From 4f8f384b099de49e45cd39ba66aa2d3564685c65 Mon Sep 17 00:00:00 2001 From: liuxiaoping Date: Fri, 23 Jun 2023 17:35:55 +0800 Subject: [PATCH 1/3] update to python38-3.8.16-1.module+el8.8.0+18967+20d359ae.1 --- 00189-use-rpm-wheels.patch | 24 +- 00329-fips.patch | 196 ++++++++-------- 00378-support-expat-2-4-5.patch | 36 +++ 00399-cve-2023-24329.patch | 222 +++++++++++++++++++ 1000-add-anolis-platform.patch | 12 - 1001-anolis-python-support-loongarch64.patch | 12 - download | 2 +- python38.spec | 70 +++++- 8 files changed, 428 insertions(+), 146 deletions(-) create mode 100644 00378-support-expat-2-4-5.patch create mode 100644 00399-cve-2023-24329.patch delete mode 100644 1000-add-anolis-platform.patch delete mode 100644 1001-anolis-python-support-loongarch64.patch diff --git a/00189-use-rpm-wheels.patch b/00189-use-rpm-wheels.patch index c4132aa..15021bf 100644 --- a/00189-use-rpm-wheels.patch +++ b/00189-use-rpm-wheels.patch @@ -1,4 +1,4 @@ -From 7558ea14881f9afdf622375b5140b209c0c2f84d Mon Sep 17 00:00:00 2001 +From ff07393a8c9c3d69090a775a8d4b89a3019f71a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 15 Aug 2018 15:36:29 +0200 Subject: [PATCH] 00189: Instead of bundled wheels, use our RPM packaged wheels @@ -8,11 +8,11 @@ We keep them in /usr/share/python-wheels Downstream only: upstream bundles We might eventually pursuit upstream support, but it's low prio --- - Lib/ensurepip/__init__.py | 33 +++++++++++++++++++++++---------- - 1 file changed, 23 insertions(+), 10 deletions(-) + Lib/ensurepip/__init__.py | 36 ++++++++++++++++++++++++++---------- + 1 file changed, 26 insertions(+), 10 deletions(-) diff --git a/Lib/ensurepip/__init__.py b/Lib/ensurepip/__init__.py -index 597a1ef..3c2287f 100644 +index b291e9a..798d0f4 100644 --- a/Lib/ensurepip/__init__.py +++ b/Lib/ensurepip/__init__.py @@ -1,6 +1,7 @@ @@ -24,14 +24,15 @@ index 597a1ef..3c2287f 100644 import sys import runpy import tempfile -@@ -9,9 +10,24 @@ import subprocess +@@ -9,8 +10,26 @@ import subprocess __all__ = ["version", "bootstrap"] - + _PACKAGE_NAMES = ('setuptools', 'pip') -_SETUPTOOLS_VERSION = "56.0.0" +-_PIP_VERSION = "22.0.4" ++ +_WHEEL_DIR = "/usr/share/python38-wheels/" - --_PIP_VERSION = "21.1.1" ++ +_wheels = {} + +def _get_most_recent_wheel_version(pkg): @@ -48,10 +49,11 @@ index 597a1ef..3c2287f 100644 +_SETUPTOOLS_VERSION = _get_most_recent_wheel_version("setuptools") + +_PIP_VERSION = _get_most_recent_wheel_version("pip") - ++ _PROJECTS = [ ("setuptools", _SETUPTOOLS_VERSION, "py3"), -@@ -101,13 +117,10 @@ def _bootstrap(*, root=None, upgrade=False, user=False, + ("pip", _PIP_VERSION, "py3"), +@@ -99,13 +118,10 @@ def _bootstrap(*, root=None, upgrade=False, user=False, # additional paths that need added to sys.path additional_paths = [] for project, version, py_tag in _PROJECTS: @@ -70,5 +72,5 @@ index 597a1ef..3c2287f 100644 additional_paths.append(os.path.join(tmpdir, wheel_name)) -- -2.31.1 +2.35.3 diff --git a/00329-fips.patch b/00329-fips.patch index d955f73..590bda6 100644 --- a/00329-fips.patch +++ b/00329-fips.patch @@ -1,4 +1,4 @@ -From 9e1da6c093529d7b314f3703158a213824c3521e Mon Sep 17 00:00:00 2001 +From 31ae5d3189a0b8ec07c55df3785d27d769bc90a5 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 25 Jul 2019 16:19:52 +0200 Subject: [PATCH 01/36] Expose OpenSSL FIPS_mode() as hashlib.get_fips_mode() @@ -123,10 +123,10 @@ index 9aaea47..30fd8a9 100644 -/*[clinic end generated code: output=38c2637f67e9bb79 input=a9049054013a1b77]*/ +/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From 5a8faeb61d7acd6c7036efe24efe269c683dc1a0 Mon Sep 17 00:00:00 2001 +From 9e12b2fdecca4fba5d777923f7742fffb7b6240d Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 25 Jul 2019 17:04:06 +0200 Subject: [PATCH 02/36] Use python's fall backs for the crypto it implements @@ -410,10 +410,10 @@ index 63ae836..1bcfdf9 100644 +if not get_fips_mode(): + del __py_new diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 8b53d23..e9abcbb 100644 +index e6cec4e..f40cc83 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py -@@ -945,6 +945,7 @@ class KDFTests(unittest.TestCase): +@@ -954,6 +954,7 @@ class KDFTests(unittest.TestCase): iterations=1, dklen=None) self.assertEqual(out, self.pbkdf2_results['sha1'][0][0]) @@ -422,10 +422,10 @@ index 8b53d23..e9abcbb 100644 self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac) -- -2.31.1 +2.38.1 -From d21c5a098dda889de21985e57f12852ce9fbbcf1 Mon Sep 17 00:00:00 2001 +From a7711c418ea72f9ea18bbb70a2d52ab44489066b Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 25 Jul 2019 17:19:06 +0200 Subject: [PATCH 03/36] Disable Python's hash implementations in FIPS mode, @@ -695,10 +695,10 @@ index c1fb618..34d09b4 100644 return NULL; } diff --git a/setup.py b/setup.py -index c28c096..a11bbda 100644 +index 0b24dd6..f7c4be1 100644 --- a/setup.py +++ b/setup.py -@@ -1673,7 +1673,6 @@ class PyBuildExt(build_ext): +@@ -1677,7 +1677,6 @@ class PyBuildExt(build_ext): def detect_modules(self): self.configure_compiler() self.init_inc_lib_dirs() @@ -706,7 +706,7 @@ index c28c096..a11bbda 100644 self.detect_simple_extensions() if TEST_EXTENSIONS: self.detect_test_extensions() -@@ -2161,7 +2160,7 @@ class PyBuildExt(build_ext): +@@ -2165,7 +2164,7 @@ class PyBuildExt(build_ext): sources=sources, depends=depends)) @@ -715,7 +715,7 @@ index c28c096..a11bbda 100644 # Detect SSL support for the socket module (via _ssl) config_vars = sysconfig.get_config_vars() -@@ -2182,7 +2181,7 @@ class PyBuildExt(build_ext): +@@ -2186,7 +2185,7 @@ class PyBuildExt(build_ext): if not openssl_libs: # libssl and libcrypto not found self.missing.extend(['_ssl', '_hashlib']) @@ -724,7 +724,7 @@ index c28c096..a11bbda 100644 # Find OpenSSL includes ssl_incs = find_file( -@@ -2190,7 +2189,7 @@ class PyBuildExt(build_ext): +@@ -2194,7 +2193,7 @@ class PyBuildExt(build_ext): ) if ssl_incs is None: self.missing.extend(['_ssl', '_hashlib']) @@ -733,7 +733,7 @@ index c28c096..a11bbda 100644 # OpenSSL 1.0.2 uses Kerberos for KRB5 ciphers krb5_h = find_file( -@@ -2200,12 +2199,24 @@ class PyBuildExt(build_ext): +@@ -2204,12 +2203,24 @@ class PyBuildExt(build_ext): if krb5_h: ssl_incs.extend(krb5_h) @@ -761,7 +761,7 @@ index c28c096..a11bbda 100644 depends=[ 'socketmodule.h', '_ssl/debughelpers.c', -@@ -2218,22 +2229,12 @@ class PyBuildExt(build_ext): +@@ -2222,22 +2233,12 @@ class PyBuildExt(build_ext): self.add(Extension('_hashlib', ['_hashopenssl.c'], depends=['hashlib.h'], @@ -788,7 +788,7 @@ index c28c096..a11bbda 100644 blake2_deps = glob(os.path.join(escape(self.srcdir), 'Modules/_blake2/impl/*')) -@@ -2243,6 +2244,7 @@ class PyBuildExt(build_ext): +@@ -2247,6 +2248,7 @@ class PyBuildExt(build_ext): ['_blake2/blake2module.c', '_blake2/blake2b_impl.c', '_blake2/blake2s_impl.c'], @@ -796,7 +796,7 @@ index c28c096..a11bbda 100644 depends=blake2_deps)) sha3_deps = glob(os.path.join(escape(self.srcdir), -@@ -2250,7 +2252,9 @@ class PyBuildExt(build_ext): +@@ -2254,7 +2256,9 @@ class PyBuildExt(build_ext): sha3_deps.append('hashlib.h') self.add(Extension('_sha3', ['_sha3/sha3module.c'], @@ -808,10 +808,10 @@ index c28c096..a11bbda 100644 def detect_nis(self): if MS_WINDOWS or CYGWIN or HOST_PLATFORM == 'qnx6': -- -2.31.1 +2.38.1 -From 668177d86702b10da881f76cf17bda44d8823be9 Mon Sep 17 00:00:00 2001 +From 5928affee1e8306877918efc417090512faea14d Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 12 Dec 2019 16:58:31 +0100 Subject: [PATCH 04/36] Expose all hashes available to OpenSSL @@ -1310,10 +1310,10 @@ index 30fd8a9..e96a752 100644 -/*[clinic end generated code: output=5467006d93e7479e input=a9049054013a1b77]*/ +/*[clinic end generated code: output=be8e21a10dff71e7 input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From 7137c003853b8672eed4d28fe8703756b75ab790 Mon Sep 17 00:00:00 2001 +From eb264b74a2a6fc820813edbfa611b782edcda088 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 25 Jul 2019 18:13:45 +0200 Subject: [PATCH 05/36] Fix tests @@ -1323,7 +1323,7 @@ Subject: [PATCH 05/36] Fix tests 1 file changed, 45 insertions(+), 13 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index e9abcbb..2a55fd4 100644 +index f40cc83..972eda1 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -190,7 +190,9 @@ class HashLibTestCase(unittest.TestCase): @@ -1442,10 +1442,10 @@ index e9abcbb..2a55fd4 100644 @requires_sha3 def test_extra_sha3(self): -- -2.31.1 +2.38.1 -From 94f13c68d2a4845e58d4c7b7adf01e64f993c4f5 Mon Sep 17 00:00:00 2001 +From 7c34172f398cdea804e8a4671f996e9b3706ec7d Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 26 Jul 2019 11:27:57 +0200 Subject: [PATCH 06/36] Change FIPS exceptions from _blake2, _sha3 module init @@ -1584,10 +1584,10 @@ index 34d09b4..3079e1e 100644 if ((m = PyModule_Create(&_SHA3module)) == NULL) { return NULL; -- -2.31.1 +2.38.1 -From 805af2c3dcbe1855a9fb8eb534b985aed338c2ba Mon Sep 17 00:00:00 2001 +From c968e85d077123510f8b6441b169b46f6e0e9d26 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 26 Jul 2019 11:24:09 +0200 Subject: [PATCH 07/36] Make hashlib importable under FIPS mode @@ -1619,10 +1619,10 @@ index 1bcfdf9..898e6dc 100644 -- -2.31.1 +2.38.1 -From bc3f033f0a832e6b7ddf50e1059de8fc5df08d3f Mon Sep 17 00:00:00 2001 +From ea2a87a494c36eae2cc2cf343074ff0214e37517 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Fri, 26 Jul 2019 15:41:10 +0200 Subject: [PATCH 08/36] Implement hmac.new using new built-in module, @@ -2250,10 +2250,10 @@ index 0000000..b472a6e +} +/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/ diff --git a/setup.py b/setup.py -index a11bbda..ca30105 100644 +index f7c4be1..6fc7e72 100644 --- a/setup.py +++ b/setup.py -@@ -2231,6 +2231,10 @@ class PyBuildExt(build_ext): +@@ -2235,6 +2235,10 @@ class PyBuildExt(build_ext): depends=['hashlib.h'], **self.detect_openssl_args()) ) @@ -2265,10 +2265,10 @@ index a11bbda..ca30105 100644 # RHEL: Always force OpenSSL for md5, sha1, sha256, sha512; # don't build Python's implementations. -- -2.31.1 +2.38.1 -From da75615e1f3e6b8f44a16e5113a4a6fd55e48629 Mon Sep 17 00:00:00 2001 +From 03ac0fc03e418f73ed76b203f779a083312aaff9 Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Mon, 29 Jul 2019 12:45:11 +0200 Subject: [PATCH 09/36] FIPS review @@ -2480,10 +2480,10 @@ index ca95d72..216ed04 100644 + return PyModuleDef_Init(&_hmacopenssl_def); } -- -2.31.1 +2.38.1 -From f48fab4946308008e989d845ce0dbc2cff6ce9ff Mon Sep 17 00:00:00 2001 +From f130424124b4cbd4b61f1dd84b69f1f4f9e766f6 Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Mon, 29 Jul 2019 13:05:04 +0200 Subject: [PATCH 10/36] revert cosmetic nitpick and remove trailing whitespace @@ -2529,10 +2529,10 @@ index 216ed04..221714c 100644 .m_methods = hmacopenssl_functions, .m_slots = hmacopenssl_slots, -- -2.31.1 +2.38.1 -From dc55436077250ba791ee67692fdc8704a900987b