From 61e2aebcb5efc5daa57a82d76550b4022342a6dd Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Sun, 9 Feb 2025 00:23:19 +0100 Subject: python3: upgrade 3.12.8 -> 3.12.9 Release notes: https://docs.python.org/release/3.12.9/whatsnew/changelog.html#python-3-12-9 Solves CVE-2025-0938, CVE-2024-12254 and 3 other vulnerabilities without CVE number assigment. Add a patch to fix failure of a new test. (From OE-Core rev: cb0187ed2962e4c140c4f59ce08f94b18b05004c) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- ...void-shebang-overflow-on-python-config.py.patch | 2 +- ...ng-tests-due-to-load-variability-on-YP-AB.patch | 4 +- .../0001-ctypes-correct-gcc-check-in-test.patch | 53 +++ ...-cc_basename-to-replace-CC-for-checking-c.patch | 10 +- ...1-test_readline-skip-limited-history-test.patch | 4 +- ...c-setup.py-do-not-add-a-curses-include-pa.patch | 2 +- .../recipes-devtools/python/python3/makerace.patch | 2 +- meta/recipes-devtools/python/python3_3.12.8.bb | 476 -------------------- meta/recipes-devtools/python/python3_3.12.9.bb | 477 +++++++++++++++++++++ 9 files changed, 542 insertions(+), 488 deletions(-) create mode 100644 meta/recipes-devtools/python/python3/0001-ctypes-correct-gcc-check-in-test.patch delete mode 100644 meta/recipes-devtools/python/python3_3.12.8.bb create mode 100644 meta/recipes-devtools/python/python3_3.12.9.bb diff --git a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch index 3311a90bda..6e4930b9ec 100644 --- a/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch +++ b/meta/recipes-devtools/python/python3/0001-Avoid-shebang-overflow-on-python-config.py.patch @@ -19,7 +19,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index 2d235d2..1ac2263 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2354,6 +2354,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh +@@ -2355,6 +2355,8 @@ python-config: $(srcdir)/Misc/python-config.in Misc/python-config.sh @ # Substitution happens here, as the completely-expanded BINDIR @ # is not available in configure sed -e "s,@EXENAME@,$(EXENAME)," < $(srcdir)/Misc/python-config.in >python-config.py diff --git a/meta/recipes-devtools/python/python3/0001-Skip-failing-tests-due-to-load-variability-on-YP-AB.patch b/meta/recipes-devtools/python/python3/0001-Skip-failing-tests-due-to-load-variability-on-YP-AB.patch index 6779dd515a..ec3bb9cbbd 100644 --- a/meta/recipes-devtools/python/python3/0001-Skip-failing-tests-due-to-load-variability-on-YP-AB.patch +++ b/meta/recipes-devtools/python/python3/0001-Skip-failing-tests-due-to-load-variability-on-YP-AB.patch @@ -54,7 +54,7 @@ diff --git a/Lib/test/test_time.py b/Lib/test/test_time.py index 9463add..4e0f39d 100644 --- a/Lib/test/test_time.py +++ b/Lib/test/test_time.py -@@ -527,6 +527,7 @@ class TimeTestCase(unittest.TestCase): +@@ -536,6 +536,7 @@ class TimeTestCase(unittest.TestCase): @unittest.skipIf( support.is_wasi, "process_time not available on WASI" ) @@ -62,7 +62,7 @@ index 9463add..4e0f39d 100644 def test_process_time(self): # process_time() should not include time spend during a sleep start = time.process_time() -@@ -540,6 +541,7 @@ class TimeTestCase(unittest.TestCase): +@@ -549,6 +550,7 @@ class TimeTestCase(unittest.TestCase): self.assertTrue(info.monotonic) self.assertFalse(info.adjustable) diff --git a/meta/recipes-devtools/python/python3/0001-ctypes-correct-gcc-check-in-test.patch b/meta/recipes-devtools/python/python3/0001-ctypes-correct-gcc-check-in-test.patch new file mode 100644 index 0000000000..3dd762e519 --- /dev/null +++ b/meta/recipes-devtools/python/python3/0001-ctypes-correct-gcc-check-in-test.patch @@ -0,0 +1,53 @@ +From 2e2a0c8593a38f2020cc2baeeaa7972eb86773f9 