python: bump to version 2.7.16

This change updates Python to version 2.7.16, which is a bugfix release
in the Python 2.7 series.
This also removes patches back-ported from upstream.

Signed-off-by: Alexandru Ardelean <redacted>

diff --git a/lang/python/python-version.mk b/lang/python/python-version.mk
index b04f763f2e2d0f3ab742a0b6804502c3a2558fc0..cba9255f4b0ce8326955dc2c7d4cfd1ce0ae6086 100644 (file)
--- a/lang/python/python-version.mk
+++ b/lang/python/python-version.mk
@@ -6,10 +6,10 @@
 #
 
 PYTHON_VERSION:=2.7
-PYTHON_VERSION_MICRO:=15
+PYTHON_VERSION_MICRO:=16
 
-PYTHON_SETUPTOOLS_PKG_RELEASE:=2
-PYTHON_PIP_PKG_RELEASE:=2
+PYTHON_SETUPTOOLS_PKG_RELEASE:=1
+PYTHON_PIP_PKG_RELEASE:=1
 
-PYTHON_SETUPTOOLS_VERSION:=39.0.1
-PYTHON_PIP_VERSION:=9.0.3
+PYTHON_SETUPTOOLS_VERSION:=40.6.2
+PYTHON_PIP_VERSION:=18.1

diff --git a/lang/python/python/Makefile b/lang/python/python/Makefile
index 69ccf3adf5d1ff3554af407021109ab694b6ccac..36a6cc09f04581e57aaed8c0c6426923d94d734b 100644 (file)
--- a/lang/python/python/Makefile
+++ b/lang/python/python/Makefile
@@ -12,11 +12,11 @@ include ../python-version.mk
 
 PKG_NAME:=python
 PKG_VERSION:=$(PYTHON_VERSION).$(PYTHON_VERSION_MICRO)
-PKG_RELEASE:=5
+PKG_RELEASE:=1
 
 PKG_SOURCE:=Python-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://www.python.org/ftp/python/$(PKG_VERSION)
-PKG_HASH:=22d9b1ac5b26135ad2b8c2901a9413537e08749a753356ee913c84dbd2df5574
+PKG_HASH:=f222ef602647eecb6853681156d32de4450a2c39f4de93bd5b20235f2e660ed7
 
 PKG_LICENSE:=PSF
 PKG_LICENSE_FILES:=LICENSE Modules/_ctypes/libffi_msvc/LICENSE Modules/_ctypes/darwin/LICENSE Modules/_ctypes/libffi/LICENSE Modules/_ctypes/libffi_osx/LICENSE Tools/pybench/LICENSE