Mon Sep 17 00:00:00 2001 +From 5259a4c7bd3d1ce2f0bdbcd0c95583c95d7d0d23 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Wed, 31 Jul 2019 15:43:43 +0200 Subject: [PATCH 11/36] Add initial tests for various hashes under FIPS mode @@ -2613,10 +2613,10 @@ index 0000000..bee911e +if __name__ == "__main__": + unittest.main() -- -2.31.1 +2.38.1 -From 446c6a790ef878bda6137ebfc570f36dee01c380 Mon Sep 17 00:00:00 2001 +From c2b7ebc17d79f8c91572a790d425f9106d4dd70e Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Thu, 1 Aug 2019 16:39:37 +0200 Subject: [PATCH 12/36] Initialize HMAC type. @@ -2682,10 +2682,10 @@ index 221714c..239445a 100644 fail: -- -2.31.1 +2.38.1 -From 357007a6034cc3409ad2e2fe9fc77974ea6de626 Mon Sep 17 00:00:00 2001 +From 931784f1a431538486905ef1d3958dfefd5478e6 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 1 Aug 2019 17:57:05 +0200 Subject: [PATCH 13/36] Use a stronger hash in multiprocessing handshake @@ -2730,10 +2730,10 @@ index 8e2facf..bb4acb6 100644 response = connection.recv_bytes(256) # reject large message if response != WELCOME: -- -2.31.1 +2.38.1 -From fddd82fedc5ea8b49ceab49296c7bddb9f3f1204 Mon Sep 17 00:00:00 2001 +From 8a68ba81a66181d9a4b6c7b1e77f944efada2aae Mon Sep 17 00:00:00 2001 From: Marcel Plch Date: Fri, 2 Aug 2019 17:36:01 +0200 Subject: [PATCH 14/36] Fix refcounting @@ -2804,10 +2804,10 @@ index 239445a..9c28828 100644 -- -2.31.1 +2.38.1 -From 42f7d2fbefe161607ad146f44d2abd19fe804810 Mon Sep 17 00:00:00 2001 +From 5d835c236b392e8741fabe9b9d83d5482842dd87 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 13:37:05 +0200 Subject: [PATCH 15/36] hmac: Don't default to md5 in FIPS mode @@ -2830,10 +2830,10 @@ index daabc8c..0302364 100644 result = _hmacopenssl.new(key, digestmod=name) if msg: -- -2.31.1 +2.38.1 -From e285342c3b17de9b13ccbf2dbdb68cce5b4df86c Mon Sep 17 00:00:00 2001 +From d865fb5a73ffaf39de68b69c9ccb81ca17b6c430 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 14:20:58 +0200 Subject: [PATCH 16/36] Make _hmacopenssl.HMAC subclassable; subclass it as @@ -3121,10 +3121,10 @@ index b472a6e..861acc1 100644 -/*[clinic end generated code: output=10b6e8cac6d7a2c9 input=a9049054013a1b77]*/ +/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From 5dab92e1f96fc0940a2d5d365708329e8c282587 Mon Sep 17 00:00:00 2001 +From 0a75e9886721aa076542a40159b02fbd18bd8cd3 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 16:10:36 +0200 Subject: [PATCH 17/36] Fix _hmacopenssl.HMAC.block_size @@ -3147,10 +3147,10 @@ index 7d3d973..a24c8ba 100644 static PyMethodDef Hmac_methods[] = { -- -2.31.1 +2.38.1 -From d39cc2e44d6debffce096b82d30909e2662379ab Mon Sep 17 00:00:00 2001 +From 68b4ee700ed23422472c9b96cf0631cb5a5dab6e Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 15:02:08 +0200 Subject: [PATCH 18/36] distutils upload: Skip md5 checksum in FIPS mode @@ -3229,10 +3229,10 @@ index c17d8e7..b4b64e9 100644 def test_upload_fails(self): -- -2.31.1 +2.38.1 -From 124f7e862bdbf6615e64fedfa73a76e199d68644 Mon Sep 17 00:00:00 2001 +From 62c8250c2996af8e4d112676c0995616583fafa7 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 15:32:25 +0200 Subject: [PATCH 19/36] Fix HMAC tests on FIPS mode @@ -3322,10 +3322,10 @@ index 23c108f..0a85981 100644 def test_equality(self): # Testing if the copy has the same digests. -- -2.31.1 +2.38.1 -From 6bc6c745da5c2d860de9f76402ccf554e398bbbc Mon Sep 17 00:00:00 2001 +From a7f5d3a4712694e6b74295ba6980c554b56d7227 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 16:37:12 +0200 Subject: [PATCH 20/36] test_tools: Skip md5sum tests in FIPS mode @@ -3355,10 +3355,10 @@ index fb565b7..7028a4d 100644 @classmethod def setUpClass(cls): -- -2.31.1 +2.38.1 -From 22f2476f2a19dfc4e4c25e5df2f059bf8e15d397 Mon Sep 17 00:00:00 2001 +From 9e6cfe34f7377761f758d57a1b68a62fd4d0f2d1 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 18:23:57 +0200 Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode @@ -3368,7 +3368,7 @@ Subject: [PATCH 21/36] Make hashlib tests pass in FIPS mode 1 file changed, 48 insertions(+), 19 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 2a55fd4..9ae5efc 100644 +index 972eda1..19a9868 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -28,6 +28,11 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount') @@ -3528,7 +3528,7 @@ index 2a55fd4..9ae5efc 100644 @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) def test_case_md5_uintmax(self, size): -@@ -842,14 +869,16 @@ class HashLibTestCase(unittest.TestCase): +@@ -851,14 +878,16 @@ class HashLibTestCase(unittest.TestCase): m = cons(b'x' * gil_minsize) m.update(b'1') @@ -3550,10 +3550,10 @@ index 2a55fd4..9ae5efc 100644 @support.reap_threads def test_threaded_hashing(self): -- -2.31.1 +2.38.1 -From ca8655cc0f8c1bcfb5ae970d33a826c092746203 Mon Sep 17 00:00:00 2001 +From 22b6dcc045d87d130852bc4f017cfb6305b329dd Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 14 Aug 2019 14:43:07 +0200 Subject: [PATCH 22/36] distutils upload: only add md5 if available, but @@ -3620,10 +3620,10 @@ index b4b64e9..f720a79 100644 def test_upload_fails(self): -- -2.31.1 +2.38.1 -From 12f506902ee04749565485bb60f0b927b2895e71 Mon Sep 17 00:00:00 2001 +From b02daa9dbf4fcd2d1e067d63873d276bd7bf132f Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Fri, 13 Sep 2019 02:30:00 +0200 Subject: [PATCH 23/36] bpo-9216: Add usedforsecurity to hashlib constructors @@ -3709,7 +3709,7 @@ index f5da6ec..86b9f65 100644 These functions return the corresponding hash objects for calculating diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 9ae5efc..08bb91f 100644 +index 19a9868..3ee9b14 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -226,6 +226,15 @@ class HashLibTestCase(unittest.TestCase): @@ -5854,10 +5854,10 @@ index 4167fd3..504d40a 100644 SHAobject *new; Py_buffer buf; -- -2.31.1 +2.38.1 -From 041f34e22d7c458b611a72e3927deb85f20d1a85 Mon Sep 17 00:00:00 2001 +From 0ee86826a425528d1f129788ad3e9e144e81da83 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 26 Aug 2019 19:09:39 +0200 Subject: [PATCH 24/36] Test the usedforsecurity flag @@ -5867,7 +5867,7 @@ Subject: [PATCH 24/36] Test the usedforsecurity flag 1 file changed, 54 insertions(+), 34 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 08bb91f..1368e91 100644 +index 3ee9b14..a991f0a 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -21,6 +21,7 @@ from test import support @@ -6080,9 +6080,9 @@ index 08bb91f..1368e91 100644 - self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3') + self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3', usedforsecurity=False) - # use the three examples from Federal Information Processing Standards - # Publication 180-1, Secure Hash Standard, 1995 April 17 -@@ -925,6 +935,16 @@ class HashLibTestCase(unittest.TestCase): + @unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems') + @bigmemtest(size=_4G - 1, memuse=1, dry_run=False) +@@ -934,6 +944,16 @@ class HashLibTestCase(unittest.TestCase): self.assertEqual(expected_hash, hasher.hexdigest()) @@ -6100,10 +6100,10 @@ index 08bb91f..1368e91 100644 class KDFTests(unittest.TestCase): -- -2.31.1 +2.38.1 -From 6ae69003979add3243d700e1f5154cf83818ea62 Mon Sep 17 00:00:00 2001 +From 7602d70630fa0e736ad518b243079b658893d653 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 29 Aug 2019 10:25:28 +0200 Subject: [PATCH 25/36] Skip error checking in _hashlib.get_fips_mode @@ -6155,10 +6155,10 @@ index b4d05ab..a48b607 100644 -- -2.31.1 +2.38.1 -From 95b58ae12206c7889e0159a720c1a96fcb2dc050 Mon Sep 17 00:00:00 2001 +From 07552e7758fdc9c9610d773b4100d4686b5353a3 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Thu, 10 Oct 2019 13:04:50 +0200 Subject: [PATCH 26/36] Skip error checking in _Py_hashlib_fips_error @@ -6193,10 +6193,10 @@ index 47ed003..d4cbdef 100644 } PyErr_Format(exc, "%s is not available in FIPS mode", name); -- -2.31.1 +2.38.1 -From ba0462edf8fb3ae3cb04151460002cf687758605 Mon Sep 17 00:00:00 2001 +From 8be15a9faf79a062be4b0f27605737bc34687e68 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 5 Aug 2019 19:12:38 +0200 Subject: [PATCH 27/36] Fixups @@ -6235,10 +6235,10 @@ index 0a85981..0b481ec 100644 h1 = hmac.HMAC(b"key", digestmod="sha1") h2 = h1.copy() -- -2.31.1 +2.38.1 -From d2596ea3fab68d2fc586abaae64323599c2a74c8 Mon Sep 17 00:00:00 2001 +From 112646fbf2af81df1750140f7486b32296518099 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Mon, 26 Aug 2019 19:39:48 +0200 Subject: [PATCH 28/36] Don't re-export get_fips_mode from hashlib @@ -6446,7 +6446,7 @@ index 34812e6..86e61e2 100644 self.compare_hashes(hashlib.shake_128(b'abc'), _hashlib.openssl_shake_128(b'abc')) self.compare_hashes(hashlib.shake_256(b'abc'), _hashlib.openssl_shake_256(b'abc')) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index 1368e91..a4b7840 100644 +index a991f0a..b535059 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -29,7 +29,9 @@ COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount') @@ -6502,7 +6502,7 @@ index 1368e91..a4b7840 100644 self.check_blocksize_name('md5', 64, 16) self.check_blocksize_name('sha1', 64, 20) self.check_blocksize_name('sha224', 64, 28) -@@ -935,7 +937,7 @@ class HashLibTestCase(unittest.TestCase): +@@ -944,7 +946,7 @@ class HashLibTestCase(unittest.TestCase): self.assertEqual(expected_hash, hasher.hexdigest()) @@ -6551,7 +6551,7 @@ index 0b481ec..cc77928 100644 def test_realcopy(self): # Testing if the copy method created a real copy. diff --git a/Lib/test/test_smtplib.py b/Lib/test/test_smtplib.py -index c9205ae..e4d7fb4 100644 +index d14eb45..af53ec9 100644 --- a/Lib/test/test_smtplib.py +++ b/Lib/test/test_smtplib.py @@ -17,6 +17,8 @@ import select @@ -6563,7 +6563,7 @@ index c9205ae..e4d7fb4 100644 import unittest from test import support, mock_socket -@@ -1059,7 +1061,7 @@ class SMTPSimTests(unittest.TestCase): +@@ -1114,7 +1116,7 @@ class SMTPSimTests(unittest.TestCase): def testAUTH_multiple(self): # Test that multiple authentication methods are tried. @@ -6605,10 +6605,10 @@ index 1cb358f..6f5cb7f 100644 from test import support -- -2.31.1 +2.38.1 -From 7873a4a314732768bc4d11a095ae50f0553bdebd Mon Sep 17 00:00:00 2001 +From 69a0ddba408a9595aa0fc5b3fdfe7e59838acea2 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Wed, 20 Nov 2019 10:59:25 +0100 Subject: [PATCH 29/36] Use FIPS compliant CSPRNG @@ -6773,10 +6773,10 @@ index eb2b6d0..cb38cfe 100644 return win32_urandom((unsigned char *)buffer, size, raise); #else -- -2.31.1 +2.38.1 -From 99ee25369116bf17731502e77a81bd0c5ac59b38 Mon Sep 17 00:00:00 2001 +From 72894033d2c1d29897204c5272d8f2878c17254c Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 28 Nov 2019 17:26:02 +0100 Subject: [PATCH 30/36] Fixups for FIPS compliant CSPRNG @@ -6872,10 +6872,10 @@ index cb38cfe..08fa29a 100644 return 0; } -- -2.31.1 +2.38.1 -From 