Mon Sep 17 00:00:00 2001 +From: Peter Marko +Date: Sat, 8 Feb 2025 23:57:17 +0100 +Subject: [PATCH] ctypes: correct gcc check in test + +In case gcc is not available, it will throw exception and test fails. +So chatch the exception to skip the test correctly. + +====================================================================== +ERROR: test_null_dlsym (test.test_ctypes.test_dlerror.TestNullDlsym.test_null_dlsym) +---------------------------------------------------------------------- +Traceback (most recent call last): + File "/usr/lib/python3.12/test/test_ctypes/test_dlerror.py", line 61, in test_null_dlsym + retcode = subprocess.call(["gcc", "--version"], + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "/usr/lib/python3.12/subprocess.py", line 391, in call + with Popen(*popenargs, **kwargs) as p: + ^^^^^^^^^^^^^^^^^^^^^^^^^^^ + File "/usr/lib/python3.12/subprocess.py", line 1028, in __init__ + self._execute_child(args, executable, preexec_fn, close_fds, + File "/usr/lib/python3.12/subprocess.py", line 1963, in _execute_child + raise child_exception_type(errno_num, err_msg, err_filename) +FileNotFoundError: [Errno 2] No such file or directory: 'gcc' + +Upstream-Status: Submitted [https://github.com/python/cpython/pull/129872] +Signed-off-by: Peter Marko +--- + Lib/test/test_ctypes/test_dlerror.py | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/Lib/test/test_ctypes/test_dlerror.py b/Lib/test/test_ctypes/test_dlerror.py +index 6bf492399cb..56eb7622b4d 100644 +--- a/Lib/test/test_ctypes/test_dlerror.py ++++ b/Lib/test/test_ctypes/test_dlerror.py +@@ -58,11 +58,14 @@ def test_null_dlsym(self): + import subprocess + import tempfile + +- retcode = subprocess.call(["gcc", "--version"], +- stdout=subprocess.DEVNULL, +- stderr=subprocess.DEVNULL) +- if retcode != 0: ++ try: ++ retcode = subprocess.call(["gcc", "--version"], ++ stdout=subprocess.DEVNULL, ++ stderr=subprocess.DEVNULL) ++ except: + self.skipTest("gcc is missing") ++ if retcode != 0: ++ self.skipTest("gcc is not working") + + pipe_r, pipe_w = os.pipe() + self.addCleanup(os.close, pipe_r) diff --git a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch index c9ef409018..5a1f9ffccf 100644 --- a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch +++ b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch @@ -73,7 +73,7 @@ index 9270b5f..955daad 100644 *clang*) # Any changes made here should be reflected in the GCC+Darwin case below PGO_PROF_GEN_FLAG="-fprofile-instr-generate" -@@ -2158,7 +2159,7 @@ AC_MSG_RESULT([$BOLT_APPLY_FLAGS]) +@@ -2179,7 +2180,7 @@ AC_MSG_RESULT([$BOLT_APPLY_FLAGS]) # compiler and platform. BASECFLAGS tweaks need to be made even if the # user set OPT. @@ -82,7 +82,7 @@ index 9270b5f..955daad 100644 *clang*) cc_is_clang=1 ;; -@@ -2430,7 +2431,7 @@ yes) +@@ -2451,7 +2452,7 @@ yes) # ICC doesn't recognize the option, but only emits a warning ## XXX does it emit an unused result warning and can it be disabled? @@ -91,7 +91,7 @@ index 9270b5f..955daad 100644 [*icc*], [ac_cv_disable_unused_result_warning=no] [PY_CHECK_CC_WARNING([disable], [unused-result])]) AS_VAR_IF([ac_cv_disable_unused_result_warning], [yes], -@@ -2676,7 +2677,7 @@ yes) +@@ -2697,7 +2698,7 @@ yes) ;; esac @@ -100,7 +100,7 @@ index 9270b5f..955daad 100644 *mpicc*) CFLAGS_NODIST="$CFLAGS_NODIST" ;; -@@ -3511,7 +3512,7 @@ then +@@ -3532,7 +3533,7 @@ then then LINKFORSHARED="-Wl,--export-dynamic" fi;; @@ -109,7 +109,7 @@ index 9270b5f..955daad 100644 *gcc*) if $CC -Xlinker --help 2>&1 | grep export-dynamic >/dev/null then -@@ -6832,7 +6833,7 @@ if test "$ac_cv_gcc_asm_for_x87" = yes; then +@@ -6853,7 +6854,7 @@ if test "$ac_cv_gcc_asm_for_x87" = yes; then # Some versions of gcc miscompile inline asm: # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=46491 # http://gcc.gnu.org/ml/gcc/2010-11/msg00366.html diff --git a/meta/recipes-devtools/python/python3/0001-test_readline-skip-limited-history-test.patch b/meta/recipes-devtools/python/python3/0001-test_readline-skip-limited-history-test.patch index 3568d92bda..f9dc0ddcda 100644 --- a/meta/recipes-devtools/python/python3/0001-test_readline-skip-limited-history-test.patch +++ b/meta/recipes-devtools/python/python3/0001-test_readline-skip-limited-history-test.patch @@ -20,7 +20,7 @@ diff --git a/Lib/test/test_readline.py b/Lib/test/test_readline.py index fab124a..291dd48 100644 --- a/Lib/test/test_readline.py +++ b/Lib/test/test_readline.py -@@ -133,6 +133,7 @@ class TestHistoryManipulation (unittest.TestCase): +@@ -141,6 +141,7 @@ class TestHistoryManipulation (unittest.TestCase): self.assertEqual(readline.get_history_item(1), "entrée 1") self.assertEqual(readline.get_history_item(2), "entrée 22") @@ -28,7 +28,7 @@ index fab124a..291dd48 100644 def test_write_read_limited_history(self): previous_length = readline.get_history_length() self.addCleanup(readline.set_history_length, previous_length) -@@ -371,6 +372,7 @@ readline.write_history_file(history_file) +@@ -379,6 +380,7 @@ readline.write_history_file(history_file) self.assertIn(b"done", output) diff --git a/meta/recipes-devtools/python/python3/0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch b/meta/recipes-devtools/python/python3/0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch index f5e500b146..e917c8bdf0 100644 --- a/meta/recipes-devtools/python/python3/0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch +++ b/meta/recipes-devtools/python/python3/0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch @@ -18,7 +18,7 @@ diff --git a/configure.ac b/configure.ac index 6e465a4..13c4835 100644 --- a/configure.ac +++ b/configure.ac -@@ -6537,12 +6537,6 @@ AS_VAR_IF([have_panel], [no], [ +@@ -6558,12 +6558,6 @@ AS_VAR_IF([have_panel], [no], [ AC_MSG_RESULT([$have_panel (CFLAGS: $PANEL_CFLAGS, LIBS: $PANEL_LIBS)]) ]) diff --git a/meta/recipes-devtools/python/python3/makerace.patch b/meta/recipes-devtools/python/python3/makerace.patch index f420404f34..862b648685 100644 --- a/meta/recipes-devtools/python/python3/makerace.patch +++ b/meta/recipes-devtools/python/python3/makerace.patch @@ -20,7 +20,7 @@ diff --git a/Makefile.pre.in b/Makefile.pre.in index dce36a5..2d235d2 100644 --- a/Makefile.pre.in +++ b/Makefile.pre.in -@@ -2265,7 +2265,7 @@ COMPILEALL_OPTS=-j0 +@@ -2266,7 +2266,7 @@ COMPILEALL_OPTS=-j0 TEST_MODULES=@TEST_MODULES@ .PHONY: libinstall diff --git a/meta/recipes-devtools/python/python3_3.12.8.bb b/meta/recipes-devtools/python/python3_3.12.8.bb deleted file mode 100644 index fddb29b271..0000000000 --- a/meta/recipes-devtools/python/python3_3.12.8.bb +++ /dev/null @@ -1,476 +0,0 @@ -SUMMARY = "The Python Programming Language" -HOMEPAGE = "http://www.python.org" -DESCRIPTION = "Python is a programming language that lets you work more quickly and integrate your systems more effectively." -LICENSE = "PSF-2.0" -SECTION = "devel/python" - -LIC_FILES_CHKSUM = "file://LICENSE;md5=fcf6b249c2641540219a727f35d8d2c2" - -SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ - file://run-ptest \ - file://create_manifest3.py \ - file://get_module_deps3.py \ - file://python3-manifest.json \ - file://check_build_completeness.py \ - file://reformat_sysconfig.py \ - file://cgi_py.patch \ - file://0001-Makefile.pre-use-qemu-wrapper-when-gathering-profile.patch \ - file://0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch \ - file://crosspythonpath.patch \ - file://0001-test_locale.py-correct-the-test-output-format.patch \ - file://0020-configure.ac-setup.py-do-not-add-a-curses-include-pa.patch \ - file://0001-Skip-failing-tests-due-to-load-variability-on-YP-AB.patch \ - file://0001-test_ctypes.test_find-skip-without-tools-sdk.patch \ - file://makerace.patch \ - file://0001-sysconfig.py-use-platlibdir-also-for-purelib.patch \ - file://0001-Lib-pty.py-handle-stdin-I-O-errors-same-way-as-maste.patch \ - file://deterministic_imports.patch \ - file://0001-Avoid-shebang-overflow-on-python-config.py.patch \ - file://0001-Update-test_sysconfig-for-posix_user-purelib.patch \ - file://0001-skip-no_stdout_fileno-test-due-to-load-variability.patch \ - file://0001-test_storlines-skip-due-to-load-variability.patch \ - file://0001-test_shutdown-skip-problematic-test.patch \ - file://0001-gh-107811-tarfile-treat-overflow-in-UID-GID-as-failu.patch \ - file://0001-test_deadlock-skip-problematic-test.patch \ - file://0001-test_active_children-skip-problematic-test.patch \ - file://0001-test_readline-skip-limited-history-test.patch \ - " - -SRC_URI:append:class-native = " \ - file://0001-Lib-sysconfig.py-use-prefix-value-from-build-configu.patch \ - " - -SRC_URI[sha256sum] = "c909157bb25ec114e5869124cc2a9c4a4d4c1e957ca4ff553f1edc692101154e" - -# exclude pre-releases for both python 2.x and 3.x -UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P\d+(\.\d+)+).tar" - -CVE_PRODUCT = "python cpython" - -CVE_STATUS[CVE-2007-4559] = "disputed: Upstream consider this expected behaviour" -CVE_STATUS[CVE-2019-18348] = "not-applicable-config: This is not exploitable when glibc has CVE-2016-10739 fixed" -CVE_STATUS[CVE-2020-15523] = "not-applicable-platform: Issue only applies on Windows" -CVE_STATUS[CVE-2022-26488] = "not-applicable-platform: Issue only applies on Windows" -# The module will be removed in the future and flaws documented. -CVE_STATUS[CVE-2015-20107] = "upstream-wontfix: The mailcap module is insecure by design, so this can't be fixed in a meaningful way" -CVE_STATUS[CVE-2023-36632] = "disputed: Not an issue, in fact expected behaviour" - -PYTHON_MAJMIN = "3.12" - -S = "${WORKDIR}/Python-${PV}" - -BBCLASSEXTEND = "native nativesdk" - -inherit autotools pkgconfig qemu ptest multilib_header update-alternatives - -MULTILIB_SUFFIX = "${@d.getVar('base_libdir',1).split('/')[-1]}" - -ALTERNATIVE:${PN}-dev = "python3-config" -ALTERNATIVE_LINK_NAME[python3-config] = "${bindir}/python${PYTHON_MAJMIN}-config" -ALTERNATIVE_TARGET[python3-config] = "${bindir}/python${PYTHON_MAJMIN}-config-${MULTILIB_SUFFIX}" - - -DEPENDS = "bzip2-replacement-native expat libffi bzip2 openssl sqlite3 zlib virtual/libintl xz virtual/crypt util-linux-libuuid libtirpc libnsl2 autoconf-archive-native ncurses" -DEPENDS:append:class-target = " python3-native" -DEPENDS:append:class-nativesdk = " python3-native" - -EXTRA_OECONF = " --without-ensurepip --enable-shared --with-platlibdir=${baselib} --with-system-expat" -EXTRA_OECONF:append:class-native = " --bindir=${bindir}/${PN}" -EXTRA_OECONF:append:class-target = " --with-build-python=nativepython3" -EXTRA_OECONF:append:class-nativesdk = " --with-build-python=nativepython3" - -export CROSSPYTHONPATH="${STAGING_LIBDIR_NATIVE}/python${PYTHON_MAJMIN}/lib-dynload/" - -EXTRANATIVEPATH += "python3-native" - -# LTO will be enabled via packageconfig depending upong distro features -LTO:class-target = "" - -CACHED_CONFIGUREVARS = " \ - ac_cv_file__dev_ptmx=yes \ - ac_cv_file__dev_ptc=no \ - ac_cv_working_tzset=yes \ -" -# set thread stack size to 2MB on musl for interpreter and stdlib C extensions -# so it does not run into stack limits due to musl's small thread stack -# This is only needed to build interpreter and not the subsequent modules -# Thats why CFLAGS_NODIST is modified instead of CFLAGS -CACHED_CONFIGUREVARS:append:libc-musl = "\ - CFLAGS_NODIST='${CFLAGS} -DTHREAD_STACK_SIZE=0x200000' \ -" - -# PGO currently causes builds to not be reproducible so disable by default, see YOCTO #13407 -PACKAGECONFIG ??