Copy the second part of a change previously made to python27 [1], to
python31, python32 and python33.
This fixes staging and packaging of these ports by a non-root user by
running ranlib on the archive prior to it being installed read-only.
While I'm here:
- python27: Add breadcrumbs and references to the patch header
- python34: Update breadcrumbs and references to the patch header
[1] https://svnweb.freebsd.org/ports?view=revision&revision=350207
Submitted by: antoine
Reviewed by: kwm, sbz
Copy change committed to python27 [1] to python31, python32 and
python33 to fix builds of some extensions with Clang 3.4.
Also add breadcrumbs to the patch header in lang/python27 referencing
the upstream issue. [2]
The Python 3.4 port (lang/python34) already carries the patch.
[1] https://svnweb.freebsd.org/ports?view=revision&revision=346428
[2] http://bugs.python.org/issue20767
- pycompile only once, previously it would pycompile 3 imported modules
(getopt, struct and py_compile) and make them read-only, and later try
to pycompile them again and fail
- ranlib before installing archive read-only
With hat: portmgr
A vulnerability was reported [1] in Python's socket module, due to a
boundary error within the sock_recvfrom_into() function, which could be
exploited to cause a buffer overflow.
This could be used to crash a Python application that uses the
socket.recvfrom_info() function or, possibly, execute arbitrary code
with the permissions of the user running vulnerable Python code.
This vulnerable function, socket.recvfrom_into(), was introduced in
Python 2.5. Earlier versions are not affected by this flaw. This is
fixed in upstream branches for version 2.7, 3.1, 3.2 and 3.3.
[1] http://bugs.python.org/issue20246
MFH: 2014Q1
Security: 8e5e6d42-a0fa-11e3-b09a-080027f2d077
The current FreeBSD/ARM __clear_cache() implementation does nothing #if
__i386__ || __x86_64__ #else abort();
cognet@ advises this is an issue for anything !Apple that is using the
libcompiler_rt provided by Clang on ARM, and requires upstreaming.
This is the root cause of abort() on import for the ctypes module in
Python, as they bundle libffi. [1]
This change patches the bundled libffi library in all Python ports, even
though it is a NOOP for the ports that use devel/libffi. These ports,
currently python31, will get the fix via ports/184517
A huge shout out to cognet@ who helped diagnose the issue and created
the patch to address it. Thank you!
PR: ports/149167 [1]
PR: ports/184517
Submitted by: cognet [3]
Reviewed by: cognet, eadler, milki, ak
lang/python26, lang/python27 and lang/python31 now add
ac_cv_opt_olimit_ok=no to CONFIGURE_ENV to disable functionality that
was removed in Python 3.2+ [1]
Pending a backport of the commit [2] to 2.7, we can now remove the
locally maintained patch to configure that disabled the functionality
when CC = clang.
Apart from being narrower in scope than ac_cv_opt_olimit_ok=no, the patch
doesn't work for FreeBSD versions where clang *is* cc (eg: 10.0+)
[1] http://hg.python.org/lookup/r85656
[2] http://bugs.python.org/issue877121
Reviewed by: antoine
. lang/python27: 2.7.3 -> 2.7.5
. lang/python32: 3.2.3 -> 3.2.4
. lang/python33: 3.3.0 -> 3.3.1
- update Mk/bsd.python.mk with new versions
- mark lang/python26 and lang/python31 as deprecated (set them to
upstream EoL dates)
- update docs (lang/python-doc-html)
- align databases/py-bsddb patch for python27 - most of it was applied
upstream. Raise BDB version to 4.3 atleast, according to
upstream requirements.
Many thanks to Martin (miwi) for his time on this update.
PR: 178506
Submitted by: rm (myself)
Exp-run by: portmgr (miwi)
- revert erroneous threads patch in lang/python26 and lang/python27,
that was added after ports/131080. It was rejected upstream, because it's
not actually a bug, but misuse.
Gabor Pali (pgj) in collaboration with Kubilay Kocak (koobs) did an
independent investigation regard the issue. See here for details:
http://lists.freebsd.org/pipermail/freebsd-python/2013-April/005376.html
PR: 153167
Submitted by: Duncan Findlay <duncan@duncf.ca>
Reported by: pgj/koobs (at python@ ML)
Exp-run by: portmgr (miwi)
for an exp-run of updated python versions.
