summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/python
AgeCommit message (Collapse)Author
2021-06-15python3: fix CVE-2021-23336timo/dunfell/python3-CVE-2021-23336Lee Chee Yang
From: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> """ The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. """ References: https://nvd.nist.gov/vuln/detail/CVE-2021-23336 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336 Signed-off-by: Tim Orling <timothy.t.orling@intel.com>
2021-05-14python3-jinja2: 2.11.2 -> 2.11.3Lee Chee Yang
updates include fix for CVE-2020-28493 changelog: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-11meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda Bassey
Added missing HOMEPAGE and DESCRIPTION found using the test command `oe-selftest -r distrodata.Distrodata.test_missing_homepg` [YOCTO #13471] Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7290b773486da3888f848abf0dba747f2d9f42e1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-09python3-jinja2: set CVE_PRODUCTChen Qi
Set CVE_PRODUCT for more accurate CVE scanning. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit aefcc7a7dd012530ed846292caaed70d20589a3a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-05meta/recipes-devtools: Add HOMEPAGE / DESCRIPTIONDorinda
Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bb05814335e7101bfd8df0a11dc18a044e867bed) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-05python3: fix CVE-2021-3177Anuj Mittal
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 25d1cae49e56797c4c9e91c01697c4de02dee046) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-12python3-pycairo: use python3targetconfigAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dadf001c85938b831def8da5851a40dc0977e3d0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-02-04python3: Use addtask statement instead of task dependenciesTomasz Dziendzielski
The externalsrc class deletes do_patch task which results with: | ERROR: Task do_create_manifest in <PATH>/python3_3.8.2.bb depends upon | non-existent task do_patch in <PATH>/python3_3.8.2.bb Use addtask to define correct order to prevent this error, since addtask mechanism accepts deleted tasks. [YOCTO #14151] Signed-off-by: Tomasz Dziendzielski <tomasz.dziendzielski@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a746d034fa7eaad4f4876fa61c5a8c3c15e211c8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-01-29python3: Avoid installing test data into recipe-sysrootRichard Purdie
There are several thousand files in the test directory which we don't need. Adding these for the native and target sysroots is a crazy amount of files to be throwing around needlessly. Delete the files from the sysroot side of things to tidy up the sysroots and improve performance. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6bced03011ad1663d68b0322a2f8aeb4d836646) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-12-11python3: fix CVE-2019-20907Andrej Valek
- move fixing patch for CVE-2020-8492 to the right location Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-11-30python3: add CVE-2007-4559 to whitelistRoss Burton
This issue describes expected behaviour, do not use tarfile with untrusted data. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f4c22e83f2e68ff157da5ea1303acc2931d63f5f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-11-19python3: fix CVE-2020-27619Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-11-19python3: whitelist CVE-2020-15523Lee Chee Yang
This CVE is issue on _Py_CheckPython3 uses uninitialized dllpath when embedder sets module path with Py_SetPath. Since it is .dll issue (on windows only), hence whitelist it. https://bugs.python.org/issue29778 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-11-17python3: add ldconfig rdepends for python3-ctypesMingli Yu
The ctypes module needs to use "ldconfig -p" to find the library path and it simply has below logic if no ldconfig installed. except OSError: pass Before the patch: >>> from ctypes.util import find_library >>> lib_path = find_library('archive') >>> print(lib_path) None After the patch: >>> from ctypes.util import find_library >>> lib_path = find_library('archive') >>> print(lib_path) libarchive.so.13 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ddb96902a124a6e1f035f0fd868b0139989bc1bc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-10-20python3: fix CVE-2020-26116Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-09-30meta: add/fix invalid Upstream-Status tagsRoss Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 630ce8130598e2bca7231ac28a7cc18b5b942544) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-09-28python3-jinja2: Import from meta-oe/meta-pythonRichard Purdie
