal (platform-independent) wheels but not platform-specific wheels, because of the custom _PYTHON_HOST_PLATFORM value. (Packages that do not have universal wheels would be compiled from source.) With a correct _PYTHON_HOST_PLATFORM, host pip can install platform-specific wheels as well. However, the pre-built shared object (.so) files in these wheels will have the host's platform triplet in their file names. When target Python packages are built (using the target's _PYTHON_HOST_PLATFORM), Python will not use these shared object files. By forcing host pip to build packages from source, the built shared object files will not have the platform triplet in their file names. (Host Python has been patched to remove the platform triplet from file names.) This allows these packages to be used when building target Python packages. (The net effect of this complete change is that platform-dependent packages will continue to be compiled from source, while platform-independent packages will now also be compiled from source.) Fixes https://github.com/openwrt/packages/issues/12680. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to 3.7.8, refresh/rework patchesJeffery To2020-06-304-20/+6
| | | | | | | | | | | | This contains a fix for CVE-2020-8492 (Denial of service in urllib.request.AbstractBasicAuthHandler)[1]. This also updates the setuptools and pip packages to 47.1.0 and 20.1.1, respectively. [1]: https://docs.python.org/release/3.7.8/whatsnew/changelog.html#python-3-7-8-release-candidate-1 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Fix float byte order detectionJeffery To2020-01-302-0/+428
| | | | | | | | | | | | | | | | This backports patches from bpo-34585[1] to fix byte order detection of floats. Fixing byte order detection allows the repr() of floats to be shorter[2]. sys.float_repr_style should be 'short' instead of 'legacy' on supported platforms. See #11134. [1]: https://bugs.python.org/issue34585 [2]: https://docs.python.org/3.8/whatsnew/3.1.html#other-language-changes Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to version 3.7.5Josef Schlehofer2019-10-219-451/+10
| | | | | | | | | | | | | | setuptools: Updated to version 41.2.0 pip: Updated to version 19.2.3 Removed patches: - 017: code was refactored - 02{5,6,7,8}: those patches were backported from upstream and they are included in 3.7.5 Refreshed patches Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* python,python3: Fix CVE-2019-16056, CVE-2019-16935Jeffery To2019-10-051-0/+129
| | | | | | | | | | | | | | | These patches address issues: CVE-2019-16056: email.utils.parseaddr mistakenly parse an email CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py (for Python 2.7) CVE-2019-16935 was fixed for python3 in #10109 Links to Python issues: https://bugs.python.org/issue34155 https://bugs.python.org/issue38243 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: backport three security patchesJosef Schlehofer2019-09-303-0/+297
| | | | | | | Fixes: CVE-2019-16935 Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry-picked from commit 80def9e)
* python,python3: Fix ctypes.util.find_library()Jeffery To2019-07-221-0/+74
| | | | | | | | | | | | | | | Python's ctypes.util.find_library() function currently doesn't work for musl libraries/systems[1]. This adds a patch to fix this function, based on a patch from Alpine Linux[2]. Fixes #9448. [1]: https://bugs.python.org/issue21622 [2]: https://git.alpinelinux.org/aports/tree/main/python2/musl-find_library.patch Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: Update to version 3.7.4Josef Schlehofer2019-07-1013-517/+16
| | | | | | | | | | | | | | - Update setuptools to 40.8.0 - Update pip to 19.0.3 - Refreshed patches - Removed 4 patches (2 of them was included in 3.7.3 and other two are included in this release) Makefile python3: - Move PKG_MAINTAINER above PKG_LICENSE Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry-picked from ce769db0077f3ace8ef691cf33b827a10e0613a5)
* python3: use _python_sysroot for cross-compilationEneas U de Queiroz2019-07-101-0/+67
| | | | | | | | This patch, taken from buildroot, avoids the use of host paths when compiling third-party extensions. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com> (cherry-picked from 523c52f6f272810a6183f7e1302c09e9a7f16f46)
* python,python3: Fix CVE-2019-9948 - local_file:// allowed in urllibJeffery To2019-06-041-0/+76
| | | | | | | | | | | | | | These patches address issue: CVE-2019-9948: Unnecessary URL scheme exists to allow local_file:// reading file in urllib Link to Python issue: https://bugs.python.org/issue35907 Issue 35907 is still currently open, waiting for a decision for Python 3.5; these patches for Python 2.7 and 3.7 have been merged. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python,python3: Fix CVE-2019-9740 and CVE-2019-9947Jeffery To2019-06-031-0/+146
| | | | | | | | | | | | | | | | These patches address issues: CVE-2019-9740: Python urllib CRLF injection vulnerability CVE-2019-9947: Header Injection in urllib Links to Python issues: https://bugs.python.org/issue36276 (resolved duplicated of 30458) https://bugs.python.org/issue35906 (resolved duplicated of 30458) https://bugs.python.org/issue30458 Issue 30458 is still currently open, waiting for a decision for Python 3.5; these patches for Python 2.7 and 3.7 have been merged. Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python,python3: Fix CVE-2019-9636 - urlsplit missing NFKC normalizationJeffery To2019-03-311-0/+150
| | | | | | | | | | These patches address issue: CVE-2019-9636: urlsplit does not handle NFKC normalization Link to Python issue: https://bugs.python.org/issue36216 Signed-off-by: Jeffery To <jeffery.to@gmail.com>
* python3: remove OpenSSL deprecated API patchAlexandru Ardelean2019-03-192-310/+0
| | | | | | | | | | | Fixes: https://github.com/openwrt/packages/issues/8399 These 2 patches cause some breakage for other packages. For now, we drop them and wait for upstream to finalize a fix. We can live with deprecated SSL APIs for a while. No need to hurry, since this doesn't seem to help. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: Fix compilation with deprecated OpenSSL APIsRosen Penev2019-03-1110-14/+324
