<div dir="ltr"><div>Python 3.8.0 is now out, so we should upgrade directly to that version.</div><div><br></div><div>Alex<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 23 Oct 2019 at 12:37, Adrian Bunk <<a href="mailto:bunk@stusta.de">bunk@stusta.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Backported patch removed.<br>
<br>
Signed-off-by: Adrian Bunk <<a href="mailto:bunk@stusta.de" target="_blank">bunk@stusta.de</a>><br>
---<br>
...lib-as-location-for-site-packages-an.patch | 2 +-<br>
...nt-parse-domains-containing-GH-13079.patch | 132 ------------------<br>
...asename-to-replace-CC-for-checking-c.patch | 2 +-<br>
.../{<a href="http://python3_3.7.4.bb" rel="noreferrer" target="_blank">python3_3.7.4.bb</a> => <a href="http://python3_3.7.5.bb" rel="noreferrer" target="_blank">python3_3.7.5.bb</a>} | 5 +-<br>
4 files changed, 4 insertions(+), 137 deletions(-)<br>
delete mode 100644 meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch<br>
rename meta/recipes-devtools/python/{<a href="http://python3_3.7.4.bb" rel="noreferrer" target="_blank">python3_3.7.4.bb</a> => <a href="http://python3_3.7.5.bb" rel="noreferrer" target="_blank">python3_3.7.5.bb</a>} (98%)<br>
<br>
diff --git a/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch b/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch<br>
index 661f52d01f..ea75262c4f 100644<br>
--- a/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch<br>
+++ b/meta/recipes-devtools/python/python3/0001-Do-not-hardcode-lib-as-location-for-site-packages-an.patch<br>
@@ -70,7 +70,7 @@ index 6e81b2f..671a20e 100644<br>
<br>
Programs/python.o: $(srcdir)/Programs/python.c<br>
@@ -856,7 +857,7 @@ regen-opcode:<br>
- Python/compile.o Python/symtable.o Python/ast_unparse.o Python/ast.o: $(srcdir)/Include/graminit.h $(srcdir)/Include/Python-ast.h<br>
+ Python/compile.o Python/symtable.o Python/ast_unparse.o Python/ast.o Python/future.o Parser/parsetok.o: $(srcdir)/Include/graminit.h $(srcdir)/Include/Python-ast.h<br>
<br>
Python/getplatform.o: $(srcdir)/Python/getplatform.c<br>
- $(CC) -c $(PY_CORE_CFLAGS) -DPLATFORM='"$(MACHDEP)"' -o $@ $(srcdir)/Python/getplatform.c<br>
diff --git a/meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch b/meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch<br>
deleted file mode 100644<br>
index 319e7ed07e..0000000000<br>
--- a/meta/recipes-devtools/python/python3/0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch<br>
+++ /dev/null<br>
@@ -1,132 +0,0 @@<br>
-From 90d56127ae15b1e452755e62c77dc475dedf7161 Mon Sep 17 00:00:00 2001<br>
-From: jpic <<a href="mailto:jpic@users.noreply.github.com" target="_blank">jpic@users.noreply.github.com</a>><br>
-Date: Wed, 17 Jul 2019 23:54:25 +0200<br>
-Subject: [PATCH] bpo-34155: Dont parse domains containing @ (GH-13079)<br>
-<br>
-Before:<br>
-<br>
- >>> email.message_from_string('From: a@malicious.org@<a href="http://important.com" rel="noreferrer" target="_blank">important.com</a>', policy=email.policy.default)['from'].addresses<br>
- (Address(display_name='', username='a', domain='<a href="http://malicious.org" rel="noreferrer" target="_blank">malicious.org</a>'),)<br>
-<br>
- >>> parseaddr('a@malicious.org@<a href="http://important.com" rel="noreferrer" target="_blank">important.com</a>')<br>
- ('', '<a href="mailto:a@malicious.org" target="_blank">a@malicious.org</a>')<br>
-<br>
- After:<br>
-<br>
- >>> email.message_from_string('From: a@malicious.org@<a href="http://important.com" rel="noreferrer" target="_blank">important.com</a>', policy=email.policy.default)['from'].addresses<br>
- (Address(display_name='', username='', domain=''),)<br>
-<br>
- >>> parseaddr('a@malicious.org@<a href="http://important.com" rel="noreferrer" target="_blank">important.com</a>')<br>
- ('', 'a@')<br>
-<br>
-<a href="https://bugs.python.org/issue34155" rel="noreferrer" target="_blank">https://bugs.python.org/issue34155</a><br>