diff --git a/lang/python/python/patches/014-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch b/lang/python/python/patches/014-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch
deleted file mode 100644 (file)
index b290a28..0000000
--- a/lang/python/python/patches/014-2.7-bpo-34623-Use-XML_SetHashSalt-in-_elementtree-GH.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-From 18b20bad75b4ff0486940fba4ec680e96e70f3a2 Mon Sep 17 00:00:00 2001
-From: Christian Heimes <christian@python.org>
-Date: Tue, 18 Sep 2018 15:13:09 +0200
-Subject: [PATCH] [2.7] bpo-34623: Use XML_SetHashSalt in _elementtree
- (GH-9146) (GH-9394)
-
-The C accelerated _elementtree module now initializes hash randomization
-salt from _Py_HashSecret instead of libexpat's default CPRNG.
-
-Signed-off-by: Christian Heimes <christian@python.org>
-
-https://bugs.python.org/issue34623.
-(cherry picked from commit cb5778f00ce48631c7140f33ba242496aaf7102b)
-
-Co-authored-by: Christian Heimes <christian@python.org>
-
-
-
-https://bugs.python.org/issue34623
----
- Include/pyexpat.h                                            | 4 +++-
- .../next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst   | 2 ++
- Modules/_elementtree.c                                       | 5 +++++
- Modules/pyexpat.c                                            | 5 +++++
- 4 files changed, 15 insertions(+), 1 deletion(-)
- create mode 100644 Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
-
-diff --git a/Include/pyexpat.h b/Include/pyexpat.h
-index 5340ef5fa3..3fc5fa54da 100644
---- a/Include/pyexpat.h
-+++ b/Include/pyexpat.h
-@@ -3,7 +3,7 @@
- 
- /* note: you must import expat.h before importing this module! */
- 
--#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.0"
-+#define PyExpat_CAPI_MAGIC  "pyexpat.expat_CAPI 1.1"
- #define PyExpat_CAPSULE_NAME "pyexpat.expat_CAPI"
- 
- struct PyExpat_CAPI 
-@@ -43,6 +43,8 @@ struct PyExpat_CAPI
-         XML_Parser parser, XML_UnknownEncodingHandler handler,
-         void *encodingHandlerData);
-     void (*SetUserData)(XML_Parser parser, void *userData);
-+    /* might be none for expat < 2.1.0 */
-+    int (*SetHashSalt)(XML_Parser parser, unsigned long hash_salt);
-     /* always add new stuff to the end! */
- };
- 
-diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
-new file mode 100644
-index 0000000000..31ad92ef85
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
-@@ -0,0 +1,2 @@
-+The C accelerated _elementtree module now initializes hash randomization
-+salt from _Py_HashSecret instead of libexpat's default CSPRNG.
-diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
-index f7f992dd3a..b38e0ab329 100644
---- a/Modules/_elementtree.c
-+++ b/Modules/_elementtree.c
-@@ -2574,6 +2574,11 @@ xmlparser(PyObject* self_, PyObject* args, PyObject* kw)
-         PyErr_NoMemory();
-         return NULL;
-     }
-+    /* expat < 2.1.0 has no XML_SetHashSalt() */
-+    if (EXPAT(SetHashSalt) != NULL) {
-+        EXPAT(SetHashSalt)(self->parser,
-+                           (unsigned long)_Py_HashSecret.prefix);
-+    }
- 
-     ALLOC(sizeof(XMLParserObject), "create expatparser");
- 
-diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
-index 2b4d31293c..1f8c0d70a5 100644
---- a/Modules/pyexpat.c
-+++ b/Modules/pyexpat.c
-@@ -2042,6 +2042,11 @@ MODULE_INITFUNC(void)
-     capi.SetProcessingInstructionHandler = XML_SetProcessingInstructionHandler;
-     capi.SetUnknownEncodingHandler = XML_SetUnknownEncodingHandler;
-     capi.SetUserData = XML_SetUserData;
-+#if XML_COMBINED_VERSION >= 20100
-+    capi.SetHashSalt = XML_SetHashSalt;
-+#else
-+    capi.SetHashSalt = NULL;
-+#endif
- 
-     /* export using capsule */
-     capi_object = PyCapsule_New(&capi, PyExpat_CAPSULE_NAME, NULL);
--- 
-2.19.1
-

diff --git a/lang/python/python/patches/015-2.7-bpo-34623-Mention-CVE-2018-14647-in-news-entry-G.patch b/lang/python/python/patches/015-2.7-bpo-34623-Mention-CVE-2018-14647-in-news-entry-G.patch
deleted file mode 100644 (file)
index 5d7f201..0000000
--- a/lang/python/python/patches/015-2.7-bpo-34623-Mention-CVE-2018-14647-in-news-entry-G.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 10be1d3f802b874914b2a13eb41407c7a582d9b3 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Fri, 21 Sep 2018 21:57:00 -0700
-Subject: [PATCH] [2.7] bpo-34623: Mention CVE-2018-14647 in news entry
- (GH-9482) (GH-9490)
-
-https://bugs.python.org/issue34623
-(cherry picked from commit 026337a7101369297c8083047d2f3c6fc9dd1e2b)
-
-
-Co-authored-by: Christian Heimes <christian@python.org>
-
-
-https://bugs.python.org/issue34623
----
- .../next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst    | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
-index 31ad92ef85..cbaa4b7506 100644
---- a/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
-+++ b/Misc/NEWS.d/next/Security/2018-09-10-16-05-39.bpo-34623.Ua9jMv.rst
-@@ -1,2 +1,2 @@
--The C accelerated _elementtree module now initializes hash randomization
--salt from _Py_HashSecret instead of libexpat's default CSPRNG.
-+CVE-2018-14647: The C accelerated _elementtree module now initializes hash
-+randomization salt from _Py_HashSecret instead of libexpat's default CSPRNG.
--- 
-2.19.1
-