- trim Makefile headers
- remove leading indefinite article from COMMENT
- use PYTHON shortcut in MASTER_SITES
- whitespace fixes
- remove checks for unsupported versions of FreeBSD
- use static value ``33'' instead of PYTHON_SUFFIX in lang/python33/pkg-plist,
because this value is not supposed to be changed across the branch and for
consistency with other python3 ports
- remove conflicts in lang/python-mode.el with not more existing python-2.4
and also add experimental support for POSIX semaphores in FreeBSD
7-STABLE and up. The option knobs PTH and SEM respectively are
added to enable this behaviour.
Python is able to use POSIX semaphores for thread synchronization
in threading, and prefers them.
The multiprocessing module in Python 2.6 requires POSIX semaphores,
however, the FreeBSD rtld and malloc need further work to allow
a process to call pthread_create() immediately after fork() as it is
not something allowed by a strict interpretation of the POSIX specs;
therefore allow GNU Pth to be used until the situation is resolved.
Approved by: miwi
runs its signal handlers, not to a random thread that happens to be
executing at the time when signal arrives. This functionality has been
lost since Python 2.3, possible cause is that the linux implementation
of POSIX threads always delivered signal to the main thread. This
bug results in rather annoying inability to terminate threading script
with ^C for example and there could be other issues as well.
Bump PORTREVISION.
PR: ports/131080
Submitted by: Andriy Pylypenko <bamby@sippysoft.com>
Approved by: MAINTAINER's timeout
Python 2.6 will be the next default python version when enough
testings of consumer ports are done. The new "2to3" program is
renamed to 2to3-2.6 and 2to3-3.0 for each version, respectively.
Repo-copied by: marcus
Multiple vulnerabilities:
1) Various integer overflow errors exist in core modules e.g. stringobject,
unicodeobject, bufferobject, longobject, tupleobject, stropmodule, gcmodule, mmapmodule.
2) An integer overflow in the hashlib module can lead to an unreliable cryptographic digest results.
3) Integer overflow errors in the processing of unicode strings can be exploited to cause
buffer overflows on 32-bit systems.
4) An integer overflow exists in the PyOS_vsnprintf() function on architectures that do not
have a "vsnprintf()" function.
5) An integer underflow error in the PyOS_vsnprintf() function when passing zero-length strings
can lead to memory corruption.
PR: 127172 (based on)
Submitted by: bf <bf2006a@yahoo.com>
Obtained from: python svn
Security: CVE-2008-2315, CVE-2008-2316, CVE-2008-3142, CVE-2008-3144, CVE-2008-3143. (vuxml come later)
when devel/ncurses installed.
- Similar to python24, don't pick up ncursesw in python25. This results
in both ncurses are linked into _curses.so
Tested by: krion
Approved by: alexbl (python@)
period. Python 2.5 brought a vast range of incompatibility to a
large number of ports, so the python@ team will do more basic
compatibility work in a private repository and merge it later.
Sorry for the inconvenience.
Approved by: portmgr (kris)
- Now, lang/python is just a meta-port which depends on lang/python25.
- And all versions of Python ports have short version identifier in its
package name; python25-2.5, python24-2.4.3 and etc.
- Also you must upgrade all python modules after lang/python updated,
cd /usr/ports/lang/python && make upgrade-site-packages
- Give maintainership of Python ports to the new python@ group which
includes me, alexbl@ and others.
- Provide USE_PYTHON_BUILD and USE_PYTHON_RUN to allow explicit
dependencies. [1]
- Provide PYDISTUTILS_CONFIGUREARGS and run ${PYSETUP} config on
'do-configure' targets. [2]
Reviewed by: eik [1]
Submitted by: Mike Brown <mike@skew.org>
expat 1.95.6 in its distribution from Python-2.3.
- Bump PORTREVISION subsequently.
Requested by: Mike Brown <mike@skew.org>
Jeremy Kloth <jeremy.kloth@fourthought.com>