3750c8b8b4c09c6bc795721bc353da23b015fe4d Mon Sep 17 00:00:00 2001 +From d8bc6ab755acf0e2feffda802aeed032a2319df8 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 2 Apr 2020 16:50:37 +0200 Subject: [PATCH 31/36] Do not raise a ValueError if digestmod is missing in @@ -6902,10 +6902,10 @@ index 5055027..ee1ad76 100644 return digestmod.lower() elif callable(digestmod): -- -2.31.1 +2.38.1 -From 737af204f04bb39e5f87d53fe07713137639234e Mon Sep 17 00:00:00 2001 +From 9dd6dc8c11b96ac74abf220ed76d1176041c3711 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Thu, 2 Apr 2020 16:55:36 +0200 Subject: [PATCH 32/36] Regenerate the clinic files @@ -6989,10 +6989,10 @@ index 861acc1..527be83 100644 -/*[clinic end generated code: output=d93ad460795d49b5 input=a9049054013a1b77]*/ +/*[clinic end generated code: output=9b75c31e1116bf6f input=a9049054013a1b77]*/ -- -2.31.1 +2.38.1 -From d0e7edf46ceef6ffb6075bb8b8b966f31df018fc Mon Sep 17 00:00:00 2001 +From f646402958e8d284519ef7f72d0225ace210ffa7 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Tue, 7 Apr 2020 15:16:45 +0200 Subject: [PATCH 33/36] Pass kwargs (like usedforsecurity) through __hash_new @@ -7024,10 +7024,10 @@ index 2fc214e..785858f 100644 try: -- -2.31.1 +2.38.1 -From 0e3f635871d22831cbb5f0bffb9962f2a1ad29eb Mon Sep 17 00:00:00 2001 +From bd206ed69e7c19b62f0174a649b5c2d03f0d9f5b Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Tue, 7 Apr 2020 15:18:48 +0200 Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with @@ -7038,7 +7038,7 @@ Subject: [PATCH 34/36] Adjust new upstream test for failing hashes with 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py -index a4b7840..a858bf4 100644 +index b535059..6e846c4 100644 --- a/Lib/test/test_hashlib.py +++ b/Lib/test/test_hashlib.py @@ -239,15 +239,23 @@ class HashLibTestCase(unittest.TestCase): @@ -7070,10 +7070,10 @@ index a4b7840..a858bf4 100644 self.assertRaises(ValueError, hashlib.new, 'spam spam spam spam spam') self.assertRaises(TypeError, hashlib.new, 1) -- -2.31.1 +2.38.1 -From 8145cfd2f71749a9fe844e5abc725f36e9085b22 Mon Sep 17 00:00:00 2001 +From d1ce20110573989382948a901896169eb637b265 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Fri, 24 Apr 2020 19:57:16 +0200 Subject: [PATCH 35/36] Skip the test_with_digestmod_no_default under FIPS @@ -7116,10 +7116,10 @@ index cc77928..fd068e0 100644 class ConstructorTestCase(unittest.TestCase): -- -2.31.1 +2.38.1 -From 969498fda9699b2e9d2df4a78a671e37d578daea Mon Sep 17 00:00:00 2001 +From bff06e176e60200582a42611d4fe3c240da314a3 Mon Sep 17 00:00:00 2001 From: Charalampos Stratakis Date: Tue, 31 Mar 2020 18:00:42 +0200 Subject: [PATCH 36/36] Add a sentinel value on the Hmac_members table of the @@ -7142,5 +7142,5 @@ index 9577cad..4bd7c15 100644 PyDoc_STRVAR(hmactype_doc, -- -2.31.1 +2.38.1 diff --git a/00378-support-expat-2-4-5.patch b/00378-support-expat-2-4-5.patch new file mode 100644 index 0000000..2a06bfb --- /dev/null +++ b/00378-support-expat-2-4-5.patch @@ -0,0 +1,36 @@ +diff --git a/Lib/test/test_minidom.py b/Lib/test/test_minidom.py +index 06c9107..6c3f5a8 100644 +--- a/Lib/test/test_minidom.py ++++ b/Lib/test/test_minidom.py +@@ -1149,14 +1149,11 @@ class MinidomTest(unittest.TestCase): + + # Verify that character decoding errors raise exceptions instead + # of crashing +- if pyexpat.version_info >= (2, 4, 5): +- self.assertRaises(ExpatError, parseString, +- b'') +- self.assertRaises(ExpatError, parseString, +- b'Comment \xe7a va ? Tr\xe8s bien ?') +- else: +- self.assertRaises(UnicodeDecodeError, parseString, +- b'Comment \xe7a va ? Tr\xe8s bien ?') ++ ++ self.assertRaises(ExpatError, parseString, ++ b'') ++ self.assertRaises(ExpatError, parseString, ++ b'Comment \xe7a va ? Tr\xe8s bien ?') + + doc.unlink() + +@@ -1601,10 +1598,7 @@ class MinidomTest(unittest.TestCase): + self.confirm(doc2.namespaceURI == xml.dom.EMPTY_NAMESPACE) + + def testExceptionOnSpacesInXMLNSValue(self): +- if pyexpat.version_info >= (2, 4, 5): +- context = self.assertRaisesRegex(ExpatError, 'syntax error') +- else: +- context = self.assertRaisesRegex(ValueError, 'Unsupported syntax') ++ context = self.assertRaisesRegex(ExpatError, 'syntax error') + + with context: + parseString('') diff --git a/00399-cve-2023-24329.patch b/00399-cve-2023-24329.patch new file mode 100644 index 0000000..3ee32d2 --- /dev/null +++ b/00399-cve-2023-24329.patch @@ -0,0 +1,222 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Mon, 22 May 2023 03:42:37 -0700 +Subject: [PATCH] 00399: CVE-2023-24329 + +gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508) + +`urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit GH-25595. + +This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329). + +(cherry picked from commit d7f8a5fe07b0ff3a419ccec434cc405b21a5a304) +(cherry picked from commit 2f630e1ce18ad2e07428296532a68b11dc66ad10) +(cherry picked from commit 610cc0ab1b760b2abaac92bd256b96191c46b941) +(cherry picked from commit f48a96a28012d28ae37a2f4587a780a5eb779946) + +Co-authored-by: Illia Volochii +Co-authored-by: Gregory P. Smith [Google] +--- + Doc/library/urllib.parse.rst | 38 +++++++++++- + Lib/test/test_urlparse.py | 61 ++++++++++++++++++- + Lib/urllib/parse.py | 12 ++++ + ...