diff options
Diffstat (limited to 'dev-lang')
| -rw-r--r-- | dev-lang/python/ChangeLog | 6 | ||||
| -rw-r--r-- | dev-lang/python/Manifest | 6 | ||||
| -rw-r--r-- | dev-lang/python/files/python-3.2-CVE-2013-2099.patch | 51 | ||||
| -rw-r--r-- | dev-lang/python/python-3.2.5-r1.ebuild | 370 |
4 files changed, 432 insertions, 1 deletions
diff --git a/dev-lang/python/ChangeLog b/dev-lang/python/ChangeLog index 7b7572c0..1c1bc0a0 100644 --- a/dev-lang/python/ChangeLog +++ b/dev-lang/python/ChangeLog @@ -2,6 +2,12 @@ # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2 # $Header: $ +*python-3.2.5-r1 (07 Jul 2013) + + 07 Jul 2013; Bertrand Jacquin <beber@meleeweb.net> + +files/python-3.2-CVE-2013-2099.patch, +python-3.2.5-r1.ebuild: + dev-lang/python: Fix cross compiling, #471804 + 10 Jun 2013; Bertrand Jacquin <beber@meleeweb.net> metadata.xml: Fix manifest diff --git a/dev-lang/python/Manifest b/dev-lang/python/Manifest index 0edf2de5..0498a8aa 100644 --- a/dev-lang/python/Manifest +++ b/dev-lang/python/Manifest @@ -1,8 +1,12 @@ AUX pydoc.conf 279 SHA256 6437e85d16d34efaf2665b3cabb0707392e6dee3df04989d3fcac63fd22997e8 WHIRLPOOL 1ba44797765939d7c0bcbecb08cb6201eeff9b134d4d3caef9339729dcad9f258e20b16db5f369f49b378df3c91e530115dbce5ce3595d71cd325a48793ac814 AUX pydoc.init 741 SHA256 c2611330da516682d9a489e21b426550d6896d57d1b15eaafde3e8c518931460 WHIRLPOOL b9fe7bafcd984de6b80d58961fb31704ea40235a8ac6a896f2c9dbc015db11b0c711320e6687ac88e6621a8a217d5b8468b4e17f32ae25592b0708d894f0fc44 AUX python-2.7.3-BJA-cross.diff 791 SHA256 d062e76017795ea11a560d37465dcde8be26ae79e430037b0fb3b33376562930 WHIRLPOOL a66f2eb9865d73d777ce19ce8ea7df333d1842b9e893087962c7f021ff89e0a66645feec7ce44c03fe7c8e0a7042cfd6be34a97c29672117eabae4212a6cab66 +AUX python-3.2-CVE-2013-2099.patch 2102 SHA256 76a89951e7efcf14d37e30e0104446429ca121c68cbb1753ec362a177c1b5a54 WHIRLPOOL 3cd701c606ef1f4f557d1d250af41a860a6a5c4b6d9ff9a9f469ab6974f13e1205d2c4c791e9bd353fd4ff726f6cbf979f9a3927b83b04af5128c1aea7070496 DIST Python-2.7.3.tar.bz2 11793433 SHA256 726457e11cb153adc3f428aaf1901fc561a374c30e5e7da6742c0742a338663c WHIRLPOOL c980f465066ef0881d8b1141c6d8d4c54991c765fc258ddcd37ed2ec483f0686b8cc4cd076c56e0c8fa8891852905bed74d70b3f5071210cef7a9713542ab1a8 +DIST Python-3.2.5.tar.xz 9221624 SHA256 8ccb9645b9779fc4550055b2ebb21a724ab7a63dee45643286eb4f79b2f84116 WHIRLPOOL d5e5fae5e1d4110861e1e1dac00c9812abbbc37205e8ce3cd268535ab9f66e24038ab4778af8bb834fd472eaa0281730f1f2fabdf6dffc4f6b54ef32c1d75953 DIST python-gentoo-patches-2.7.3-1.tar.bz2 13858 SHA256 51f6981ba02064998dfb020725c33233641b3743c4f5cf04091657313a49b8fd WHIRLPOOL b8c4e83354f913eb50b9c91ad558a4cc042a395fd4bd7227cc2e5e6ede8962eb699d44ec3b3a05b47ea658fce2e90b2d0e035282d9737d602f313bad1a7d314a +DIST python-gentoo-patches-3.2.5-0.tar.xz 13892 SHA256 ebbfacc81486493ce4c16a697e53d77e9dc5c9d700e86cf92ae93b5e3e03abee WHIRLPOOL 55b1ba0a25612b3987af93e252dd2dbd71ff0f4ff0bcadda9ba0b11e19278acdb3fa91166a854dcbe3d27bb570a104ee63a3976111d6f608614f7b3d9f734f67 EBUILD python-2.7.3-r3.ebuild 11665 SHA256 976876f4263f8b09d7419a2731409fae60acc986a9da37f5af555648c4d74dbf WHIRLPOOL 0a7bd167e94223b2ba5523139515d87501aa57f84ac1e8afca7f134999cdd98ed0a842bffd716415acbf3f5ade9ffae9029b4c43440de75f01a92b606f1cd0d6 -MISC ChangeLog 1872 SHA256 203903abfd02b39a739d496da88e9e90a9ffe55f2ee3363a8880a7cc12b43753 WHIRLPOOL 07676a4e9e4566e2b9fa458784557dc2c1dc55c752bbc73757244fb75af73724e1aa5722a2e677374c8b161b10231672e31edf0696e548be5e3bd06974d7bd11 +EBUILD python-3.2.5-r1.ebuild 10704 SHA256 519dd32a752665ac2df5bc881d31f5c01d7be6b5a084a4c1f6dfbc74d2fc9ecb WHIRLPOOL 1488b173c84e54a4da098d4a727ec6b74d38763bc5864bd51e17fee538113a3dbd3f734d7044f7715188fab66ed2079d677bcf68340d3fc94697a348f4e719ee +MISC ChangeLog 2072 SHA256 4b223ff6672173d1021d959cf7100c0037b98e1249c2fe2dc6f138349f49a728 WHIRLPOOL a55224675189d718e86153947ae48d03309615d63e2fc9987731ed18e4397a450f082b6887169d9f42b43e9471f4d5de2e57fdec5f0fcfd0739c2ccf8d8c2f57 MISC metadata.xml 694 SHA256 21b0456a1169c1c017b79c9fff9ae6b95629a2f45bab272ee859d584883c9e06 WHIRLPOOL 0d2bd6dea286e92a1b89b5e0a9994584cad129a306c4464dbbe3162ddb2c68287e89aeb641d0949dfe535270891d0e94e78ce8bee5a18f12f30daf022cc85bdc diff --git a/dev-lang/python/files/python-3.2-CVE-2013-2099.patch b/dev-lang/python/files/python-3.2-CVE-2013-2099.patch new file mode 100644 index 00000000..9055a03d --- /dev/null +++ b/dev-lang/python/files/python-3.2-CVE-2013-2099.patch @@ -0,0 +1,51 @@ +# HG changeset patch +# User Antoine Pitrou <solipsis@pitrou.net> +# Date 1368892602 -7200 +# Sat May 18 17:56:42 2013 +0200 +# Branch 3.2 +# Node ID b9b521efeba385af0142988899a55de1c1c805c7 +# Parent 6255b40c6a6127933d8ea7a2b9de200f5a0e6154 +Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099). + +diff --git a/Lib/ssl.py b/Lib/ssl.py +--- a/Lib/ssl.py ++++ b/Lib/ssl.py +@@ -108,9 +108,16 @@ + pass + + +-def _dnsname_to_pat(dn): ++def _dnsname_to_pat(dn, max_wildcards=1): + pats = [] + for frag in dn.split(r'.'): ++ if frag.count('*') > max_wildcards: ++ # Issue #17980: avoid denials of service by refusing more ++ # than one wildcard per fragment. A survery of established ++ # policy among SSL implementations showed it to be a ++ # reasonable choice. ++ raise CertificateError( ++ "too many wildcards in certificate DNS name: " + repr(dn)) + if frag == '*': + # When '*' is a fragment by itself, it matches a non-empty dotless + # fragment. +diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py +--- a/Lib/test/test_ssl.py ++++ b/Lib/test/test_ssl.py +@@ -326,6 +326,17 @@ + self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com') + self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com') + ++ # Issue #17980: avoid denials of service by refusing more than one ++ # wildcard per fragment. ++ cert = {'subject': ((('commonName', 'a*b.com'),),)} ++ ok(cert, 'axxb.com') ++ cert = {'subject': ((('commonName', 'a*b.co*'),),)} ++ ok(cert, 'axxb.com') ++ cert = {'subject': ((('commonName', 'a*b*.com'),),)} ++ with self.assertRaises(ssl.CertificateError) as cm: ++ ssl.match_hostname(cert, 'axxbxxc.com') ++ self.assertIn("too many wildcards", str(cm.exception)) ++ + def test_server_side(self): + # server_hostname doesn't work for server sockets + ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) diff --git a/dev-lang/python/python-3.2.5-r1.ebuild b/dev-lang/python/python-3.2.5-r1.ebuild new file mode 100644 index 00000000..1776ad0e --- /dev/null +++ b/dev-lang/python/python-3.2.5-r1.ebuild @@ -0,0 +1,370 @@ +# Copyright 1999-2013 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/dev-lang/python/python-3.2.5-r1.ebuild,v 1.8 2013/07/07 12:06:45 ago Exp $ + +EAPI="4" +WANT_AUTOMAKE="none" +WANT_LIBTOOL="none" + +inherit autotools eutils flag-o-matic multilib pax-utils python-utils-r1 toolchain-funcs multiprocessing + +MY_P="Python-${PV}" +PATCHSET_REVISION="0" + +DESCRIPTION="An interpreted, interactive, object-oriented programming