diff --git a/lang/python/python/patches/018-bpo-35746-Fix-segfault-in-ssl-s-cert-parser-GH-11569.patch b/lang/python/python/patches/018-bpo-35746-Fix-segfault-in-ssl-s-cert-parser-GH-11569.patch
deleted file mode 100644 (file)
index 05e0ae6..0000000
--- a/lang/python/python/patches/018-bpo-35746-Fix-segfault-in-ssl-s-cert-parser-GH-11569.patch
+++ /dev/null
@@ -1,120 +0,0 @@
-From 06b15424b0dcacb1c551b2a36e739fffa8d0c595 Mon Sep 17 00:00:00 2001
-From: "Miss Islington (bot)"
- <31488909+miss-islington@users.noreply.github.com>
-Date: Tue, 15 Jan 2019 15:11:52 -0800
-Subject: [PATCH] bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
-
-Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
-distribution points with empty DP or URI correctly. A malicious or buggy
-certificate can result into segfault.
-
-Signed-off-by: Christian Heimes <christian@python.org>
-
-https://bugs.python.org/issue35746
-(cherry picked from commit a37f52436f9aa4b9292878b72f3ff1480e2606c3)
-
-Co-authored-by: Christian Heimes <christian@python.org>
----
- Lib/test/talos-2019-0758.pem                  | 22 +++++++++++++++++++
- Lib/test/test_ssl.py                          | 22 +++++++++++++++++++
- .../2019-01-15-18-16-05.bpo-35746.nMSd0j.rst  |  3 +++
- Modules/_ssl.c                                |  4 ++++
- 4 files changed, 51 insertions(+)
- create mode 100644 Lib/test/talos-2019-0758.pem
- create mode 100644 Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst
-
-diff --git a/Lib/test/talos-2019-0758.pem b/Lib/test/talos-2019-0758.pem
-new file mode 100644
-index 0000000000..13b95a77fd
---- /dev/null
-+++ b/Lib/test/talos-2019-0758.pem
-@@ -0,0 +1,22 @@
-+-----BEGIN CERTIFICATE-----
-+MIIDqDCCApKgAwIBAgIBAjALBgkqhkiG9w0BAQswHzELMAkGA1UEBhMCVUsxEDAO
-+BgNVBAMTB2NvZHktY2EwHhcNMTgwNjE4MTgwMDU4WhcNMjgwNjE0MTgwMDU4WjA7
-+MQswCQYDVQQGEwJVSzEsMCoGA1UEAxMjY29kZW5vbWljb24tdm0tMi50ZXN0Lmxh
-+bC5jaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC63fGB
-+J80A9Av1GB0bptslKRIUtJm8EeEu34HkDWbL6AJY0P8WfDtlXjlPaLqFa6sqH6ES
-+V48prSm1ZUbDSVL8R6BYVYpOlK8/48xk4pGTgRzv69gf5SGtQLwHy8UPBKgjSZoD
-+5a5k5wJXGswhKFFNqyyxqCvWmMnJWxXTt2XDCiWc4g4YAWi4O4+6SeeHVAV9rV7C
-+1wxqjzKovVe2uZOHjKEzJbbIU6JBPb6TRfMdRdYOw98n1VXDcKVgdX2DuuqjCzHP
-+WhU4Tw050M9NaK3eXp4Mh69VuiKoBGOLSOcS8reqHIU46Reg0hqeL8LIL6OhFHIF
-+j7HR6V1X6F+BfRS/AgMBAAGjgdYwgdMwCQYDVR0TBAIwADAdBgNVHQ4EFgQUOktp
-+HQjxDXXUg8prleY9jeLKeQ4wTwYDVR0jBEgwRoAUx6zgPygZ0ZErF9sPC4+5e2Io
-+UU+hI6QhMB8xCzAJBgNVBAYTAlVLMRAwDgYDVQQDEwdjb2R5LWNhggkA1QEAuwb7
-+2s0wCQYDVR0SBAIwADAuBgNVHREEJzAlgiNjb2Rlbm9taWNvbi12bS0yLnRlc3Qu
-+bGFsLmNpc2NvLmNvbTAOBgNVHQ8BAf8EBAMCBaAwCwYDVR0fBAQwAjAAMAsGCSqG
-+SIb3DQEBCwOCAQEAvqantx2yBlM11RoFiCfi+AfSblXPdrIrHvccepV4pYc/yO6p
-+t1f2dxHQb8rWH3i6cWag/EgIZx+HJQvo0rgPY1BFJsX1WnYf1/znZpkUBGbVmlJr
-+t/dW1gSkNS6sPsM0Q+7HPgEv8CPDNK5eo7vU2seE0iWOkxSyVUuiCEY9ZVGaLVit
-+p0C78nZ35Pdv4I+1cosmHl28+es1WI22rrnmdBpH8J1eY6WvUw2xuZHLeNVN0TzV
