kumquat-buildroot/package/python3/0014-Add-an-option-to-disable-pydoc.patch

100 lines
3.1 KiB
Diff
Raw Normal View History

From 18a754e930e03d143d9392e49174cc370b334cdd Mon Sep 17 00:00:00 2001
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Date: Wed, 22 Feb 2017 17:07:56 -0800
Subject: [PATCH] Add an option to disable pydoc
It removes 0.5 MB of data from the target plus the pydoc script
itself.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Samuel Martin <s.martin49@gmail.com>
[ Andrey Smirnov: ported to Python 3.6 ]
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
Makefile.pre.in | 8 +++++++-
configure.ac | 6 ++++++
setup.py | 9 +++++++--
3 files changed, 20 insertions(+), 3 deletions(-)
diff --git a/Makefile.pre.in b/Makefile.pre.in
index 4110fff4ac..badb2af35d 100644
--- a/Makefile.pre.in
+++ b/Makefile.pre.in
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 23:21:37 +02:00
@@ -1231,7 +1231,9 @@ bininstall: altbininstall
-rm -f $(DESTDIR)$(BINDIR)/idle3
(cd $(DESTDIR)$(BINDIR); $(LN) -s idle$(VERSION) idle3)
-rm -f $(DESTDIR)$(BINDIR)/pydoc3
+ifeq (@PYDOC@,yes)
(cd $(DESTDIR)$(BINDIR); $(LN) -s pydoc$(VERSION) pydoc3)
+endif
-rm -f $(DESTDIR)$(BINDIR)/2to3
(cd $(DESTDIR)$(BINDIR); $(LN) -s 2to3-$(VERSION) 2to3)
-rm -f $(DESTDIR)$(BINDIR)/pyvenv
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 23:21:37 +02:00
@@ -1279,7 +1281,7 @@ LIBSUBDIRS= tkinter site-packages \
multiprocessing multiprocessing/dummy \
unittest \
venv venv/scripts venv/scripts/common venv/scripts/posix \
- curses pydoc_data
+ curses
TESTSUBDIRS= tkinter/test tkinter/test/test_tkinter \
tkinter/test/test_ttk test \
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 23:21:37 +02:00
@@ -1354,6 +1356,10 @@ ifeq (@TEST_MODULES@,yes)
LIBSUBDIRS += $(TESTSUBDIRS)
endif
+ifeq (@PYDOC@,yes)
+LIBSUBDIRS += pydoc_data
+endif
+
libinstall: build_all $(srcdir)/Modules/xxmodule.c
@for i in $(SCRIPTDIR) $(LIBDEST); \
do \
diff --git a/configure.ac b/configure.ac
index f924937fe1..1621fa1611 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3226,6 +3226,12 @@ if test "$posix_threads" = "yes"; then
python3: bump to 3.7.0 Other changes include: - Refreshing all necessary patches for 3.7.0 - Add a hash for the license file. - Python no longer has it's own internal libffi, as such, host-libffi is now required to build host-python3, and is added as a dependency. - Drop PYTHON3_LIBTOOL_PATCH = NO, since there is no longer any internal libffi copy that was causing the libtool patching process to fail. - A new core module "uuid" is now is added in the Config.in file, and relies on util-linux's uuid library. - Also, a new patch: 0030-Fix-cross-compiling-the-uuid-module.patch is required to fix compiling the uuid module, because the include directory search path for uuid.h is hardcoded to /usr/include/uuid, which causes an "unsafe for cross-compilation" error during compiling if the host pc has uuid headers installed. - 0031-Add-an-option-to-disable-uuid-module.patch is added to allow disabling the Python3 UUID module, so that when BR2_PACKAGE_PYTHON3_UUID is disabled by the UUID library is present, the uuid Python module is not built, as expected. - 0032-fix-building-on-older-distributions.patch is added to change os.replace by os.rename in the update_file.py script to fix building on older Linux distributions that have older versions of python that don't include os.replace. os.rename