-03-07-20-59-17.gh-issue-102153.14CLSZ.rst | 3 + + 4 files changed, 111 insertions(+), 3 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst + +diff --git a/Doc/library/urllib.parse.rst b/Doc/library/urllib.parse.rst +index a6cfc5d3dc..7dda121f26 100644 +--- a/Doc/library/urllib.parse.rst ++++ b/Doc/library/urllib.parse.rst +@@ -147,6 +147,10 @@ or on combining URL components into a URL string. + ParseResult(scheme='http', netloc='www.cwi.nl:80', path='/%7Eguido/Python.html', + params='', query='', fragment='') + ++ .. warning:: ++ ++ :func:`urlparse` does not perform validation. See :ref:`URL parsing ++ security ` for details. + + .. versionchanged:: 3.2 + Added IPv6 URL parsing capabilities. +@@ -312,8 +316,14 @@ or on combining URL components into a URL string. + ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is + decomposed before parsing, no error will be raised. + +- Following the `WHATWG spec`_ that updates RFC 3986, ASCII newline +- ``\n``, ``\r`` and tab ``\t`` characters are stripped from the URL. ++ Following some of the `WHATWG spec`_ that updates RFC 3986, leading C0 ++ control and space characters are stripped from the URL. ``\n``, ++ ``\r`` and tab ``\t`` characters are removed from the URL at any position. ++ ++ .. warning:: ++ ++ :func:`urlsplit` does not perform validation. See :ref:`URL parsing ++ security ` for details. + + .. versionchanged:: 3.6 + Out-of-range port numbers now raise :exc:`ValueError`, instead of +@@ -326,6 +336,9 @@ or on combining URL components into a URL string. + .. versionchanged:: 3.8.10 + ASCII newline and tab characters are stripped from the URL. + ++ .. versionchanged:: 3.8.17 ++ Leading WHATWG C0 control and space characters are stripped from the URL. ++ + .. _WHATWG spec: https://url.spec.whatwg.org/#concept-basic-url-parser + + .. function:: urlunsplit(parts) +@@ -402,6 +415,27 @@ or on combining URL components into a URL string. + or ``scheme://host/path``). If *url* is not a wrapped URL, it is returned + without changes. + ++.. _url-parsing-security: ++ ++URL parsing security ++-------------------- ++ ++The :func:`urlsplit` and :func:`urlparse` APIs do not perform **validation** of ++inputs. They may not raise errors on inputs that other applications consider ++invalid. They may also succeed on some inputs that might not be considered ++URLs elsewhere. Their purpose is for practical functionality rather than ++purity. ++ ++Instead of raising an exception on unusual input, they may instead return some ++component parts as empty strings. Or components may contain more than perhaps ++they should. ++ ++We recommend that users of these APIs where the values may be used anywhere ++with security implications code defensively. Do some verification within your ++code before trusting a returned component part. Does that ``scheme`` make ++sense? Is that a sensible ``path``? Is there anything strange about that ++``hostname``? etc. ++ + .. _parsing-ascii-encoded-bytes: + + Parsing ASCII Encoded Bytes +diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py +index 0f99130f5d..0ad3bf128b 100644 +--- a/Lib/test/test_urlparse.py ++++ b/Lib/test/test_urlparse.py +@@ -660,6 +660,65 @@ class UrlParseTestCase(unittest.TestCase): + self.assertEqual(p.scheme, "https") + self.assertEqual(p.geturl(), "https://www.python.org/javascript:alert('msg')/?query=something#fragment") + ++ def test_urlsplit_strip_url(self): ++ noise = bytes(range(0, 0x20 + 1)) ++ base_url = "http://User:Pass@www.python.org:080/doc/?query=yes#frag" ++ ++ url = noise.decode("utf-8") + base_url ++ p = urllib.parse.urlsplit(url) ++ self.assertEqual(p.scheme, "http") ++ self.assertEqual(p.netloc, "User:Pass@www.python.org:080") ++ self.assertEqual(p.path, "/doc/") ++ self.assertEqual(p.query, "query=yes") ++ self.assertEqual(p.fragment, "frag") ++ self.assertEqual(p.username, "User") ++ self.assertEqual(p.password, "Pass") ++ self.assertEqual(p.hostname, "www.python.org") ++ self.assertEqual(p.port, 80) ++ self.assertEqual(p.geturl(), base_url) ++ ++ url = noise + base_url.encode("utf-8") ++ p = urllib.parse.urlsplit(url) ++ self.assertEqual(p.scheme, b"http") ++ self.assertEqual(p.netloc, b"User:Pass@www.python.org:080") ++ self.assertEqual(p.path, b"/doc/") ++ self.assertEqual(p.query, b"query=yes") ++ self.assertEqual(p.fragment, b"frag") ++ self.assertEqual(p.username, b"User") ++ self.assertEqual(p.password, b"Pass") ++ self.assertEqual(p.hostname, b"www.python.org") ++ self.assertEqual(p.port, 80) ++ self.assertEqual(p.geturl(), base_url.encode("utf-8")) ++ ++ # Test that trailing space is preserved as some applications rely on ++ # this within query strings. ++ query_spaces_url = "https://www.python.org:88/doc/?query= " ++ p = urllib.parse.urlsplit(noise.decode("utf-8") + query_spaces_url) ++ self.assertEqual(p.scheme, "https") ++ self.assertEqual(p.netloc, "www.python.org:88") ++ self.assertEqual(p.path, "/doc/") ++ self.assertEqual(p.query, "query= ") ++ self.assertEqual(p.port, 88) ++ self.assertEqual(p.geturl(), query_spaces_url) ++ ++ p = urllib.parse.urlsplit("www.pypi.org ") ++ # That "hostname" gets considered a "path" due to the ++ # trailing space and our existing logic... YUCK... ++ # and re-assembles via geturl aka unurlsplit into the original. ++ # django.core.validators.URLValidator (at least through v3.2) relies on ++ # this, for better or worse, to catch it in a ValidationError via its ++ # regular expressions. ++ # Here we test the basic round trip concept of such a trailing space. ++ self.assertEqual(urllib.parse.urlunsplit(p), "www.pypi.org ") ++ ++ # with scheme as cache-key ++ url = "//www.python.org/" ++ scheme = noise.decode("utf-8") + "https" + noise.decode("utf-8") ++ for _ in range(2): ++ p = urllib.parse.urlsplit(url, scheme=scheme) ++ self.assertEqual(p.scheme, "https") ++ self.assertEqual(p.geturl(), "https://www.python.org/") ++ + def test_attributes_bad_port(self): + """Check handling of invalid ports.""" + for bytes in (False, True): +@@ -667,7 +726,7 @@ class UrlParseTestCase(unittest.TestCase): + for port in ("foo", "1.5", "-1", "0x10"): + with self.subTest(bytes=bytes, parse=parse, port=port): + netloc = "www.example.net:" + port +- url = "http://" + netloc ++ url = "http://" + netloc + "/" + if bytes: + netloc = netloc.encode("ascii") + url = url.encode("ascii") +diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py +index f0d9d4d803..979e6d2127 100644 +--- a/Lib/urllib/parse.py ++++ b/Lib/urllib/parse.py +@@ -25,6 +25,10 @@ currently not entirely compliant with this RFC due to defacto + scenarios for parsing, and for backward compatibility purposes, some + parsing quirks from older RFCs are retained. The testcases in + test_urlparse.py provides a good indicator of parsing behavior. ++ ++The WHATWG URL Parser spec should also be considered. We are not compliant with ++it either due to existing user code API behavior expectations (Hyrum's Law). ++It serves as a useful guide when making changes. + """ + + import re +@@ -77,6 +81,10 @@ scheme_chars = ('abcdefghijklmnopqrstuvwxyz' + '0123456789' + '+-.') + ++# Leading and trailing C0 control and space to be stripped per WHATWG spec. ++# == "".join([chr(i) for i in range(0, 0x20 + 1)]) ++_WHATWG_C0_CONTROL_OR_SPACE = '\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f ' ++ + # Unsafe bytes to be removed per WHATWG spec + _UNSAFE_URL_BYTES_TO_REMOVE = ['\t', '\r', '\n'] + +@@ -431,6 +439,10 @@ def urlsplit(url, scheme='', allow_fragments=True): + url, scheme, _coerce_result = _coerce_args(url, scheme) + url = _remove_unsafe_bytes_from_url(url) + scheme = _remove_unsafe_bytes_from_url(scheme) ++ # Only lstrip url as some applications rely on preserving trailing space. ++ # (https://url.spec.whatwg.org/#concept-basic-url-parser would strip both) ++ url = url.lstrip(_WHATWG_C0_CONTROL_OR_SPACE) ++ scheme = scheme.strip(_WHATWG_C0_CONTROL_OR_SPACE) + allow_fragments = bool(allow_fragments) + key = url, scheme, allow_fragments, type(url), type(scheme) + cached = _parse_cache.get(key, None) +diff --git a/Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst b/Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst +new file mode 100644 +index 0000000000..e57ac4ed3a +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2023-03-07-20-59-17.gh-issue-102153.14CLSZ.rst +@@ -0,0 +1,3 @@ ++:func:`urllib.parse.urlsplit` now strips leading C0 control and space ++characters following the specification for URLs defined by WHATWG in ++response to CVE-2023-24329. Patch by Illia Volochii. diff --git a/1000-add-anolis-platform.patch b/1000-add-anolis-platform.patch deleted file mode 100644 index 66d78d2..0000000 --- a/1000-add-anolis-platform.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Nur Python-3.8.6_old/Doc/library/gettext.rst Python-3.8.6/Doc/library/gettext.rst ---- Python-3.8.6_old/Doc/library/gettext.rst 2020-09-23 20:36:32.000000000 +0800 -+++ Python-3.8.6/Doc/library/gettext.rst 2021-06-21 13:56:22.000000000 +0800 -@@ -721,7 +721,7 @@ - - .. rubric:: Footnotes - --.. [#] The default locale directory is system dependent; for example, on RedHat Linux -+.. [#] The default locale directory is system dependent; for example, on Anolis OS - it is :file:`/usr/share/locale`, but on Solaris it is :file:`/usr/lib/locale`. - The :mod:`gettext` module does not try to support these system dependent - defaults; instead its default is :file:`{sys.base_prefix}/share/locale` (see diff --git a/1001-anolis-python-support-loongarch64.patch b/1001-anolis-python-support-loongarch64.patch deleted file mode 100644 index 7528294..0000000 --- a/1001-anolis-python-support-loongarch64.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -Nurp Python-3.8.3.orig/configure.ac Python-3.8.3/configure.ac ---- Python-3.8.3.orig/configure.ac 2021-01-20 01:59:43.644531250 +0000 -+++ Python-3.8.3/configure.ac 2021-01-20 02:49:57.824218750 +0000 -@@ -830,6 +830,8 @@ cat >> conftest.c <=2.4.5 has become strcter in that regard due to +# related security issues; with ET.XML instantiating a +# namespace-aware parser under the hood, this test has no +# future in CPython. +# +# References: +# - https://datatracker.ietf.org/doc/html/rfc3968 +# - https://www.w3.org/TR/xml-names/ +# +# Also, test_minidom.py: Support Expat >=2.4.5 +# +# The patch has diverged from upstream as the python test +# suite was relying on checking the expat version, whereas +# in RHEL fixes get backported instead of rebasing packages. +# +# Upstream: https://bugs.python.org/issue46811 +Patch378: 00378-support-expat-2-4-5.patch + +# 00399 # +# CVE-2023-24329 +# +# gh-102153: Start stripping C0 control and space chars in `urlsplit` (GH-102508) +# +# `urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit GH-25595. +# +# This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%%20any%%20leading%%20and%%20trailing%%20C0%%20control%%20or%%20space%%20from%%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329). +Patch399: 00399-cve-2023-24329.patch + # (New patches go here ^^^) # # When