-+Q3qq53AaCWuLOD1AjESWuUCxMZTK9DPS4JKXTK8RLyDeqOvJGjsSWp3kL0y3GaQ+
-+10T1rfkKJub2+m9A9duin1fn6tHc2wSvB7m3DA==
-+-----END CERTIFICATE-----
-diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
-index e476031702..9240184d98 100644
---- a/Lib/test/test_ssl.py
-+++ b/Lib/test/test_ssl.py
-@@ -72,6 +72,7 @@ NONEXISTINGCERT = data_file("XXXnonexisting.pem")
- BADKEY = data_file("badkey.pem")
- NOKIACERT = data_file("nokia.pem")
- NULLBYTECERT = data_file("nullbytecert.pem")
-+TALOS_INVALID_CRLDP = data_file("talos-2019-0758.pem")
- 
- DHFILE = data_file("ffdh3072.pem")
- BYTES_DHFILE = DHFILE.encode(sys.getfilesystemencoding())
-@@ -227,6 +228,27 @@ class BasicSocketTests(unittest.TestCase):
-         self.assertEqual(p['crlDistributionPoints'],
-                          ('http://SVRIntl-G3-crl.verisign.com/SVRIntlG3.crl',))
- 
-+    def test_parse_cert_CVE_2019_5010(self):
-+        p = ssl._ssl._test_decode_cert(TALOS_INVALID_CRLDP)
-+        if support.verbose:
-+            sys.stdout.write("\n" + pprint.pformat(p) + "\n")
-+        self.assertEqual(
-+            p,
-+            {
-+                'issuer': (
-+                    (('countryName', 'UK'),), (('commonName', 'cody-ca'),)),
-+                'notAfter': 'Jun 14 18:00:58 2028 GMT',
-+                'notBefore': 'Jun 18 18:00:58 2018 GMT',
-+                'serialNumber': '02',
-+                'subject': ((('countryName', 'UK'),),
-+                            (('commonName',
-+                              'codenomicon-vm-2.test.lal.cisco.com'),)),
-+                'subjectAltName': (
-+                    ('DNS', 'codenomicon-vm-2.test.lal.cisco.com'),),
-+                'version': 3
-+            }
-+        )
-+
-     def test_parse_cert_CVE_2013_4238(self):
-         p = ssl._ssl._test_decode_cert(NULLBYTECERT)
-         if support.verbose:
-diff --git a/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst b/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst
-new file mode 100644
-index 0000000000..dffe347eec
---- /dev/null
-+++ b/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst
-@@ -0,0 +1,3 @@
-+[CVE-2019-5010] Fix a NULL pointer deref in ssl module. The cert parser did
-+not handle CRL distribution points with empty DP or URI correctly. A
-+malicious or buggy certificate can result into segfault.
-diff --git a/Modules/_ssl.c b/Modules/_ssl.c
-index a96c419260..19bb1207b4 100644
---- a/Modules/_ssl.c
-+++ b/Modules/_ssl.c
-@@ -1223,6 +1223,10 @@ _get_crl_dp(X509 *certificate) {
-         STACK_OF(GENERAL_NAME) *gns;
- 
-         dp = sk_DIST_POINT_value(dps, i);
-+        if (dp->distpoint == NULL) {
-+            /* Ignore empty DP value, CVE-2019-5010 */
-+            continue;
-+        }
-         gns = dp->distpoint->name.fullname;
- 
-         for (j=0; j < sk_GENERAL_NAME_num(gns); j++) {
--- 
-2.17.1
-