acts in the same way as os.replace, but is cross-platform compatible. Because Buildroot is guaranteed to be built in a POSIX environment, it is safe to change replace to rename. Tested on CentOS6 and Fedora28, All test results passed: br-arm-full [1/6]: OK br-arm-cortex-a9-glibc [2/6]: OK br-arm-cortex-m4-full [3/6]: SKIPPED br-x86-64-musl [4/6]: OK br-arm-full-static [5/6]: SKIPPED armv5-ctng-linux-gnueabi [6/6]: OK 6 builds, 2 skipped, 0 build failed, 0 legal-info failed Signed-off-by: Adam Duskett <aduskett@gmail.com> [Thomas: - remove PYTHON3_LIBTOOL_PATCH = NO - improve the solution in patch 0030-Fix-cross-compiling-the-uuid-module - add patch 0031-Add-an-option-to-disable-uuid-module] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-07-20 18:10:21 +02:00
AC_CHECK_FUNCS(pthread_getcpuclockid)
fi
+AC_SUBST(PYDOC)
+
+AC_ARG_ENABLE(pydoc,
+ AS_HELP_STRING([--disable-pydoc], [disable pydoc]),
+ [ PYDOC="${enableval}" ], [ PYDOC=yes ])
+
AC_SUBST(TEST_MODULES)
AC_ARG_ENABLE(test-modules,
diff --git a/setup.py b/setup.py
index 29bfd174d2..94dd337fef 100644
--- a/setup.py
+++ b/setup.py
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 23:21:37 +02:00
@@ -2376,6 +2376,12 @@ def main():
# turn off warnings when deprecated modules are imported
import warnings
warnings.filterwarnings("ignore",category=DeprecationWarning)
+
+ scripts = ['Tools/scripts/idle3', 'Tools/scripts/2to3',
+ 'Lib/smtpd.py']
+ if not '--disable-pydoc' in sysconfig.get_config_var("CONFIG_ARGS"):
+ scripts += [ 'Tools/scripts/pydoc3' ]
+
setup(# PyPI Metadata (PEP 301)
name = "Python",
version = sys.version.split()[0],
package/python3: security bump to version 3.7.4 Fixes the following security issues: - bpo-37463: ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. ‘127.0.0.1 whatever’. - bpo-35907: CVE-2019-9948: Avoid file reading by disallowing local-file:// and local_file:// URL schemes in URLopener().open() and URLopener().retrieve() of urllib.request. - bpo-30458: Address CVE-2019-9740 by disallowing URL paths with embedded whitespace or control characters through into the underlying http client request. Such potentially malicious header injection URLs now cause an http.client.InvalidURL exception to be raised. - bpo-33529: Prevent fold function used in email header encoding from entering infinite loop when there are too many non-ASCII characters in a header. - bpo-35755: shutil.which() now uses os.confstr("CS_PATH") if available and if the PATH environment variable is not set. Remove also the current directory from posixpath.defpath. On Unix, shutil.which() and the subprocess module no longer search the executable in the current directory if the PATH environment variable is not set. Also remove the following upstreamed patches: - 0033-bpo-36742-Fixes-handling-of-pre-normalization-charac.patch - 0034-bpo-36742-Corrects-fix-to-handle-decomposition-in-us.patch Signed-off-by: Adam Duskett <Aduskett@gmail.com> [Peter: mention security fixes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-07-10 23:21:37 +02:00
@@ -2400,8 +2406,7 @@ def main():
# If you change the scripts installed here, you also need to
# check the PyBuildScripts command above, and change the links
# created by the bininstall target in Makefile.pre.in
- scripts = ["Tools/scripts/pydoc3", "Tools/scripts/idle3",
- "Tools/scripts/2to3", "Tools/scripts/pyvenv"]
+ scripts = scripts
)
# --install-platlib
--
2.13.5