-<br>
-Upstream-Status: Backport [<a href="https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9" rel="noreferrer" target="_blank">https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9</a>]<br>
-<br>
-CVE: CVE-2019-16056<br>
-<br>
-Signed-off-by: Chen Qi <<a href="mailto:Qi.Chen@windriver.com" target="_blank">Qi.Chen@windriver.com</a>><br>
----<br>
- Lib/email/_header_value_parser.py | 2 ++<br>
- Lib/email/_parseaddr.py | 11 ++++++++++-<br>
- Lib/test/test_email/test__header_value_parser.py | 10 ++++++++++<br>
- Lib/test/test_email/test_email.py | 14 ++++++++++++++<br>
- .../2019-05-04-13-33-37.bpo-34155.MJll68.rst | 1 +<br>
- 5 files changed, 37 insertions(+), 1 deletion(-)<br>
- create mode 100644 Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst<br>
-<br>
-diff --git a/Lib/email/_header_value_parser.py b/Lib/email/_header_value_parser.py<br>
-index fc00b4a098..bbc026ec71 100644<br>
---- a/Lib/email/_header_value_parser.py<br>
-+++ b/Lib/email/_header_value_parser.py<br>
-@@ -1582,6 +1582,8 @@ def get_domain(value):<br>
- token, value = get_dot_atom(value)<br>
- except errors.HeaderParseError:<br>
- token, value = get_atom(value)<br>
-+ if value and value[0] == '@':<br>
-+ raise errors.HeaderParseError('Invalid Domain')<br>
- if leader is not None:<br>
- token[:0] = [leader]<br>
- domain.append(token)<br>
-diff --git a/Lib/email/_parseaddr.py b/Lib/email/_parseaddr.py<br>
-index cdfa3729ad..41ff6f8c00 100644<br>
---- a/Lib/email/_parseaddr.py<br>
-+++ b/Lib/email/_parseaddr.py<br>
-@@ -379,7 +379,12 @@ class AddrlistClass:<br>
- aslist.append('@')<br>
- self.pos += 1<br>
- self.gotonext()<br>
-- return EMPTYSTRING.join(aslist) + self.getdomain()<br>
-+ domain = self.getdomain()<br>
-+ if not domain:<br>
-+ # Invalid domain, return an empty address instead of returning a<br>
-+ # local part to denote failed parsing.<br>
-+ return EMPTYSTRING<br>
-+ return EMPTYSTRING.join(aslist) + domain<br>
- <br>
- def getdomain(self):<br>
- """Get the complete domain name from an address."""<br>
-@@ -394,6 +399,10 @@ class AddrlistClass:<br>
- elif self.field[self.pos] == '.':<br>
- self.pos += 1<br>
- sdlist.append('.')<br>
-+ elif self.field[self.pos] == '@':<br>
-+ # bpo-34155: Don't parse domains with two `@` like<br>
-+ # `a@malicious.org@<a href="http://important.com" rel="noreferrer" target="_blank">important.com</a>`.<br>
-+ return EMPTYSTRING<br>
- elif self.field[self.pos] in self.atomends:<br>
- break<br>
- else:<br>
-diff --git a/Lib/test/test_email/test__header_value_parser.py b/Lib/test/test_email/test__header_value_parser.py<br>
-index 693487bc96..7dc4de1b7b 100644<br>
---- a/Lib/test/test_email/test__header_value_parser.py<br>
-+++ b/Lib/test/test_email/test__header_value_parser.py<br>
-@@ -1438,6 +1438,16 @@ class TestParser(TestParserMixin, TestEmailBase):<br>
- self.assertEqual(addr_spec.domain, '<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a>')<br>
- self.assertEqual(addr_spec.addr_spec, '<a href="mailto:star.a.star@example.com" target="_blank">star.a.star@example.com</a>')<br>
- <br>
-+ def test_get_addr_spec_multiple_domains(self):<br>
-+ with self.assertRaises(errors.HeaderParseError):<br>
-+ parser.get_addr_spec('star@a.star@<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a>')<br>
-+<br>
-+ with self.assertRaises(errors.HeaderParseError):<br>
-+ parser.get_addr_spec('star@a@<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a>')<br>
-+<br>
-+ with self.assertRaises(errors.HeaderParseError):<br>
-+ parser.get_addr_spec('star@172.17.0.1@<a href="http://example.com" rel="noreferrer" target="_blank">example.com</a>')<br>
-+<br>
- # get_obs_route<br>
- <br>
- def test_get_obs_route_simple(self):<br>
-diff --git a/Lib/test/test_email/test_email.py b/Lib/test/test_email/test_email.py<br>
-index c29cc56203..aa775881c5 100644<br>
---- a/Lib/test/test_email/test_email.py<br>
