commit: 3dbd956b4363bab8ab06697f5e6a797a348fab0f Author: Michał Górny <mgorny <AT> gentoo <DOT> org> AuthorDate: Sun Feb 26 20:01:25 2023 +0000 Commit: Michał Górny <mgorny <AT> gentoo <DOT> org> CommitDate: Sun Feb 26 20:11:15 2023 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3dbd956b
dev-lang/python: Backport CVE-2023-24329 fix to 3.8.16_p3 Bug: https://bugs.gentoo.org/897958 Signed-off-by: Michał Górny <mgorny <AT> gentoo.org> dev-lang/python/Manifest | 1 + dev-lang/python/python-3.8.16_p3.ebuild | 425 ++++++++++++++++++++++++++++++++ 2 files changed, 426 insertions(+) diff --git a/dev-lang/python/Manifest b/dev-lang/python/Manifest index 485f7b7b55e2..76cdea07b865 100644 --- a/dev-lang/python/Manifest +++ b/dev-lang/python/Manifest @@ -25,5 +25,6 @@ DIST python-gentoo-patches-3.11.2_p1.tar.xz 7788 BLAKE2B 9652c46cd323958a43e26fd DIST python-gentoo-patches-3.12.0a4.tar.xz 8504 BLAKE2B 1257c1fe428fc967ef7d3107f99e4fcef0758a2bfa5b345bf69bb47bc0af1644b449f2b11b61148a8f79ed583a80365432d78ec4bade3d92070f08ad2ff568c2 SHA512 142f5d2ee8c1beeb6084bb6b48a0bbdcde907f48f514ac7743f0e6898a761696bb7788861fcb5c938cc36f212d444ddcfe874880ac8b4d0d54bc8ec04b166ca0 DIST python-gentoo-patches-3.12.0a5.tar.xz 7704 BLAKE2B 7224d3e4318313183a10dc0d4fa73ab589b9de8096945750f31d45371b926f7e2cbeb2c672c254e369f04bb5588a79335ceea2e3ce4968e76f70206bdc3c9672 SHA512 951d6fd25e113bf29fb334a9162bc132d27a8c3186c8b6cbaddfbdea8ccd221fe126d09cf7c6df59942d49dac8561a4e168468daa0e7cd0d0d3a925166b4d835 DIST python-gentoo-patches-3.8.16_p2.tar.xz 30888 BLAKE2B c1816cd8b043b9aa3629a7753b7a9afa7c9af5d35b81954113af40632c97dabaa2148f0b920d9a37e8f4ebeadc1d76788a904c254ea842ea1062d552d2208e8e SHA512 6383c3f07fc7d6f37bb0cf9af27544323784eb2ded9b6f7913f3f59f5011ccb5615fb1adcc9eb3f9a58a98b7a2c24393bfbeef0b85728d77404621e29cb72656 +DIST python-gentoo-patches-3.8.16_p3.tar.xz 31900 BLAKE2B ae3787f223407c34c1a8c442c0e05bea8307cbace6140dc0ed08085d4a507bc2b6307cb89efa738750affc29320a3ec562fef5c066804abe25a856e4cbe88685 SHA512 df90a99b316c967a1176909a47450b02f771ded695b5f63486d85da7ff5755a27b9410b71bd27fb4217f8555e278c91bd88db53a9108aa84559bfbfd0ce4e5e7 DIST python-gentoo-patches-3.9.16_p1.tar.xz 25564 BLAKE2B e6b7f20bb0457011d74f441d58eb0c9c4426a61bf0f8a2146f0180104c7b8b5054a04afc664374a17f3770d3ae94836099c362e841e4c00631a75fc56a2b352d SHA512 43f473dba8f6bd19c6a30f169ec8e8abb9eefe7d26c357884ee27cabf1b5876c079ea0e9454b9e52021d15f070e0a824e3366cfde20d57175f5f89774ee50a5b DIST python-gentoo-patches-3.9.16_p2.tar.xz 26664 BLAKE2B 7176c58fd4bfe40489de33d67a0c106f9d170656e6ae47318b103ac45a4e0aca14e89790300c3881a3c9b8ca556996573621eb5dac0a71106ea0ae9bbf3e82c2 SHA512 792fcd53385d95e3ba5937b26099fcc19e62d3512783c25e734ee0cd153c8717e618dba010dd98b8647d3265bf94e40665e30494aae1a84181febbd7dbab3f36 diff --git a/dev-lang/python/python-3.8.16_p3.ebuild b/dev-lang/python/python-3.8.16_p3.ebuild new file mode 100644 index 000000000000..039847af9b3a --- /dev/null +++ b/dev-lang/python/python-3.8.16_p3.ebuild @@ -0,0 +1,425 @@ +# Copyright 1999-2023 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI="7" +WANT_LIBTOOL="none" + +inherit autotools flag-o-matic multiprocessing pax-utils +inherit prefix python-utils-r1 toolchain-funcs verify-sig + +MY_PV=${PV/_rc/rc} +MY_P="Python-${MY_PV%_p*}" +PYVER=$(ver_cut 1-2) +PATCHSET="python-gentoo-patches-${MY_PV}" + +DESCRIPTION="An interpreted, interactive, object-oriented programming language" +HOMEPAGE=" + https://www.python.org/ + https://github.com/python/cpython/ +" +SRC_URI=" + https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz + https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz + verify-sig? ( + https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc + ) +" +S="${WORKDIR}/${MY_P}" + +LICENSE="PSF-2" +SLOT="${PYVER}" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" +IUSE=" + bluetooth build +ensurepip examples gdbm hardened lto +ncurses pgo + +readline +sqlite +ssl test tk valgrind wininst +xml +" +RESTRICT="!test? ( test )" + +# Do not add a dependency on dev-lang/python to this ebuild. +# If you need to apply a patch which requires python for bootstrapping, please +# run the bootstrap code on your dev box and include the results in the +# patchset. See bug 447752. + +RDEPEND=" + app-arch/bzip2:= + app-arch/xz-utils:= + dev-libs/libffi:= + sys-apps/util-linux:= + >=sys-libs/zlib-1.1.3:= + virtual/libcrypt:= + virtual/libintl + ensurepip? ( dev-python/ensurepip-wheels ) + gdbm? ( sys-libs/gdbm:=[berkdb] ) + ncurses? ( >=sys-libs/ncurses-5.2:= ) + readline? ( >=sys-libs/readline-4.1:= ) + sqlite? ( >=dev-db/sqlite-3.3.8:3= ) + ssl? ( >=dev-libs/openssl-1.1.1:= ) + tk? ( + >=dev-lang/tcl-8.0:= + >=dev-lang/tk-8.0:= + dev-tcltk/blt:= + dev-tcltk/tix + ) + xml? ( >=dev-libs/expat-2.1:= ) +" +# bluetooth requires headers from bluez +DEPEND=" + ${RDEPEND} + bluetooth? ( net-wireless/bluez ) + test? ( app-arch/xz-utils[extra-filters(+)] ) + valgrind? ( dev-util/valgrind ) +" +# autoconf-archive needed to eautoreconf +BDEPEND=" + sys-devel/autoconf-archive + app-alternatives/awk + virtual/pkgconfig + verify-sig? ( sec-keys/openpgp-keys-python ) +" +RDEPEND+=" + !build? ( app-misc/mime-types ) +" + +VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc + +QA_PKGCONFIG_VERSION=${PYVER} + +src_unpack() { + if use verify-sig; then + verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc} + fi + default +} + +src_prepare() { + # Ensure that internal copies of expat and libffi are not used. + rm -r Modules/expat || die + rm -r Modules/_ctypes/libffi* || die + + local PATCHES=( + "${WORKDIR}/${PATCHSET}" + ) + + default + + # https://bugs.gentoo.org/850151 + sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die + + # force the correct number of jobs + # https://bugs.gentoo.org/737660 + local jobs=$(makeopts_jobs) + sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die + sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die + + if ! use wininst; then + rm Lib/distutils/command/wininst*.exe || die + fi + + eautoreconf +} + +src_configure() { + # disable automagic bluetooth headers detection + if ! use bluetooth; then + local -x ac_cv_header_bluetooth_bluetooth_h=no + fi + local disable + use gdbm || disable+=" gdbm" + use ncurses || disable+=" _curses _curses_panel" + use readline || disable+=" readline" + use sqlite || disable+=" _sqlite3" + use ssl || export PYTHON_DISABLE_SSL="1" + use tk || disable+=" _tkinter" + use xml || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat. + export PYTHON_DISABLE_MODULES="${disable}" + + if ! use xml; then + ewarn "You have configured Python without XML support." + ewarn "This is NOT a recommended configuration as you" + ewarn "may face problems parsing any XML documents." + fi + + if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then + einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}" + fi + + append-flags -fwrapv + + filter-flags -malign-double + + # https://bugs.gentoo.org/700012 + if is-flagq -flto || is-flagq '-flto=*'; then + append-cflags $(test-flags-CC -ffat-lto-objects) + fi + + # Export CXX so it ends up in /usr/lib/python3.X/config/Makefile. + # PKG_CONFIG needed for cross. + tc-export CXX PKG_CONFIG + + local dbmliborder= + if use gdbm; then + dbmliborder+="${dbmliborder:+:}gdbm" + fi + + local myeconfargs=( + # glibc-2.30 removes it; since we can't cleanly force-rebuild + # Python on glibc upgrade, remove it proactively to give + # a chance for users rebuilding python before glibc + ac_cv_header_stropts_h=no + + --enable-shared + --enable-ipv6 + --infodir='${prefix}/share/info' + --mandir='${prefix}/share/man' + --with-computed-gotos + --with-dbmliborder="${dbmliborder}" + --with-libc= + --enable-loadable-sqlite-extensions + --without-ensurepip + --with-system-expat + --with-system-ffi + --with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip + + $(use_with valgrind) + ) + + # disable implicit optimization/debugging flags + local -x OPT= + + if tc-is-cross-compiler ; then + # Hack to workaround get_libdir not being able to handle CBUILD, bug #794181 + local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi) + + # pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get + # propagated to sysconfig for built extensions + local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD} + local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD} + local -x CFLAGS= LDFLAGS= + + # We need to build our own Python on CBUILD first, and feed it in. + # bug #847910 and bug #864911. + local myeconfargs_cbuild=( + "${myeconfargs[@]}" + + --libdir="${cbuild_libdir:2}" + + # Avoid needing to load the right libpython.so. + --disable-shared + + # As minimal as possible for the mini CBUILD Python + # we build just for cross. + --without-lto + --disable-optimizations + ) + + # Point the imminent CHOST build to the Python we just + # built for CBUILD. + export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}" + + mkdir "${WORKDIR}"/${P}-${CBUILD} || die + pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die + # We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating + # libdir correctly for cross. + PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \ + ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}" + + # Avoid as many dependencies as possible for the cross build. + cat >> Makefile <<-EOF || die + MODULE_NIS=disabled + MODULE__DBM=disabled + MODULE__GDBM=disabled + MODULE__DBM=disabled + MODULE__SQLITE3=disabled + MODULE__HASHLIB=disabled + MODULE__SSL=disabled + MODULE__CURSES=disabled + MODULE__CURSES_PANEL=disabled + MODULE_READLINE=disabled + MODULE__TKINTER=disabled + MODULE_PYEXPAT=disabled + MODULE_ZLIB=disabled + EOF + + # Unfortunately, we do have to build this immediately, and + # not in src_compile, because CHOST configure for Python + # will check the existence of the Python it was pointed to + # immediately. + PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake + popd &> /dev/null || die + fi + + # pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get + # propagated to sysconfig for built extensions + local -x CFLAGS_NODIST=${CFLAGS} + local -x LDFLAGS_NODIST=${LDFLAGS} + local -x CFLAGS= LDFLAGS= + + # Fix implicit declarations on cross and prefix builds. Bug #674070. + if use ncurses; then + append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw + fi + + hprefixify setup.py + econf "${myeconfargs[@]}" + + if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then + eerror "configure has detected that the sem_open function is broken." + eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777." + die "Broken sem_open function (bug 496328)" + fi + + # install epython.py as part of stdlib + echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die +} + +src_compile() { + # Ensure sed works as expected + # https://bugs.gentoo.org/594768 + local -x LC_ALL=C + # Prevent using distutils bundled by setuptools. + # https://bugs.gentoo.org/823728 + export SETUPTOOLS_USE_DISTUTILS=stdlib + + # also need to clear the flags explicitly here or they end up + # in _sysconfigdata* + emake CPPFLAGS= CFLAGS= LDFLAGS= + + # Work around bug 329499. See also bug 413751 and 457194. + if has_version dev-libs/libffi[pax-kernel]; then + pax-mark E python + else + pax-mark m python + fi +} + +src_test() { + # Tests will