| | | | | | Also refreshed patches. Signed-off-by: Rosen Penev <rosenp@gmail.com>
* python,python3: fix CVE-2019-5010 - Denial of ServiceAlexandru Ardelean2019-02-121-0/+120
| | | | | | | | | | This patch addresses issue: [ssl][CVE-2019-5010] TALOS-2018-0758 Denial of Service Link to Python issue: https://bugs.python.org/issue35746 Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: enable lib2to3 to also search and fix .pyc files.Nj Hsiong2019-01-091-0/+17
| | | | | | python3's lib2to3 would fail in silence if python3 and its packages are installed as compiled .pyc files. Root cause is, in Lib/lib2to3/refactor.py, the function get_all_fix_names only searches '.py' fix names. Signed-off-by: Nj Hsiong <nj.hsiong@gmail.com>
* python3: bump to version 3.7.1Alexandru Ardelean2018-11-021-12/+0
| | | | | | | | | | | | This change bumps Python3 version to 3.7.1. Patch `002-fix-implicit-dh-free-declaration.patch` is now included in upstream. This also fixes CVE-2018-1061. https://www.cvedetails.com/cve/CVE-2018-1061/ Compile & run-tested on x86. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: fix build with SSL moduleAlexandru Ardelean2018-09-171-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | No idea how this creeped up. Probably OpenSSL been has updated recently. Will send this patch upstream as well, but in the meantime we should fix the Python3 build. Build error seems to be: ``` <openwrt>/build_dir/target-i386_pentium4_musl/Python-3.7.0/Modules/_ssl.c:4000:5: error: implicit declaration of function 'DH_free'; did you mean 'lh_free'? [-Werror=implicit-function-declaration] DH_free(dh); ^~~~~~~ lh_free cc1: some warnings being treated as errors Python build finished successfully! The necessary bits to build these optional modules were not found: _tkinter _uuid nis To find the necessary bits, look in setup.py in detect_modules() for the module's name. The following modules found by detect_modules() in setup.py, have been built by the Makefile instead, as configured by the Setup files: _abc atexit pwd time zlib Failed to build these modules: _ssl Makefile:618: recipe for target 'sharedmods' failed ``` Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: update to python 3.7.0Martin Strobel2018-07-1110-35/+22
| | | | | | | | Fixes python3 host SSL build -> host-pip can use https:// urls again. Updates Pip to 10.0.1 rebased patches Signed-off-by: Martin Strobel <arctus@crza.de>
* python3: update to version 3.6.5Alexandru Ardelean2018-05-033-15/+6
| | | | | | | Add PKG_RELEASE for setuptools and pip. Refresh all patches. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python,python3: honour the SOURCE_DATE_EPOCH for the build-infoAlexandru Ardelean2018-01-081-0/+28
| | | | | | | | | | | | | | | | | | | | | The Modules/getbuildinfo.c allows the use of DATE and TIME macros to be defined via CFLAGS. These vars, control the build date & time when the interpreter is opened, and can be read via the `platform._sys_version()` function. So, a conversion from SOURCE_DATE_EPOCH to DATE & TIME is required at build-time. This is especially needed for `platform._sys_version()` to work. The installation of pip seems to rely on this. The logic has been adapted from: https://wiki.debian.org/ReproducibleBuilds/TimestampsProposal#Makefile Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: bump to version 3.6.4Alexandru Ardelean2017-12-317-53/+17
| | | | | | | | | | | | | | | | Re-worked patch `003-do-not-run-distutils-tests.patch` to reduce patch-size. Removed `011-fix-ncursesw-definition-colisions.patch` it is fixed upstream. Refreshed with `make package/python3/refresh` Resetting PKG_RELEASE to 1. This variable was never used for pip3 & setuptools, since VERSION is specified in the package definitions. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python,python3: add support for SOURCE_DATE_EPOCH varAlexandru Ardelean2017-12-201-0/+13
| | | | | | | | | | | | | See: https://github.com/openwrt/packages/issues/5278 This should make Python & Python3 packages reproducible when building. In my local tests, I got the same sha256 for a sample .pyc file, so likely this is the solution that should address this. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: bump to version 3.6.3Alexandru Ardelean2017-11-062-25/+0
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: refresh patches `make package/python3/refresh` cmdAlexandru Ardelean2017-07-2612-57/+22
| | | | | | | | This was a bit overdue. I did not know about this methodology. Reduces patch fuzz. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: upgrade to version 3.6.2Alexandru Ardelean2017-07-241-5/+5
| | | | Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python,python3: remove multi-arch support, and /usr/local pathsAlexandru Ardelean2017-07-192-12/+21
| | | | | | | This should hopefully reduce weird behaviour caused by the host system. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python3: fix distutils path to package when using bytecodesAlexandru Ardelean2017-06-121-0/+16
| | | | | | | | | | | | | | | | If there is only Python bytecodes, then the __init__.py script will be concatenated, and the __init__.pyc as well. This is becase this bit `path = os.path.join(path, '__init__'+extension)` is iterated twice. This is a bug in Python3, also because we ship bytecodes instead of source code [ with Python & Python3 ]. Python is not affected. Reported-by: Mirko Vogt <mirko@nanl.de> Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
* python packages: move all things python under lang/pythonAlexandru Ardelean2017-05-1711-0/+265
I admit this may be be a bit aggressive, but the lang folder is getting cluttered/filled up with Python, PHP, Perl, Ruby, etc. packages. Makes sense to try to group them into per-lang folders. I took the Pythons. Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
generated by cgit (git 2.46.0) at 2026-10-12 09:51:20 +0000