= "editline gdbm ${@bb.utils.filter('DISTRO_FEATURES', 'lto', d)}" -PACKAGECONFIG[readline] = "--with-readline=readline,,readline,,,editline" -PACKAGECONFIG[editline] = "--with-readline=editline,,libedit,,,readline" -# Use profile guided optimisation by running PyBench inside qemu-user -PACKAGECONFIG[pgo] = "--enable-optimizations,,qemu-native" -PACKAGECONFIG[tk] = ",,tk" -PACKAGECONFIG[tcl] = ",,tcl" -PACKAGECONFIG[gdbm] = ",,gdbm" -PACKAGECONFIG[lto] = "--with-lto,--without-lto" -PACKAGECONFIG[staticlibpython] = "--with-static-libpython,--without-static-libpython" - -do_configure:prepend () { - mkdir -p ${B}/Modules - cat > ${B}/Modules/Setup.local << EOF -*disabled* -${@bb.utils.contains('PACKAGECONFIG', 'gdbm', '', '_gdbm _dbm', d)} -${@bb.utils.contains_any('PACKAGECONFIG', 'readline editline', '', 'readline', d)} -${@bb.utils.contains('PACKAGECONFIG', 'tk', '', '_tkinter', d)} -EOF -} - -CPPFLAGS += "-I${STAGING_INCDIR}/ncursesw -I${STAGING_INCDIR}/uuid" - -# COMPILEALL_OPTS= ensures that .pyc are not compiled in parallel -# This was found to lock up builds, break reproducibility, and produce strange file ownership -# races. -# -# The upstream commit introducing the change was: -# https://github.com/python/cpython/commit/1a2dd82f56bd813aacc570e172cefe55a8a41504 -# -# The build lock up issue is reported here: -# https://bugs.python.org/issue45945 -# -# The repro failures are documented here: -# https://autobuilder.yocto.io/pub/repro-fail/oe-reproducible-20211130-yr_o1a8d/packages/diff-html/ - -EXTRA_OEMAKE = '\ - STAGING_LIBDIR=${STAGING_LIBDIR} \ - STAGING_INCDIR=${STAGING_INCDIR} \ - LIB=${baselib} \ - COMPILEALL_OPTS= \ -' - -# Generate a Profile Guided Optimisation wrapper script that uses qemu-user for -# all cross builds. -write_pgo_wrapper:class-native = ":" -write_pgo_wrapper() { - if ${@bb.utils.contains('PACKAGECONFIG', 'pgo', 'true', 'false', d)}; then - cat >pgo-wrapper < ${B}/Modules/Setup.local << EOF +*disabled* +${@bb.utils.contains('PACKAGECONFIG', 'gdbm', '', '_gdbm _dbm', d)} +${@bb.utils.contains_any('PACKAGECONFIG', 'readline editline', '', 'readline', d)} +${@bb.utils.contains('PACKAGECONFIG', 'tk', '', '_tkinter', d)} +EOF +} + +CPPFLAGS += "-I${STAGING_INCDIR}/ncursesw -I${STAGING_INCDIR}/uuid" + +# COMPILEALL_OPTS= ensures that .pyc are not compiled in parallel +# This was found to lock up builds, break reproducibility, and produce strange file ownership +# races. +# +# The upstream commit introducing the change was: +# https://github.com/python/cpython/commit/1a2dd82f56bd813aacc570e172cefe55a8a41504 +# +# The build lock up issue is reported here: +# https://bugs.python.org/issue45945 +# +# The repro failures are documented here: +# https://autobuilder.yocto.io/pub/repro-fail/oe-reproducible-20211130-yr_o1a8d/packages/diff-html/ + +EXTRA_OEMAKE = '\ + STAGING_LIBDIR=${STAGING_LIBDIR} \ + STAGING_INCDIR=${STAGING_INCDIR} \ + LIB=${baselib} \ + COMPILEALL_OPTS= \ +' + +# Generate a Profile Guided Optimisation wrapper script that uses qemu-user for +# all cross builds. +write_pgo_wrapper:class-native = ":" +write_pgo_wrapper() { + if ${@bb.utils.contains('PACKAGECONFIG', 'pgo', 'true', 'false', d)}; then + cat >pgo-wrapper <