not work when cross compiling. + if tc-is-cross-compiler; then + elog "Disabling tests due to crosscompiling." + return + fi + + local test_opts=( + -u-network + -j "$(makeopts_jobs)" + + # fails + -x test_gdb + ) + + if use sparc ; then + # bug #788022 + test_opts+=( + -x test_multiprocessing_fork + -x test_multiprocessing_forkserver + ) + fi + + # workaround docutils breaking tests + cat > Lib/docutils.py <<-EOF || die + raise ImportError("Thou shalt not import!") + EOF + + # bug 660358 + local -x COLUMNS=80 + local -x PYTHONDONTWRITEBYTECODE= + + nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \ + CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty + local ret=${?} + + rm Lib/docutils.py || die + + [[ ${ret} -eq 0 ]] || die "emake test failed" +} + +src_install() { + local libdir=${ED}/usr/lib/python${PYVER} + + emake DESTDIR="${D}" altinstall + + # Remove static library + rm "${ED}"/usr/$(get_libdir)/libpython*.a || die + + # Fix collisions between different slots of Python. + rm "${ED}/usr/$(get_libdir)/libpython3.so" || die + + # Cheap hack to get version with ABIFLAGS + local abiver=$(cd "${ED}/usr/include"; echo python*) + if [[ ${abiver} != python${PYVER} ]]; then + # Replace python3.X with a symlink to python3.Xm + rm "${ED}/usr/bin/python${PYVER}" || die + dosym "${abiver}" "/usr/bin/python${PYVER}" + # Create python3.X-config symlink + dosym "${abiver}-config" "/usr/bin/python${PYVER}-config" + # Create python-3.5m.pc symlink + dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc" + fi + + # python seems to get rebuilt in src_install (bug 569908) + # Work around it for now. + if has_version dev-libs/libffi[pax-kernel]; then + pax-mark E "${ED}/usr/bin/${abiver}" + else + pax-mark m "${ED}/usr/bin/${abiver}" + fi + + rm -r "${libdir}"/ensurepip/_bundled || die + if ! use ensurepip; then + rm -r "${libdir}"/ensurepip || die + fi + if ! use sqlite; then + rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die + fi + if ! use tk; then + rm -r "${ED}/usr/bin/idle${PYVER}" || die + rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die + fi + + dodoc Misc/{ACKS,HISTORY,NEWS} + + if use examples; then + docinto examples + find Tools -name __pycache__ -exec rm -fr {} + || die + dodoc -r Tools + fi + insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510 + local libname=$( + printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | + emake --no-print-directory -s -f - 2>/dev/null + ) + newins Tools/gdb/libpython.py "${libname}"-gdb.py + + newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER} + newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER} + sed \ + -e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \ + -e "s:@PYDOC@:pydoc${PYVER}:" \ + -i "${ED}/etc/conf.d/pydoc-${PYVER}" \ + "${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed" + + # python-exec wrapping support + local pymajor=${PYVER%.*} + local EPYTHON=python${PYVER} + local scriptdir=${D}$(python_get_scriptdir) + mkdir -p "${scriptdir}" || die + # python and pythonX + ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die + ln -s "python${pymajor}" "${scriptdir}/python" || die + # python-config and pythonX-config + # note: we need to create a wrapper rather than symlinking it due + # to some random dirname(argv[0]) magic performed by python-config + cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die + #!/bin/sh + exec "${abiver}-config" "\${@}" + EOF + chmod +x "${scriptdir}/python${pymajor}-config" || die + ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die + # 2to3, pydoc + ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die + ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die + # idle + if use tk; then + ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die + fi +}