This is used by some of the results handling code and needed as part of buildtools tarball on various autobuilder worker for testing. ptest is disabled for OE-Core, at least for now since it depends on python3-pytest which in turn has may other dependencies. Acked-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b5156e95e9e80e3e0f7eea181cd12f85e03a111d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-09-28python3-markupsafe: Import from meta-oe/meta-pythonRichard Purdie
Needed as a dependency of python3-jinja2. ptest is disabled for OE-Core, at least for now since it depends on python3-pytest which in turn has may other dependencies. Acked-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Tim Orling <ticotimo@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a6f2727fd309b8b46a7ac1b8d99ae1d77a6ee74c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-07-06python3: fix CVE-2020-14422Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-07-06python3-libarchive-c: add the missing rdependsMingli Yu
Add the missing rdepends to fix below error: # python3 [snip] >>> import libarchive [snip] ModuleNotFoundError: No module named 'ctypes' ModuleNotFoundError: No module named 'mmap' Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b3a2615878bc7515a7bdace525dc27be45f158e2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-06-03python3-pyelftools: Upgrade 0.25 -> 0.26Joshua Watt
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0323e12624ef45e64e7a8ba6384c06e4d42df064) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-06-03python3-pycryptodome(x): Upgrade 3.9.4 -> 3.9.7Joshua Watt
Also splits apart the SRC_URI checksums to make automatic upgrades easier Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ae1f210546396b761ea86d9e32bf90c0867ff845) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-06-03pyelftools: Import from meta-pythonJoshua Watt
Imports the pyelftools recipes from meta-python, as of 7c02c7d41 ("gnome-themes-extra: correct the recipe name"). This recipe is commonly used by other layers, so moving it into OE-core helps to cut down on layer dependencies. Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 910ffaf5beed42936588c95b0c7c1b1ad67f99d3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-06-03pycryptodome: Import from meta-pythonJoshua Watt
Imports the pycryptodome recipes from meta-python, as of 7c02c7d41 ("gnome-themes-extra: correct the recipe name"). These recipes are commonly used by other layers, so moving them into OE-core helps to cut down on layer dependencies. Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a96f815c53364b119b5743b8b7100eb5588d5cf5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-05-21python3-setuptools: add the missing rdependsMingli Yu
Add the missing rdepends to fix below error: # python3 [snip] >>> import setuptools.lib2to3_ex [snip] ModuleNotFoundError: No module named 'lib2to3' ModuleNotFoundError: No module named 'pickle' Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit be5c3c989d75290863cc7aef9949cf6e82d3070f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-05-11python3-setuptools: add the missing rdependsMingli Yu
Add the missing rdepends to fix below error: # python3 [snip] >>> import setuptools [snip] ModuleNotFoundError: No module named 'json' Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-05-01python3: fix CVE-2020-8492Trevor Gamblin
CVE: CVE-2020-8492 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-04-30python3-manifest.json: add pathlib to coreTim Orling
The pathlib module is for Object-oriented filesystem paths It also provides a lot of handy utilities for checking on paths. This seems to justify adding it to the core package along side os, sys, and the other *path libraries. [YOCTO #13670] Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-03-30python3: fixing bpo-36852 patch for builds on i686 architectureMatthias Schoepfer
The original patch "bpo-36852: proper detection of mips architecture for soft float" uses AC_CANONICAL_TARGET to determine the platform triplet. While AC_CANONICAL_TARGET exports i686 as target_cpu, gcc is using i386 instead. We fall back here to i386, as it is conform to the previous behavior. Upstream Status: Submitted [https://github.com/python/cpython/pull/13196] Signed-off-by: Matthias Schoepfer <matthias.schoepfer@ithinx.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-13python: upgrade 3.8.1 -> 3.8.2Trevor Gamblin
THE LICENSE checksum changed in this update due to copyright notice added for 2020. Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-03-06python3-native: Should not search the system for headers/libraries.Jeremy Puhlman