language" +HOMEPAGE="http://www.python.org/" +SRC_URI="http://www.python.org/ftp/python/${PV}/${MY_P}.tar.xz + mirror://gentoo/python-gentoo-patches-${PV}-${PATCHSET_REVISION}.tar.xz" + +LICENSE="PSF-2" +SLOT="3.2" +KEYWORDS="alpha amd64 arm hppa ~ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh ~sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd" +IUSE="build doc elibc_uclibc examples gdbm hardened ipv6 +ncurses +readline sqlite +ssl +threads tk +wide-unicode wininst +xml" + +# Do not add a dependency on dev-lang/python to this ebuild. +# If you need to apply a patch which requires python for bootstrapping, please +# run the bootstrap code on your dev box and include the results in the +# patchset. See bug 447752. + +RDEPEND="app-arch/bzip2 + >=sys-libs/zlib-1.1.3 + virtual/libffi + virtual/libintl + !build? ( + gdbm? ( sys-libs/gdbm[berkdb] ) + ncurses? ( + >=sys-libs/ncurses-5.2 + readline? ( >=sys-libs/readline-4.1 ) + ) + sqlite? ( >=dev-db/sqlite-3.3.8:3[extensions] ) + ssl? ( dev-libs/openssl ) + tk? ( + >=dev-lang/tk-8.0 + dev-tcltk/blt + ) + xml? ( >=dev-libs/expat-2.1 ) + )" +DEPEND="${RDEPEND} + virtual/pkgconfig + >=sys-devel/autoconf-2.65 + !sys-devel/gcc[libffi]" +RDEPEND+=" !build? ( app-misc/mime-types ) + doc? ( dev-python/python-docs:${SLOT} )" +PDEPEND="app-admin/eselect-python + app-admin/python-updater" + +S="${WORKDIR}/${MY_P}" + +pkg_setup() { + if [[ "${PV}" =~ ^3\.2(\.[1234])?(_pre)? ]]; then + rm -f "${EROOT}usr/$(get_libdir)/llibpython3.so" + else + die "Deprecated code not deleted" + fi +} + +src_prepare() { + # Ensure that internal copies of expat, libffi and zlib are not used. + rm -r Modules/expat + rm -r Modules/_ctypes/libffi* + rm -r Modules/zlib + + local excluded_patches + if ! tc-is-cross-compiler; then + excluded_patches="*_all_crosscompile.patch" + fi + + EPATCH_EXCLUDE="${excluded_patches}" EPATCH_SUFFIX="patch" \ + epatch "${WORKDIR}/${PV}-${PATCHSET_REVISION}" + + epatch "${FILESDIR}/python-3.2-CVE-2013-2099.patch" + + sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" \ + Lib/distutils/command/install.py \ + Lib/distutils/sysconfig.py \ + Lib/site.py \ + Lib/sysconfig.py \ + Lib/test/test_site.py \ + Makefile.pre.in \ + Modules/Setup.dist \ + Modules/getpath.c \ + setup.py || die "sed failed to replace @@GENTOO_LIBDIR@@" + + # Disable ABI flags. + sed -e "s/ABIFLAGS=\"\${ABIFLAGS}.*\"/:/" -i configure.ac || die "sed failed" + + epatch_user + + eautoconf + eautoheader +} + +src_configure() { + if use build; then + # Disable extraneous modules with extra dependencies. + export PYTHON_DISABLE_MODULES="gdbm _curses _curses_panel readline _sqlite3 _tkinter _elementtree pyexpat" + export PYTHON_DISABLE_SSL="1" + else + local disable + use gdbm || disable+=" gdbm" + use ncurses || disable+=" _curses _curses_panel" + use readline || disable+=" readline" + use sqlite || disable+=" _sqlite3" + use ssl || export PYTHON_DISABLE_SSL="1" + use tk || disable+=" _tkinter" + use xml || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat. + export PYTHON_DISABLE_MODULES="${disable}" + + if ! use xml; then + ewarn "You have configured Python without XML support." + ewarn "This is NOT a recommended configuration as you" + ewarn "may face problems parsing any XML documents." + fi + fi + + if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then + einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}" + fi + + if [[ "$(gcc-major-version)" -ge 4 ]]; then + append-flags -fwrapv + fi + + filter-flags -malign-double + + [[ "${ARCH}" == "alpha" ]] && append-flags -fPIC + + # https://bugs.gentoo.org/show_bug.cgi?id=50309 + if is-flagq -O3; then + is-flagq -fstack-protector-all && replace-flags -O3 -O2 + use hardened && replace-flags -O3 -O2 + fi + + # Run the configure scripts in parallel. + multijob_init + + mkdir -p "${WORKDIR}"/{${CBUILD},${CHOST}} + + if tc-is-cross-compiler; then + ( + multijob_child_init + cd "${WORKDIR}"/${CBUILD} >/dev/null + OPT="-O1" CFLAGS="" CPPFLAGS="" LDFLAGS="" CC="" \ + "${S}"/configure \ + --{build,host}=${CBUILD} \ + || die "cross-configure failed" + ) & + multijob_post_fork + + # The configure script assumes it's buggy when cross-compiling. + export ac_cv_buggy_getaddrinfo=no + export ac_cv_computed_gotos=yes + export ac_cv_have_long_long_format=yes + fi + + # Export CXX so it ends up in /usr/lib/python3.X/config/Makefile. + tc-export CXX + # The configure script fails to use pkg-config correctly. + # http://bugs.python.org/issue15506 + export ac_cv_path_PKG_CONFIG=$(tc-getPKG_CONFIG) + + # Set LDFLAGS so we link modules with -lpython3.2 correctly. + # Needed on FreeBSD unless Python 3.2 is already installed. + # Please query BSD team before removing this! + append-ldflags "-L." + + local dbmliborder + if use gdbm; then + dbmliborder+="${dbmliborder:+:}gdbm" + fi + + cd "${WORKDIR}"/${CHOST} + ECONF_SOURCE=${S} OPT="" \ + econf \ + --with-fpectl \ + --enable-shared \ + $(use_enable ipv6) \ + $(use_with threads) \ + $(use_with wide-unicode) \ + --infodir='${prefix}/share/info' \ + --mandir='${prefix}/share/man' \ + --with-computed-gotos \ + --with-dbmliborder="${dbmliborder}" \ + --with-libc="" \ + --enable-loadable-sqlite-extensions \ + --with-system-expat \ + --with-system-ffi + + if tc-is-cross-compiler; then + # Modify the Makefile.pre so we don't regen for the host/ one. + # We need to link the host python programs into $PWD and run + # them from here because the distutils sysconfig module will + # parse Makefile/etc... from argv[0], and we need it to pick + # up the target settings, not the host ones. + sed -i \ + -e '1iHOSTPYTHONPATH = ./hostpythonpath:' \ + -e '/^HOSTPYTHON/s:=.*:= ./hostpython:' \ + -e '/^HOSTPGEN/s:=.*:= ./Parser/hostpgen:' \ + Makefile{.pre,} || die "sed failed" + fi + + multijob_finish +} + +src_compile() { + if tc-is-cross-compiler; then + cd "${WORKDIR}"/${CBUILD} + # Disable as many modules as possible -- but we need a few to install. + PYTHON_DISABLE_MODULES=$( + sed -n "/Extension('/{s:^.*Extension('::;s:'.*::;p}" "${S}"/setup.py | \ + egrep -v '(unicodedata|time|cStringIO|_struct|binascii)' + ) \ + PTHON_DISABLE_SSL="1" \ + CFLAGS="${BUILD_CFLAGS}" \ + SYSROOT= \ + emake + # See comment in src_configure about these. + ln python ../${CHOST}/hostpython || die + ln Parser/pgen ../${CHOST}/Parser/hostpgen || die + ln -s ../${CBUILD}/build/lib.*/ ../${CHOST}/hostpythonpath || die + fi + + cd "${WORKDIR}"/${CHOST} + emake CPPFLAGS="" CFLAGS="" LDFLAGS="" + + # Work around bug 329499. See also bug 413751 and 457194. + if has_version dev-libs/libffi[pax_kernel]; then + pax-mark E python + else + pax-mark m python + fi +} + +src_test() { + # Tests will not work when cross compiling. + if tc-is-cross-compiler; then + elog "Disabling tests due to crosscompiling." + return + fi + + cd "${WORKDIR}"/${CHOST} + + # Skip failing tests. + local skipped_tests="gdb" + + for test in ${skipped_tests}; do + mv "${S}"/Lib/test/test_${test}.py "${T}" + done + + # Rerun failed tests in verbose mode (regrtest -w). + PYTHONDONTWRITEBYTECODE="" emake test EXTRATESTOPTS="-w" CPPFLAGS="" CFLAGS="" LDFLAGS="" < /dev/tty + local result="$?" + + for test in ${skipped_tests}; do + mv "${T}/test_${test}.py" "${S}"/Lib/test + done + + elog "The following tests have been skipped:" + for test in ${skipped_tests}; do + elog "test_${test}.py" + done + + elog "If you would like to run them, you may:" + elog "cd '${EPREFIX}/usr/$(get_libdir)/python${SLOT}/test'" + elog "and run the tests separately." + + if [[ "${result}" -ne 0 ]]; then + die "emake test failed" + fi +} + +src_install() { + local libdir=${ED}/usr/$(get_libdir)/python${SLOT} + + cd "${WORKDIR}"/${CHOST} + emake DESTDIR="${D}" altinstall + + sed \ + -e "s/\(CONFIGURE_LDFLAGS=\).*/\1/" \ + -e "s/\(PY_LDFLAGS=\).*/\1/" \ + -i "${libdir}/config-${SLOT}/Makefile" || die "sed failed" + + # Backwards compat with Gentoo divergence. + dosym python${SLOT}-config /usr/bin/python-config-${SLOT} + + # Fix collisions between different slots of Python. + rm "${ED}usr/$(get_libdir)/libpython3.so" || die + + if use build; then + rm -fr "${ED}usr/bin/idle${SLOT}" "${libdir}/"{idlelib,sqlite3,test,tkinter} + else + use elibc_uclibc && rm -fr "${libdir}/test" + use sqlite || rm -fr "${libdir}/"{sqlite3,test/test_sqlite*} + use tk || rm -fr "${ED}usr/bin/idle${SLOT}" "${libdir}/"{idlelib,tkinter,test/test_tk*} + fi + + use threads || rm -fr "${libdir}/multiprocessing" + use wininst || rm -f "${libdir}/distutils/command/"wininst-*.exe + + dodoc "${S}"/Misc/{ACKS,HISTORY,NEWS} + + if use examples; then + insinto /usr/share/doc/${PF}/examples + find "${S}"/Tools -name __pycache__ -print0 | xargs -0 rm -fr + doins -r "${S}"/Tools + fi + insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510 + local libname=$(printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | \ + emake --no-print-directory -s -f - 2>/dev/null) + newins "${S}"/Tools/gdb/libpython.py "${libname}"-gdb.py + + newconfd "${FILESDIR}/pydoc.conf" pydoc-${SLOT} + newinitd "${FILESDIR}/pydoc.init" pydoc-${SLOT} + sed \ + -e "s:@PYDOC_PORT_VARIABLE@:PYDOC${SLOT/./_}_PORT:" \ + -e "s:@PYDOC@:pydoc${SLOT}:" \ + -i "${ED}etc/conf.d/pydoc-${SLOT}" "${ED}etc/init.d/pydoc-${SLOT}" || die "sed failed" + + # for python-exec + python_export python${SLOT} EPYTHON PYTHON PYTHON_SITEDIR + + # if not using a cross-compiler, use the fresh binary + if ! tc-is-cross-compiler; then + local PYTHON=./python \ + LD_LIBRARY_PATH=${LD_LIBRARY_PATH+${LD_LIBRARY_PATH}:}. + export LD_LIBRARY_PATH + fi + + echo "EPYTHON='${EPYTHON}'" > epython.py + python_domodule epython.py +} + +pkg_preinst() { + if has_version "<${CATEGORY}/${PN}-${SLOT}" && ! has_version ">=${CATEGORY}/${PN}-${SLOT}_alpha"; then + python_updater_warning="1" + fi +} + +eselect_python_update() { + if [[ -z "$(eselect python show)" || ! -f "${EROOT}usr/bin/$(eselect python show)" ]]; then + eselect python update + fi + + if [[ -z "$(eselect python show --python${PV%%.*})" || ! -f "${EROOT}usr/bin/$(eselect python show --python${PV%%.*})" ]]; then + eselect python update --python${PV%%.*} + fi +} + +pkg_postinst() { + eselect_python_update + + if [[ "${python_updater_warning}" == "1" ]]; then + ewarn "You have just upgraded from an older version of Python." + ewarn "You should switch active version of Python ${PV%%.*} and run" + ewarn "'python-updater [options]' to rebuild Python modules." + fi +} + +pkg_postrm() { + eselect_python_update +} |