-+++ b/Lib/test/test_email/test_email.py<br>
-@@ -3041,6 +3041,20 @@ class TestMiscellaneous(TestEmailBase):<br>
- self.assertEqual(utils.parseaddr('<>'), ('', ''))<br>
- self.assertEqual(utils.formataddr(utils.parseaddr('<>')), '')<br>
- <br>
-+ def test_parseaddr_multiple_domains(self):<br>
-+ self.assertEqual(<br>
-+ utils.parseaddr('a@b@c'),<br>
-+ ('', '')<br>
-+ )<br>
-+ self.assertEqual(<br>
-+ utils.parseaddr('a@b.c@c'),<br>
-+ ('', '')<br>
-+ )<br>
-+ self.assertEqual(<br>
-+ utils.parseaddr('a@172.17.0.1@c'),<br>
-+ ('', '')<br>
-+ )<br>
-+<br>
- def test_noquote_dump(self):<br>
- self.assertEqual(<br>
- utils.formataddr(('A Silly Person', 'person@dom.ain')),<br>
-diff --git a/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst<br>
-new file mode 100644<br>
-index 0000000000..50292e29ed<br>
---- /dev/null<br>
-+++ b/Misc/NEWS.d/next/Security/2019-05-04-13-33-37.bpo-34155.MJll68.rst<br>
-@@ -0,0 +1 @@<br>
-+Fix parsing of invalid email addresses with more than one ``@`` (e.g. a@b@<a href="http://c.com" rel="noreferrer" target="_blank">c.com</a>.) to not return the part before 2nd ``@`` as valid email address. Patch by maxking & jpic.<br>
diff --git a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch<br>
index 5735954628..a0ea897f4e 100644<br>
--- a/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch<br>
+++ b/meta/recipes-devtools/python/python3/0001-python3-use-cc_basename-to-replace-CC-for-checking-c.patch<br>
@@ -63,7 +63,7 @@ index a7de901..4a3681f 100644<br>
+ case $cc_basename in<br>
*clang*)<br>
AC_SUBST(LLVM_AR)<br>
- AC_PATH_TARGET_TOOL(LLVM_AR, llvm-ar, '', ${llvm_path})<br>
+ AC_PATH_TOOL(LLVM_AR, llvm-ar, '', ${llvm_path})<br>
@@ -1426,7 +1427,7 @@ then<br>
fi<br>
fi<br>
diff --git a/meta/recipes-devtools/python/<a href="http://python3_3.7.4.bb" rel="noreferrer" target="_blank">python3_3.7.4.bb</a> b/meta/recipes-devtools/python/<a href="http://python3_3.7.5.bb" rel="noreferrer" target="_blank">python3_3.7.5.bb</a><br>
similarity index 98%<br>
rename from meta/recipes-devtools/python/<a href="http://python3_3.7.4.bb" rel="noreferrer" target="_blank">python3_3.7.4.bb</a><br>
rename to meta/recipes-devtools/python/<a href="http://python3_3.7.5.bb" rel="noreferrer" target="_blank">python3_3.7.5.bb</a><br>
index 8c429e95c3..0338fa4ba8 100644<br>
--- a/meta/recipes-devtools/python/<a href="http://python3_3.7.4.bb" rel="noreferrer" target="_blank">python3_3.7.4.bb</a><br>
+++ b/meta/recipes-devtools/python/<a href="http://python3_3.7.5.bb" rel="noreferrer" target="_blank">python3_3.7.5.bb</a><br>
@@ -29,7 +29,6 @@ SRC_URI = "<a href="http://www.python.org/ftp/python/$%7BPV%7D/Python-$%7BPV%7D.tar.xz" rel="noreferrer" target="_blank">http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz</a> \<br>
file://0001-Use-FLAG_REF-always-for-interned-strings.patch \<br>
file://0001-test_locale.py-correct-the-test-output-format.patch \<br>
file://0017-setup.py-do-not-report-missing-dependencies-for-disa.patch \<br>
- file://0001-bpo-34155-Dont-parse-domains-containing-GH-13079.patch \<br>
"<br>
<br>
SRC_URI_append_class-native = " \<br>
@@ -40,8 +39,8 @@ SRC_URI_append_class-nativesdk = " \<br>
file://0001-main.c-if-OEPYTHON3HOME-is-set-use-instead-of-PYTHON.patch \<br>
"<br>
<br>
-SRC_URI[md5sum] = "d33e4aae66097051c2eca45ee3604803"<br>
-SRC_URI[sha256sum] = "fb799134b868199930b75f26678f18932214042639cd52b16da7fd134cd9b13f"<br>
+SRC_URI[md5sum] = "08ed8030b1183107c48f2092e79a87e2"<br>
+SRC_URI[sha256sum] = "e85a76ea9f3d6c485ec1780fca4e500725a4a7bbc63c78ebc44170de9b619d94"<br>
<br>
# exclude pre-releases for both python 2.x and 3.x<br>
UPSTREAM_CHECK_REGEX = "[Pp]ython-(?P<pver>\d+(\.\d+)+).tar"<br>
-- <br>
2.17.1<br>
<br>
-- <br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org" target="_blank">Openembedded-core@lists.openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</blockquote></div>