The specific issue here is rpc/rpc.h, but its likely more general. /usr/include is searched for rpc/rpc.h and if it exists on the system, it changes behavior. If you are using the extended buildtools tarball on a machine that has /usr/include/rpc/rpc.h, it will decide that is good enough and not continue to search. nis fails to build because /usr/include and /usr/lib are not part of the include/link paths for the buildtools tarball compiler(nor should they be). This makes it so python3-native will not build if you are using the extended buildtools tarball, but from a larger issue perspective it is building in likely different ways depending on what machine it is building on. libtirpc is already a depend so we shouldn't need the hosts rpc/rcp.h. Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-29python3-scons: Fix license file collisionRichard Purdie
Downloading a file called "LICENSE" into DL_DIR is 'problematic' and collides with the file from other versions of the recipe at best. Rename it to something more specific to avoid collision problems. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-28python3-setuptools: upgrade 45.0.0 -> 45.2.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-28python3-mako: upgrade 1.1.0 -> 1.1.1Alexander Kanavin
License-Update: copyright years Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-28python3-docutils: upgrade 0.15 -> 0.16Alexander Kanavin
License-Update: formatting Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-28python3-scons{-native}: upgrade 3.1.1 -> 3.1.2Tim Orling
THis release is a mix of improvements and fixes: https://github.com/SCons/scons/blob/3.1.2/src/RELEASE.txt * Changed to inherit pypi rather than relying on SOURCEFORGE_MIRROR. * Add SRC_URI for LICENSE file (not included in pypi tarball). * Make it more obvious that RDEPENDS are for class-target and drop empty RDEPENDS from -native * python3-scons-native now DEPENDS on python3-setuptools-native * Tested with core-image-base + packagegroup-core-buildessential with "scons" oe-selftest via testimage. * Tested build of "serf" (which uses python3-scons-native via the scons.bbclass). License-Update: Added "MIT License" text, updated copyright years Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-18python3: resolve ncurses host contaminationAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-15python3-pycairo: upgrade 1.18.2 -> 1.19.0Wang Mingyu
-License-Update: "PDX-License-Identifier: LGPL-2.1-only OR MPL-1.1" is added Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-15python3-pip: upgrade 19.3.1 -> 20.0.2Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-14python3: install _tkinter.*.so to python3-tkinter packageYi Zhao
When enable PACKAGECONFIG[tk], we should install _tkinter.*.so to python3-tkinter package rather than python3-misc package. Fixes: ERROR: python3-3.8.1-r0 do_package_qa: QA Issue: /usr/lib/python3.8/lib-dynload/_tkinter.cpython-38-x86_64-linux-gnu.so contained in package python3-misc requires libtk8.6.so()(64bit), but no providers found in RDEPENDS_python3-misc? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-14python: Add magic recipeJoshua Watt
The python-magic module is used by diffoscope tool to make build comparisons. Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-14python: Add libarchive-c recipeJoshua Watt
The libarchive python module is used by diffoscope tool to make build comparisons. Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-08python3: Do not hardcode "lib" for distutilsChangqing Li
Get the sys.lib from python3 itself and do not use hardcoded value of 'lib' for distutils. Solve the error below that occurs when run "python3 setup.py install" on lib64 multilib platform: [Errno 2] No such file or directory: '/usr/lib/python3.7/site-packages/test-easy-install-1828.write-test' Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-08python3: fix the installation path of libpython3.7m.a for multilibChangqing Li
Fix the installation path of libpython3.7m.a on mulitlib lib64 platform to lib64 instead of lib Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-04python3-six: Move src_uri checks to recipe mainKhem Raj
.inc is used by other versions of recipe as well, therefore putting checksums in .inc will break them unless the version is same as in oe-core Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-03python3-six: upgrade 1.13.0 -> 1.14.0Alexander Kanavin
License-update: copyright years Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-03python3-git: upgrade 3.0.2 -> 3.0.5Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-03python3-setuptools: upgrade 42.0.2 -> 45.0.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-03python3-gitdb: upgrade 2.0.5 -> 2.0.6Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-27python: remove last remnants of python2Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-23 10:39:53 +0000