adding new patches to "python" and "python3" in Fedora, EL, etc., @@ -371,9 +405,6 @@ Patch359: 00359-CVE-2021-23336.patch # # https://github.com/fedora-python/cpython -# Rebrand for Anolis OS -Patch1000: 1000-add-anolis-platform.patch -Patch1001: 1001-anolis-python-support-loongarch64.patch # ========================================== # Descriptions, and metadata for subpackages @@ -717,9 +748,8 @@ rm Lib/ensurepip/_bundled/*.whl %patch329 -p1 %patch353 -p1 %patch359 -p1 - -%patch1000 -p1 -%patch1001 -p1 +%patch378 -p1 +%patch399 -p1 # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) @@ -1808,9 +1838,25 @@ fi # ====================================================== %changelog -* Tue Apr 19 2022 Liwei Ge - 3.8.12-1.0.1 -- Rebrand for Anolis OS -- Support loongarch64 platform +* Wed May 31 2023 Charalampos Stratakis - 3.8.16-1.1 +- Security fix for CVE-2023-24329 +Resolves: rhbz#2173917 + +* Tue Dec 13 2022 Charalampos Stratakis - 3.8.16-1 +- Update to 3.8.16 +- Security fix for CVE-2022-45061 +Resolves: rhbz#2144072 + +* Mon Sep 12 2022 Charalampos Stratakis - 3.8.14-1 +- Rebase to 3.8.14 +- Security fixes for CVE-2020-10735 and CVE-2021-28861 +Resolves: rhbz#1834423, rhbz#2120642 + +* Tue Jun 14 2022 Charalampos Stratakis - 3.8.13-1 +- Rebase to 3.8.13 +- Security fix for CVE-2015-20107 +- Fix the test suite support for Expat >= 2.4.5 +Resolves: rhbz#2075390 * Wed Sep 15 2021 Charalampos Stratakis - 3.8.12-1 - Update to 3.8.12 -- Gitee From a0d1040c82717731c0d587c03fe7dc3714e6e548 Mon Sep 17 00:00:00 2001 From: Zhao Hang Date: Fri, 17 Dec 2021 06:32:15 +0000 Subject: [PATCH 2/3] Rebrand for Anolis OS # Conflicts: # python38.spec --- add-anolis-platform.patch | 12 ++++++++++++ python38.spec | 10 +++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 add-anolis-platform.patch diff --git a/add-anolis-platform.patch b/add-anolis-platform.patch new file mode 100644 index 0000000..66d78d2 --- /dev/null +++ b/add-anolis-platform.patch @@ -0,0 +1,12 @@ +diff -Nur Python-3.8.6_old/Doc/library/gettext.rst Python-3.8.6/Doc/library/gettext.rst +--- Python-3.8.6_old/Doc/library/gettext.rst 2020-09-23 20:36:32.000000000 +0800 ++++ Python-3.8.6/Doc/library/gettext.rst 2021-06-21 13:56:22.000000000 +0800 +@@ -721,7 +721,7 @@ + + .. rubric:: Footnotes + +-.. [#] The default locale directory is system dependent; for example, on RedHat Linux ++.. [#] The default locale directory is system dependent; for example, on Anolis OS + it is :file:`/usr/share/locale`, but on Solaris it is :file:`/usr/lib/locale`. + The :mod:`gettext` module does not try to support these system dependent + defaults; instead its default is :file:`{sys.base_prefix}/share/locale` (see diff --git a/python38.spec b/python38.spec index 71635aa..465a21e 100644 --- a/python38.spec +++ b/python38.spec @@ -3,6 +3,7 @@ # ================== %global pybasever 3.8 +%define anolis_release .0.1 # pybasever without the dot: %global pyshortver 38 @@ -17,7 +18,7 @@ URL: https://www.python.org/ #global prerel ... %global upstream_version %{general_version}%{?prerel} Version: %{general_version}%{?prerel:~%{prerel}} -Release: 1%{?dist}.1 +Release: 1%{anolis_release}%{?dist}.1 License: Python # Exclude i686 arch. Due to a modularity issue it's being added to the @@ -405,6 +406,8 @@ Patch399: 00399-cve-2023-24329.patch # # https://github.com/fedora-python/cpython +# Rebrand for Anolis OS +Patch1000: add-anolis-platform.patch # ========================================== # Descriptions, and metadata for subpackages @@ -751,6 +754,8 @@ rm Lib/ensurepip/_bundled/*.whl %patch378 -p1 %patch399 -p1 +%patch1000 -p1 + # Remove files that should be generated by the build # (This is after patching, so that we can use patches directly from upstream) rm configure pyconfig.h.in @@ -1838,6 +1843,9 @@ fi # ====================================================== %changelog +* Fri Jun 23 2023 Liwei Ge - 3.8.16-1.0.1.1 +- Rebrand for Anolis OS + * Wed May 31 2023 Charalampos Stratakis - 3.8.16-1.1 - Security fix for CVE-2023-24329 Resolves: rhbz#2173917 -- Gitee From 040026ff099d2f1c7589ac7c182ff8202062c576 Mon Sep 17 00:00:00 2001 From: Liwei Ge Date: Tue, 9 Nov 2021 17:55:09 +0800 Subject: [PATCH 3/3] build: support loongarch64 platform Signed-off-by: Liwei Ge --- ...-platform.patch => 1000-add-anolis-platform.patch | 0 1001-anolis-python-support-loongarch64.patch | 12 ++++++++++++ python38.spec | 5 ++++- 3 files changed, 16 insertions(+), 1 deletion(-) rename add-anolis-platform.patch => 1000-add-anolis-platform.patch (100%) create mode 100644 1001-anolis-python-support-loongarch64.patch diff --git a/add-anolis-platform.patch b/1000-add-anolis-platform.patch similarity index 100% rename from add-anolis-platform.patch rename to 1000-add-anolis-platform.patch diff --git a/1001-anolis-python-support-loongarch64.patch b/1001-anolis-python-support-loongarch64.patch new file mode 100644 index 0000000..7528294 --- /dev/null +++ b/1001-anolis-python-support-loongarch64.patch @@ -0,0 +1,12 @@ +diff -Nurp Python-3.8.3.orig/configure.ac Python-3.8.3/configure.ac +--- Python-3.8.3.orig/configure.ac 2021-01-20 01:59:43.644531250 +0000 ++++ Python-3.8.3/configure.ac 2021-01-20 02:49:57.824218750 +0000 +@@ -830,6 +830,8 @@ cat >> conftest.c < - 3.8.16-1.0.1.1 - Rebrand for Anolis OS +- Support loongarch64 platform * Wed May 31 2023 Charalampos Stratakis - 3.8.16-1.1 - Security fix for CVE-2023-24329 -- Gitee