From d0243ad3154a60853829230ebd3518be968152fd Mon Sep 17 00:00:00 2001 From: Rmys Date: Mon, 18 Oct 2021 18:03:22 +0300 Subject: [PATCH] python3-idle-3.8.12 --- ...nX.Y.a-in-usr-lib-instead-of-usr-lib.patch | 81 +++++ ...exit-with-non-zero-status-on-failure.patch | 53 +++ .../0005-Improve-distutils-C-support.patch | 333 ++++++++++++++++++ ...-binary-I-O-to-avoid-encoding-issues.patch | 186 ++++++++++ ...O-enable-both-opt-1-and-opt-2-optimi.patch | 81 +++++ ...moryError-on-zip.read-in-shutil._unp.patch | 61 ++++ ...t-to-TLS-1.2-and-increase-cipher-sui.patch | 214 +++++++++++ .../language/python3/python3-idle/pspec.xml | 18 +- 8 files changed, 1024 insertions(+), 3 deletions(-) create mode 100644 programming/language/python3/python3-idle/files/gentoo/0001-Install-libpythonX.Y.a-in-usr-lib-instead-of-usr-lib.patch create mode 100644 programming/language/python3/python3-idle/files/gentoo/0004-setup.py-exit-with-non-zero-status-on-failure.patch create mode 100644 programming/language/python3/python3-idle/files/gentoo/0005-Improve-distutils-C-support.patch create mode 100644 programming/language/python3/python3-idle/files/gentoo/0006-h2py-use-binary-I-O-to-avoid-encoding-issues.patch create mode 100644 programming/language/python3/python3-idle/files/gentoo/0008-distutils-make-OO-enable-both-opt-1-and-opt-2-optimi.patch create mode 100644 programming/language/python3/python3-idle/files/gentoo/0016-bpo-43650-Fix-MemoryError-on-zip.read-in-shutil._unp.patch create mode 100644 programming/language/python3/python3-idle/files/gentoo/0017-bpo-43998-Default-to-TLS-1.2-and-increase-cipher-sui.patch diff --git a/programming/language/python3/python3-idle/files/gentoo/0001-Install-libpythonX.Y.a-in-usr-lib-instead-of-usr-lib.patch b/programming/language/python3/python3-idle/files/gentoo/0001-Install-libpythonX.Y.a-in-usr-lib-instead-of-usr-lib.patch new file mode 100644 index 0000000000..a4e467a504 --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0001-Install-libpythonX.Y.a-in-usr-lib-instead-of-usr-lib.patch @@ -0,0 +1,81 @@ +From cb8a5266fd6cef5f523f64f95905d684766c68de Mon Sep 17 00:00:00 2001 +From: Mike Gilbert +Date: Fri, 5 Jan 2018 13:28:45 -0500 +Subject: [PATCH 01/16] Install libpythonX.Y.a in /usr/lib instead of + /usr/lib/pythonX.Y/config + +https://bugs.gentoo.org/show_bug.cgi?id=252372 +https://bugs.python.org/issue6103 +--- + Makefile.pre.in | 4 ++-- + Misc/python-config.in | 6 ------ + Misc/python-config.sh.in | 6 +----- + Modules/makesetup | 2 +- + 4 files changed, 4 insertions(+), 14 deletions(-) + +diff --git a/Makefile.pre.in b/Makefile.pre.in +index 7e381283fe..37cbb02890 100644 +--- a/Makefile.pre.in ++++ b/Makefile.pre.in +@@ -1582,9 +1582,9 @@ libainstall: @DEF_MAKE_RULE@ python-config + @if test -d $(LIBRARY); then :; else \ + if test "$(PYTHONFRAMEWORKDIR)" = no-framework; then \ + if test "$(SHLIB_SUFFIX)" = .dll; then \ +- $(INSTALL_DATA) $(LDLIBRARY) $(DESTDIR)$(LIBPL) ; \ ++ $(INSTALL_DATA) $(LDLIBRARY) $(DESTDIR)$(LIBDIR) ; \ + else \ +- $(INSTALL_DATA) $(LIBRARY) $(DESTDIR)$(LIBPL)/$(LIBRARY) ; \ ++ $(INSTALL_DATA) $(LIBRARY) $(DESTDIR)$(LIBDIR)/$(LIBRARY) ; \ + fi; \ + else \ + echo Skip install of $(LIBRARY) - use make frameworkinstall; \ +diff --git a/Misc/python-config.in b/Misc/python-config.in +index 727c4a8682..bab60cf2d1 100644 +--- a/Misc/python-config.in ++++ b/Misc/python-config.in +@@ -56,12 +56,6 @@ for opt in opt_flags: + if libpython: + libs.append(libpython) + libs.extend(getvar('LIBS').split() + getvar('SYSLIBS').split()) +- +- # add the prefix/lib/pythonX.Y/config dir, but only if there is no +- # shared library in prefix/lib/. +- if opt == '--ldflags': +- if not getvar('Py_ENABLE_SHARED'): +- libs.insert(0, '-L' + getvar('LIBPL')) + print(' '.join(libs)) + + elif opt == '--extension-suffix': +diff --git a/Misc/python-config.sh.in b/Misc/python-config.sh.in +index 2602fe24c0..8ef19cade3 100644 +--- a/Misc/python-config.sh.in ++++ b/Misc/python-config.sh.in +@@ -97,11 +97,7 @@ do + echo "$LIBS" + ;; + --ldflags) +- LIBPLUSED= +- if [ "$PY_ENABLE_SHARED" = "0" ] ; then +- LIBPLUSED="-L$LIBPL" +- fi +- echo "$LIBPLUSED -L$libdir $LIBS" ++ echo "-L$libdir $LIBS" + ;; + --extension-suffix) + echo "$SO" +diff --git a/Modules/makesetup b/Modules/makesetup +index fefe3fd129..ec7f2c098b 100755 +--- a/Modules/makesetup ++++ b/Modules/makesetup +@@ -92,7 +92,7 @@ CYGWIN*) if test $libdir = . + then + ExtraLibDir=. + else +- ExtraLibDir='$(LIBPL)' ++ ExtraLibDir='$(LIBDIR)' + fi + ExtraLibs="-L$ExtraLibDir -lpython\$(LDVERSION)";; + esac +-- +2.33.0 + diff --git a/programming/language/python3/python3-idle/files/gentoo/0004-setup.py-exit-with-non-zero-status-on-failure.patch b/programming/language/python3/python3-idle/files/gentoo/0004-setup.py-exit-with-non-zero-status-on-failure.patch new file mode 100644 index 0000000000..8e8479c2d7 --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0004-setup.py-exit-with-non-zero-status-on-failure.patch @@ -0,0 +1,53 @@ +From dbb695267eb05999d2af3ce85200c3ebdf53b1e5 Mon Sep 17 00:00:00 2001 +From: Mike Gilbert +Date: Fri, 5 Jan 2018 13:32:45 -0500 +Subject: [PATCH 04/16] setup.py: exit with non-zero status on failure + +https://bugs.gentoo.org/show_bug.cgi?id=281968 +https://bugs.python.org/issue6731 +--- + setup.py | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/setup.py b/setup.py +index 53591bc1e6..2b362029ac 100644 +--- a/setup.py ++++ b/setup.py +@@ -86,6 +86,7 @@ Programming Language :: Python + Topic :: Software Development + """ + ++exit_status = 0 + + # Set common compiler and linker flags derived from the Makefile, + # reserved for building the interpreter and the stdlib modules. +@@ -430,7 +431,10 @@ class PyBuildExt(build_ext): + print_three_column([ext.name for ext in mods_disabled]) + print() + ++ global exit_status ++ + if self.failed: ++ exit_status = 1 + failed = self.failed[:] + print() + print("Failed to build these modules:") +@@ -438,6 +442,7 @@ class PyBuildExt(build_ext): + print() + + if self.failed_on_import: ++ exit_status = 1 + failed = self.failed_on_import[:] + print() + print("Following modules built successfully" +@@ -2415,6 +2420,7 @@ def main(): + scripts = ["Tools/scripts/pydoc3", "Tools/scripts/idle3", + "Tools/scripts/2to3"] + ) ++ sys.exit(exit_status) + + # --install-platlib + if __name__ == '__main__': +-- +2.33.0 + diff --git a/programming/language/python3/python3-idle/files/gentoo/0005-Improve-distutils-C-support.patch b/programming/language/python3/python3-idle/files/gentoo/0005-Improve-distutils-C-support.patch new file mode 100644 index 0000000000..af111a5a61 --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0005-Improve-distutils-C-support.patch @@ -0,0 +1,333 @@ +From 5082bf6ec57eed8680eac679f6c3e6908031b3f7 Mon Sep 17 00:00:00 2001 +From: Mike Gilbert +Date: Fri, 5 Jan 2018 13:34:21 -0500 +Subject: [PATCH 05/16] Improve distutils C++ support + +https://bugs.python.org/issue1222585 +--- + Lib/_osx_support.py | 6 +-- + Lib/distutils/cygwinccompiler.py | 21 ++++++++-- + Lib/distutils/sysconfig.py | 25 ++++++++--- + Lib/distutils/tests/test_sysconfig.py | 16 +++---- + Lib/distutils/unixccompiler.py | 60 +++++++++++++-------------- + Makefile.pre.in | 4 +- + 6 files changed, 80 insertions(+), 52 deletions(-) + +diff --git a/Lib/_osx_support.py b/Lib/_osx_support.py +index 9b127c2491..b13734a271 100644 +--- a/Lib/_osx_support.py ++++ b/Lib/_osx_support.py +@@ -14,13 +14,13 @@ __all__ = [ + # configuration variables that may contain universal build flags, + # like "-arch" or "-isdkroot", that may need customization for + # the user environment +-_UNIVERSAL_CONFIG_VARS = ('CFLAGS', 'LDFLAGS', 'CPPFLAGS', 'BASECFLAGS', +- 'BLDSHARED', 'LDSHARED', 'CC', 'CXX', ++_UNIVERSAL_CONFIG_VARS = ('CFLAGS', 'CXXFLAGS', 'LDFLAGS', 'CPPFLAGS', 'BASECFLAGS', ++ 'BLDSHARED', 'LDSHARED', 'LDCXXSHARED', 'CC', 'CXX', + 'PY_CFLAGS', 'PY_LDFLAGS', 'PY_CPPFLAGS', + 'PY_CORE_CFLAGS', 'PY_CORE_LDFLAGS') + + # configuration variables that may contain compiler calls +-_COMPILER_CONFIG_VARS = ('BLDSHARED', 'LDSHARED', 'CC', 'CXX') ++_COMPILER_CONFIG_VARS = ('BLDSHARED', 'LDSHARED', 'LDCXXSHARED', 'CC', 'CXX') + + # prefix added to original configuration variable names + _INITPRE = '_OSX_SUPPORT_INITIAL_' +diff --git a/Lib/distutils/cygwinccompiler.py b/Lib/distutils/cygwinccompiler.py +index 6c5d77746b..640fa2da34 100644 +--- a/Lib/distutils/cygwinccompiler.py ++++ b/Lib/distutils/cygwinccompiler.py +@@ -125,8 +125,10 @@ class CygwinCCompiler(UnixCCompiler): + # dllwrap 2.10.90 is buggy + if self.ld_version >= "2.10.90": + self.linker_dll = "gcc" ++ self.linker_dll_cxx = "g++" + else: + self.linker_dll = "dllwrap" ++ self.linker_dll_cxx = "dllwrap" + + # ld_version >= "2.13" support -shared so use it instead of + # -mdll -static +@@ -140,9 +142,13 @@ class CygwinCCompiler(UnixCCompiler): + self.set_executables(compiler='gcc -mcygwin -O -Wall', + compiler_so='gcc -mcygwin -mdll -O -Wall', + compiler_cxx='g++ -mcygwin -O -Wall', ++ compiler_so_cxx='g++ -mcygwin -mdll -O -Wall', + linker_exe='gcc -mcygwin', + linker_so=('%s -mcygwin %s' % +- (self.linker_dll, shared_option))) ++ (self.linker_dll, shared_option)), ++ linker_exe_cxx='g++ -mcygwin', ++ linker_so_cxx=('%s -mcygwin %s' % ++ (self.linker_dll_cxx, shared_option))) + + # cygwin and mingw32 need different sets of libraries + if self.gcc_version == "2.91.57": +@@ -166,8 +172,12 @@ class CygwinCCompiler(UnixCCompiler): + raise CompileError(msg) + else: # for other files use the C-compiler + try: +- self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + +- extra_postargs) ++ if self.detect_language(src) == 'c++': ++ self.spawn(self.compiler_so_cxx + cc_args + [src, '-o', obj] + ++ extra_postargs) ++ else: ++ self.spawn(self.compiler_so + cc_args + [src, '-o', obj] + ++ extra_postargs) + except DistutilsExecError as msg: + raise CompileError(msg) + +@@ -302,9 +312,14 @@ class Mingw32CCompiler(CygwinCCompiler): + self.set_executables(compiler='gcc -O -Wall', + compiler_so='gcc -mdll -O -Wall', + compiler_cxx='g++ -O -Wall', ++ compiler_so_cxx='g++ -mdll -O -Wall', + linker_exe='gcc', + linker_so='%s %s %s' + % (self.linker_dll, shared_option, ++ entry_point), ++ linker_exe_cxx='g++', ++ linker_so_cxx='%s %s %s' ++ % (self.linker_dll_cxx, shared_option, + entry_point)) + # Maybe we should also append -mthreads, but then the finished + # dlls need another dll (mingwm10.dll see Mingw32 docs) +diff --git a/Lib/distutils/sysconfig.py b/Lib/distutils/sysconfig.py +index b51629eb94..c00870fb0f 100644 +--- a/Lib/distutils/sysconfig.py ++++ b/Lib/distutils/sysconfig.py +@@ -187,9 +187,12 @@ def customize_compiler(compiler): + _osx_support.customize_compiler(_config_vars) + _config_vars['CUSTOMIZED_OSX_COMPILER'] = 'True' + +- (cc, cxx, cflags, ccshared, ldshared, shlib_suffix, ar, ar_flags) = \ +- get_config_vars('CC', 'CXX', 'CFLAGS', +- 'CCSHARED', 'LDSHARED', 'SHLIB_SUFFIX', 'AR', 'ARFLAGS') ++ (cc, cxx, ccshared, ldshared, ldcxxshared, shlib_suffix, ar, ar_flags) = \ ++ get_config_vars('CC', 'CXX', 'CCSHARED', 'LDSHARED', 'LDCXXSHARED', ++ 'SHLIB_SUFFIX', 'AR', 'ARFLAGS') ++ ++ cflags = '' ++ cxxflags = '' + + if 'CC' in os.environ: + newcc = os.environ['CC'] +@@ -204,19 +207,27 @@ def customize_compiler(compiler): + cxx = os.environ['CXX'] + if 'LDSHARED' in os.environ: + ldshared = os.environ['LDSHARED'] ++ if 'LDCXXSHARED' in os.environ: ++ ldcxxshared = os.environ['LDCXXSHARED'] + if 'CPP' in os.environ: + cpp = os.environ['CPP'] + else: + cpp = cc + " -E" # not always + if 'LDFLAGS' in os.environ: + ldshared = ldshared + ' ' + os.environ['LDFLAGS'] ++ ldcxxshared = ldcxxshared + ' ' + os.environ['LDFLAGS'] + if 'CFLAGS' in os.environ: +- cflags = cflags + ' ' + os.environ['CFLAGS'] ++ cflags = os.environ['CFLAGS'] + ldshared = ldshared + ' ' + os.environ['CFLAGS'] ++ if 'CXXFLAGS' in os.environ: ++ cxxflags = os.environ['CXXFLAGS'] ++ ldcxxshared = ldcxxshared + ' ' + os.environ['CXXFLAGS'] + if 'CPPFLAGS' in os.environ: + cpp = cpp + ' ' + os.environ['CPPFLAGS'] + cflags = cflags + ' ' + os.environ['CPPFLAGS'] ++ cxxflags = cxxflags + ' ' + os.environ['CPPFLAGS'] + ldshared = ldshared + ' ' + os.environ['CPPFLAGS'] ++ ldcxxshared = ldcxxshared + ' ' + os.environ['CPPFLAGS'] + if 'AR' in os.environ: + ar = os.environ['AR'] + if 'ARFLAGS' in os.environ: +@@ -225,13 +236,17 @@ def customize_compiler(compiler): + archiver = ar + ' ' + ar_flags + + cc_cmd = cc + ' ' + cflags ++ cxx_cmd = cxx + ' ' + cxxflags + compiler.set_executables( + preprocessor=cpp, + compiler=cc_cmd, + compiler_so=cc_cmd + ' ' + ccshared, +- compiler_cxx=cxx, ++ compiler_cxx=cxx_cmd, ++ compiler_so_cxx=cxx_cmd + ' ' + ccshared, + linker_so=ldshared, + linker_exe=cc, ++ linker_so_cxx=ldcxxshared, ++ linker_exe_cxx=cxx, + archiver=archiver) + + compiler.shared_lib_extension = shlib_suffix +diff --git a/Lib/distutils/tests/test_sysconfig.py b/Lib/distutils/tests/test_sysconfig.py +index 236755d095..1388728963 100644 +--- a/Lib/distutils/tests/test_sysconfig.py ++++ b/Lib/distutils/tests/test_sysconfig.py +@@ -114,12 +114,13 @@ class SysconfigTestCase(support.EnvironGuard, unittest.TestCase): + os.environ['AR'] = 'env_ar' + os.environ['CC'] = 'env_cc' + os.environ['CPP'] = 'env_cpp' +- os.environ['CXX'] = 'env_cxx --env-cxx-flags' ++ os.environ['CXX'] = 'env_cxx' + os.environ['LDSHARED'] = 'env_ldshared' + os.environ['LDFLAGS'] = '--env-ldflags' + os.environ['ARFLAGS'] = '--env-arflags' + os.environ['CFLAGS'] = '--env-cflags' + os.environ['CPPFLAGS'] = '--env-cppflags' ++ os.environ['CXXFLAGS'] = '--env-cxxflags' + + comp = self.customize_compiler() + self.assertEqual(comp.exes['archiver'], +@@ -127,12 +128,12 @@ class SysconfigTestCase(support.EnvironGuard, unittest.TestCase): + self.assertEqual(comp.exes['preprocessor'], + 'env_cpp --env-cppflags') + self.assertEqual(comp.exes['compiler'], +- 'env_cc --sc-cflags --env-cflags --env-cppflags') ++ 'env_cc --env-cflags --env-cppflags') + self.assertEqual(comp.exes['compiler_so'], +- ('env_cc --sc-cflags ' ++ ('env_cc ' + '--env-cflags ''--env-cppflags --sc-ccshared')) + self.assertEqual(comp.exes['compiler_cxx'], +- 'env_cxx --env-cxx-flags') ++ 'env_cxx --env-cxxflags --env-cppflags') + self.assertEqual(comp.exes['linker_exe'], + 'env_cc') + self.assertEqual(comp.exes['linker_so'], +@@ -149,6 +150,7 @@ class SysconfigTestCase(support.EnvironGuard, unittest.TestCase): + del os.environ['ARFLAGS'] + del os.environ['CFLAGS'] + del os.environ['CPPFLAGS'] ++ del os.environ['CXXFLAGS'] + + comp = self.customize_compiler() + self.assertEqual(comp.exes['archiver'], +@@ -156,11 +158,11 @@ class SysconfigTestCase(support.EnvironGuard, unittest.TestCase): + self.assertEqual(comp.exes['preprocessor'], + 'sc_cc -E') + self.assertEqual(comp.exes['compiler'], +- 'sc_cc --sc-cflags') ++ 'sc_cc ') + self.assertEqual(comp.exes['compiler_so'], +- 'sc_cc --sc-cflags --sc-ccshared') ++ 'sc_cc --sc-ccshared') + self.assertEqual(comp.exes['compiler_cxx'], +- 'sc_cxx') ++ 'sc_cxx ') + self.assertEqual(comp.exes['linker_exe'], + 'sc_cc') + self.assertEqual(comp.exes['linker_so'], +diff --git a/Lib/distutils/unixccompiler.py b/Lib/distutils/unixccompiler.py +index f0792de74a..16e7fbea83 100644 +--- a/Lib/distutils/unixccompiler.py ++++ b/Lib/distutils/unixccompiler.py +@@ -52,14 +52,17 @@ class UnixCCompiler(CCompiler): + # are pretty generic; they will probably have to be set by an outsider + # (eg. using information discovered by the sysconfig about building + # Python extensions). +- executables = {'preprocessor' : None, +- 'compiler' : ["cc"], +- 'compiler_so' : ["cc"], +- 'compiler_cxx' : ["cc"], +- 'linker_so' : ["cc", "-shared"], +- 'linker_exe' : ["cc"], +- 'archiver' : ["ar", "-cr"], +- 'ranlib' : None, ++ executables = {'preprocessor' : None, ++ 'compiler' : ["cc"], ++ 'compiler_so' : ["cc"], ++ 'compiler_cxx' : ["c++"], ++ 'compiler_so_cxx' : ["c++"], ++ 'linker_so' : ["cc", "-shared"], ++ 'linker_exe' : ["cc"], ++ 'linker_so_cxx' : ["c++", "-shared"], ++ 'linker_exe_cxx' : ["c++"], ++ 'archiver' : ["ar", "-cr"], ++ 'ranlib' : None, + } + + if sys.platform[:6] == "darwin": +@@ -110,12 +113,19 @@ class UnixCCompiler(CCompiler): + + def _compile(self, obj, src, ext, cc_args, extra_postargs, pp_opts): + compiler_so = self.compiler_so ++ compiler_so_cxx = self.compiler_so_cxx + if sys.platform == 'darwin': + compiler_so = _osx_support.compiler_fixup(compiler_so, + cc_args + extra_postargs) ++ compiler_so_cxx = _osx_support.compiler_fixup(compiler_so_cxx, ++ cc_args + extra_postargs) + try: +- self.spawn(compiler_so + cc_args + [src, '-o', obj] + +- extra_postargs) ++ if self.detect_language(src) == 'c++': ++ self.spawn(compiler_so_cxx + cc_args + [src, '-o', obj] + ++ extra_postargs) ++ else: ++ self.spawn(compiler_so + cc_args + [src, '-o', obj] + ++ extra_postargs) + except DistutilsExecError as msg: + raise CompileError(msg) + +@@ -173,30 +183,16 @@ class UnixCCompiler(CCompiler): + ld_args.extend(extra_postargs) + self.mkpath(os.path.dirname(output_filename)) + try: +- if target_desc == CCompiler.EXECUTABLE: +- linker = self.linker_exe[:] ++ if target_lang == "c++": ++ if target_desc == CCompiler.EXECUTABLE: ++ linker = self.linker_exe_cxx[:] ++ else: ++ linker = self.linker_so_cxx[:] + else: +- linker = self.linker_so[:] +- if target_lang == "c++" and self.compiler_cxx: +- # skip over environment variable settings if /usr/bin/env +- # is used to set up the linker's environment. +- # This is needed on OSX. Note: this assumes that the +- # normal and C++ compiler have the same environment +- # settings. +- i = 0 +- if os.path.basename(linker[0]) == "env": +- i = 1 +- while '=' in linker[i]: +- i += 1 +- +- if os.path.basename(linker[i]) == 'ld_so_aix': +- # AIX platforms prefix the compiler with the ld_so_aix +- # script, so we need to adjust our linker index +- offset = 1 ++ if target_desc == CCompiler.EXECUTABLE: ++ linker = self.linker_exe[:] + else: +- offset = 0 +- +- linker[i+offset] = self.compiler_cxx[i] ++ linker = self.linker_so[:] + + if sys.platform == 'darwin': + linker = _osx_support.compiler_fixup(linker, ld_args) +diff --git a/Makefile.pre.in b/Makefile.pre.in +index 37cbb02890..3d724dfb51 100644 +--- a/Makefile.pre.in ++++ b/Makefile.pre.in +@@ -606,10 +606,10 @@ sharedmods: $(BUILDPYTHON) pybuilddir.txt Modules/_math.o + *\ -s*|s*) quiet="-q";; \ + *) quiet="";; \ + esac; \ +- echo "$(RUNSHARED) CC='$(CC)' LDSHARED='$(BLDSHARED)' OPT='$(OPT)' \ ++ echo "$(RUNSHARED) CC='$(CC)' LDSHARED='$(BLDSHARED)' CFLAGS='$(PY_CFLAGS)' \ + _TCLTK_INCLUDES='$(TCLTK_INCLUDES)' _TCLTK_LIBS='$(TCLTK_LIBS)' \ + $(PYTHON_FOR_BUILD) $(srcdir)/setup.py $$quiet build"; \ +- $(RUNSHARED) CC='$(CC)' LDSHARED='$(BLDSHARED)' OPT='$(OPT)' \ ++ $(RUNSHARED) CC='$(CC)' LDSHARED='$(BLDSHARED)' CFLAGS='$(PY_CFLAGS)' \ + _TCLTK_INCLUDES='$(TCLTK_INCLUDES)' _TCLTK_LIBS='$(TCLTK_LIBS)' \ + $(PYTHON_FOR_BUILD) $(srcdir)/setup.py $$quiet build + +-- +2.33.0 + diff --git a/programming/language/python3/python3-idle/files/gentoo/0006-h2py-use-binary-I-O-to-avoid-encoding-issues.patch b/programming/language/python3/python3-idle/files/gentoo/0006-h2py-use-binary-I-O-to-avoid-encoding-issues.patch new file mode 100644 index 0000000000..5835c553bb --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0006-h2py-use-binary-I-O-to-avoid-encoding-issues.patch @@ -0,0 +1,186 @@ +From 5260345d0d7acefb91590212d8d629abe9eb1538 Mon Sep 17 00:00:00 2001 +From: Mike Gilbert +Date: Fri, 5 Jan 2018 13:40:40 -0500 +Subject: [PATCH 06/16] h2py: use binary I/O to avoid encoding issues + +https://bugs.python.org/issue13032 +--- + Tools/scripts/h2py.py | 67 ++++++++++++++++++++++--------------------- + 1 file changed, 34 insertions(+), 33 deletions(-) + +diff --git a/Tools/scripts/h2py.py b/Tools/scripts/h2py.py +index ea37c04d4c..aabea34697 100755 +--- a/Tools/scripts/h2py.py ++++ b/Tools/scripts/h2py.py +@@ -23,36 +23,36 @@ + + import sys, re, getopt, os + +-p_define = re.compile(r'^[\t ]*#[\t ]*define[\t ]+([a-zA-Z0-9_]+)[\t ]+') ++p_define = re.compile(br'^[\t ]*#[\t ]*define[\t ]+([a-zA-Z0-9_]+)[\t ]+') + + p_macro = re.compile( +- r'^[\t ]*#[\t ]*define[\t ]+' +- r'([a-zA-Z0-9_]+)\(([_a-zA-Z][_a-zA-Z0-9]*)\)[\t ]+') ++ br'^[\t ]*#[\t ]*define[\t ]+' ++ br'([a-zA-Z0-9_]+)\(([_a-zA-Z][_a-zA-Z0-9]*)\)[\t ]+') + +-p_include = re.compile(r'^[\t ]*#[\t ]*include[\t ]+<([^>\n]+)>') ++p_include = re.compile(br'^[\t ]*#[\t ]*include[\t ]+<([^>\n]+)>') + +-p_comment = re.compile(r'/\*([^*]+|\*+[^/])*(\*+/)?') +-p_cpp_comment = re.compile('//.*') ++p_comment = re.compile(br'/\*([^*]+|\*+[^/])*(\*+/)?') ++p_cpp_comment = re.compile(b'//.*') + + ignores = [p_comment, p_cpp_comment] + +-p_char = re.compile(r"'(\\.[^\\]*|[^\\])'") ++p_char = re.compile(br"'(\\.[^\\]*|[^\\])'") + +-p_hex = re.compile(r"0x([0-9a-fA-F]+)L?") ++p_hex = re.compile(br"0x([0-9a-fA-F]+)L?") + + filedict = {} + importable = {} + + try: +- searchdirs=os.environ['include'].split(';') ++ searchdirs=os.environb[b'include'].split(b';') + except KeyError: + try: +- searchdirs=os.environ['INCLUDE'].split(';') ++ searchdirs=os.environb[b'INCLUDE'].split(b';') + except KeyError: +- searchdirs=['/usr/include'] ++ searchdirs=[b'/usr/include'] + try: +- searchdirs.insert(0, os.path.join('/usr/include', +- os.environ['MULTIARCH'])) ++ searchdirs.insert(0, os.path.join(b'/usr/include', ++ os.environb[b'MULTIARCH'])) + except KeyError: + pass + +@@ -61,22 +61,23 @@ def main(): + opts, args = getopt.getopt(sys.argv[1:], 'i:') + for o, a in opts: + if o == '-i': +- ignores.append(re.compile(a)) ++ ignores.append(re.compile(a.encode())) + if not args: + args = ['-'] + for filename in args: + if filename == '-': + sys.stdout.write('# Generated by h2py from stdin\n') +- process(sys.stdin, sys.stdout) ++ process(sys.stdin.buffer, sys.stdout.buffer) + else: +- with open(filename) as fp: ++ filename = filename.encode() ++ with open(filename, 'rb') as fp: + outfile = os.path.basename(filename) +- i = outfile.rfind('.') ++ i = outfile.rfind(b'.') + if i > 0: outfile = outfile[:i] + modname = outfile.upper() +- outfile = modname + '.py' +- with open(outfile, 'w') as outfp: +- outfp.write('# Generated by h2py from %s\n' % filename) ++ outfile = modname + b'.py' ++ with open(outfile, 'wb') as outfp: ++ outfp.write(b'# Generated by h2py from %s\n' % filename) + filedict = {} + for dir in searchdirs: + if filename[:len(dir)] == dir: +@@ -88,9 +89,9 @@ def main(): + def pytify(body): + # replace ignored patterns by spaces + for p in ignores: +- body = p.sub(' ', body) ++ body = p.sub(b' ', body) + # replace char literals by ord(...) +- body = p_char.sub("ord('\\1')", body) ++ body = p_char.sub(b"ord('\\1')", body) + # Compute negative hexadecimal constants + start = 0 + UMAX = 2*(sys.maxsize+1) +@@ -101,7 +102,7 @@ def pytify(body): + val = int(body[slice(*m.span(1))], 16) + if val > sys.maxsize: + val -= UMAX +- body = body[:s] + "(" + str(val) + ")" + body[e:] ++ body = body[:s] + b"(" + str(val).encode() + b")" + body[e:] + start = s + 1 + return body + +@@ -114,7 +115,7 @@ def process(fp, outfp, env = {}): + match = p_define.match(line) + if match: + # gobble up continuation lines +- while line[-2:] == '\\\n': ++ while line[-2:] == b'\\\n': + nextline = fp.readline() + if not nextline: break + lineno = lineno + 1 +@@ -123,11 +124,11 @@ def process(fp, outfp, env = {}): + body = line[match.end():] + body = pytify(body) + ok = 0 +- stmt = '%s = %s\n' % (name, body.strip()) ++ stmt = name + b' = ' + body.strip() + b'\n' + try: + exec(stmt, env) + except: +- sys.stderr.write('Skipping: %s' % stmt) ++ sys.stderr.buffer.write(b'Skipping: ' + stmt) + else: + outfp.write(stmt) + match = p_macro.match(line) +@@ -135,11 +136,11 @@ def process(fp, outfp, env = {}): + macro, arg = match.group(1, 2) + body = line[match.end():] + body = pytify(body) +- stmt = 'def %s(%s): return %s\n' % (macro, arg, body) ++ stmt = b'def ' + macro + b'(' + arg + b'): return ' + body + b'\n' + try: + exec(stmt, env) + except: +- sys.stderr.write('Skipping: %s' % stmt) ++ sys.stderr.buffer.write(b'Skipping: ' + stmt) + else: + outfp.write(stmt) + match = p_include.match(line) +@@ -148,24 +149,24 @@ def process(fp, outfp, env = {}): + a, b = regs[1] + filename = line[a:b] + if filename in importable: +- outfp.write('from %s import *\n' % importable[filename]) ++ outfp.write(b'from ' + importable[filename] + b' import *\n') + elif filename not in filedict: + filedict[filename] = None + inclfp = None + for dir in searchdirs: + try: +- inclfp = open(dir + '/' + filename) ++ inclfp = open(dir + b'/' + filename, 'rb') + break + except IOError: + pass + if inclfp: + with inclfp: + outfp.write( +- '\n# Included from %s\n' % filename) ++ b'\n# Included from %s\n' % filename) + process(inclfp, outfp, env) + else: +- sys.stderr.write('Warning - could not find file %s\n' % +- filename) ++ sys.stderr.buffer.write(b'Warning - could not find file ' + ++ filename + b'\n') + + if __name__ == '__main__': + main() +-- +2.33.0 + diff --git a/programming/language/python3/python3-idle/files/gentoo/0008-distutils-make-OO-enable-both-opt-1-and-opt-2-optimi.patch b/programming/language/python3/python3-idle/files/gentoo/0008-distutils-make-OO-enable-both-opt-1-and-opt-2-optimi.patch new file mode 100644 index 0000000000..1daa5fcf12 --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0008-distutils-make-OO-enable-both-opt-1-and-opt-2-optimi.patch @@ -0,0 +1,81 @@ +From 1623362fd068507f5455cfb8cd8873fb268e9843 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= +Date: Sun, 5 Jun 2016 08:18:01 +0200 +Subject: [PATCH 08/16] distutils: make -OO enable both opt-1 and opt-2 + optimization + +Bug: http://bugs.python.org/issue27226 +Bug: https://bugs.gentoo.org/585060 +--- + Lib/distutils/command/build_py.py | 8 ++++---- + Lib/distutils/command/install_lib.py | 12 ++++++------ + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/Lib/distutils/command/build_py.py b/Lib/distutils/command/build_py.py +index edc2171cd1..e34749d6eb 100644 +--- a/Lib/distutils/command/build_py.py ++++ b/Lib/distutils/command/build_py.py +@@ -315,9 +315,9 @@ class build_py (Command): + if self.compile: + outputs.append(importlib.util.cache_from_source( + filename, optimization='')) +- if self.optimize > 0: ++ for opt in range(1, self.optimize + 1): + outputs.append(importlib.util.cache_from_source( +- filename, optimization=self.optimize)) ++ filename, optimization=opt)) + + outputs += [ + os.path.join(build_dir, filename) +@@ -387,8 +387,8 @@ class build_py (Command): + if self.compile: + byte_compile(files, optimize=0, + force=self.force, prefix=prefix, dry_run=self.dry_run) +- if self.optimize > 0: +- byte_compile(files, optimize=self.optimize, ++ for opt in range(1, self.optimize + 1): ++ byte_compile(files, optimize=opt, + force=self.force, prefix=prefix, dry_run=self.dry_run) + + class build_py_2to3(build_py, Mixin2to3): +diff --git a/Lib/distutils/command/install_lib.py b/Lib/distutils/command/install_lib.py +index 6154cf0943..049b662566 100644 +--- a/Lib/distutils/command/install_lib.py ++++ b/Lib/distutils/command/install_lib.py +@@ -24,8 +24,8 @@ class install_lib(Command): + # 2) compile .pyc only (--compile --no-optimize; default) + # 3) compile .pyc and "opt-1" .pyc (--compile --optimize) + # 4) compile "opt-1" .pyc only (--no-compile --optimize) +- # 5) compile .pyc and "opt-2" .pyc (--compile --optimize-more) +- # 6) compile "opt-2" .pyc only (--no-compile --optimize-more) ++ # 5) compile .pyc, "opt-1" and "opt-2" .pyc (--compile --optimize-more) ++ # 6) compile "opt-1" and "opt-2" .pyc (--no-compile --optimize-more) + # + # The UI for this is two options, 'compile' and 'optimize'. + # 'compile' is strictly boolean, and only decides whether to +@@ -132,8 +132,8 @@ class install_lib(Command): + byte_compile(files, optimize=0, + force=self.force, prefix=install_root, + dry_run=self.dry_run) +- if self.optimize > 0: +- byte_compile(files, optimize=self.optimize, ++ for opt in range(1, self.optimize + 1): ++ byte_compile(files, optimize=opt, + force=self.force, prefix=install_root, + verbose=self.verbose, dry_run=self.dry_run) + +@@ -167,9 +167,9 @@ class install_lib(Command): + if self.compile: + bytecode_files.append(importlib.util.cache_from_source( + py_file, optimization='')) +- if self.optimize > 0: ++ for opt in range(1, self.optimize + 1): + bytecode_files.append(importlib.util.cache_from_source( +- py_file, optimization=self.optimize)) ++ py_file, optimization=opt)) + + return bytecode_files + +-- +2.33.0 + diff --git a/programming/language/python3/python3-idle/files/gentoo/0016-bpo-43650-Fix-MemoryError-on-zip.read-in-shutil._unp.patch b/programming/language/python3/python3-idle/files/gentoo/0016-bpo-43650-Fix-MemoryError-on-zip.read-in-shutil._unp.patch new file mode 100644 index 0000000000..7a50969df1 --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0016-bpo-43650-Fix-MemoryError-on-zip.read-in-shutil._unp.patch @@ -0,0 +1,61 @@ +From 5a5335aba36f6c4204ba65faa8b2e67025c1bd4a Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <31488909+miss-islington@users.noreply.github.com> +Date: Mon, 17 May 2021 10:34:39 -0700 +Subject: [PATCH 16/17] bpo-43650: Fix MemoryError on zip.read in + shutil._unpack_zipfile for large files (GH-25058) + +`shutil.unpack_archive()` tries to read the whole file into memory, making no use of any kind of smaller buffer. Process crashes for really large files: I.e. archive: ~1.7G, unpacked: ~10G. Before the crash it can easily take away all available RAM on smaller systems. Had to pull the code form `zipfile.Zipfile.extractall()` to fix this + +Automerge-Triggered-By: GH:gpshead +(cherry picked from commit f32c7950e0077b6d9a8e217c2796fc582f18ca08) + +Co-authored-by: Igor Bolshakov +--- + Lib/shutil.py | 16 ++++++---------- + .../2021-03-29-00-23-30.bpo-43650.v01tic.rst | 2 ++ + 2 files changed, 8 insertions(+), 10 deletions(-) + create mode 100644 Misc/NEWS.d/next/Library/2021-03-29-00-23-30.bpo-43650.v01tic.rst + +diff --git a/Lib/shutil.py b/Lib/shutil.py +index fdadb83800..aaf76c651b 100644 +--- a/Lib/shutil.py ++++ b/Lib/shutil.py +@@ -1144,20 +1144,16 @@ def _unpack_zipfile(filename, extract_dir): + if name.startswith('/') or '..' in name: + continue + +- target = os.path.join(extract_dir, *name.split('/')) +- if not target: ++ targetpath = os.path.join(extract_dir, *name.split('/')) ++ if not targetpath: + continue + +- _ensure_directory(target) ++ _ensure_directory(targetpath) + if not name.endswith('/'): + # file +- data = zip.read(info.filename) +- f = open(target, 'wb') +- try: +- f.write(data) +- finally: +- f.close() +- del data ++ with zip.open(name, 'r') as source, \ ++ open(targetpath, 'wb') as target: ++ copyfileobj(source, target) + finally: + zip.close() + +diff --git a/Misc/NEWS.d/next/Library/2021-03-29-00-23-30.bpo-43650.v01tic.rst b/Misc/NEWS.d/next/Library/2021-03-29-00-23-30.bpo-43650.v01tic.rst +new file mode 100644 +index 0000000000..a2ea4a4800 +--- /dev/null ++++ b/Misc/NEWS.d/next/Library/2021-03-29-00-23-30.bpo-43650.v01tic.rst +@@ -0,0 +1,2 @@ ++Fix :exc:`MemoryError` in :func:`shutil.unpack_archive` which fails inside ++:func:`shutil._unpack_zipfile` on large files. Patch by Igor Bolshakov. +-- +2.32.0 + diff --git a/programming/language/python3/python3-idle/files/gentoo/0017-bpo-43998-Default-to-TLS-1.2-and-increase-cipher-sui.patch b/programming/language/python3/python3-idle/files/gentoo/0017-bpo-43998-Default-to-TLS-1.2-and-increase-cipher-sui.patch new file mode 100644 index 0000000000..24385bfeb6 --- /dev/null +++ b/programming/language/python3/python3-idle/files/gentoo/0017-bpo-43998-Default-to-TLS-1.2-and-increase-cipher-sui.patch @@ -0,0 +1,214 @@ +From 5b42865796c6bf768d4d11e3c93dc0994d46f783 Mon Sep 17 00:00:00 2001 +From: Christian Heimes +Date: Sat, 1 May 2021 20:53:10 +0200 +Subject: [PATCH 17/17] bpo-43998: Default to TLS 1.2 and increase cipher suite + security (GH-25778) + +The ssl module now has more secure default settings. Ciphers without forward +secrecy or SHA-1 MAC are disabled by default. Security level 2 prohibits +weak RSA, DH, and ECC keys with less than 112 bits of security. +:class:`~ssl.SSLContext` defaults to minimum protocol version TLS 1.2. +Settings are based on Hynek Schlawack's research. + +``` +$ openssl version +OpenSSL 1.1.1k FIPS 25 Mar 2021 +$ openssl ciphers -v '@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM' +TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD +TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD +TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD +TLS_AES_128_CCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESCCM(128) Mac=AEAD +ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD +ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD +ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD +ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD +ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD +ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD +ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 +ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 +ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 +ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 +DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD +DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD +DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 +DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 +``` + +Signed-off-by: Christian Heimes +--- + Doc/library/ssl.rst | 8 ++++ + Lib/test/test_nntplib.py | 24 +++++++++-- + .../2021-05-01-13-13-40.bpo-43998.xhmWD7.rst | 5 +++ + Modules/_ssl.c | 43 ++++++++++++++++--- + 4 files changed, 72 insertions(+), 8 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst + +diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst +index a58717c3ab..f1c43ee3d8 100644 +--- a/Doc/library/ssl.rst ++++ b/Doc/library/ssl.rst +@@ -1471,6 +1471,14 @@ to speed up repeated connections from the same clients. + ciphers, no ``NULL`` ciphers and no ``MD5`` ciphers (except for + :data:`PROTOCOL_SSLv2`). + ++ .. versionchanged:: 3.9.5_p2 (Gentoo) ++ ++ The default cipher suites now include only secure AES and ChaCha20 ++ ciphers with forward secrecy and security level 2. RSA and DH keys with ++ less than 2048 bits and ECC keys with less than 224 bits are prohibited. ++ :data:`PROTOCOL_TLS`, :data:`PROTOCOL_TLS_CLIENT`, and ++ :data:`PROTOCOL_TLS_SERVER` use TLS 1.2 as minimum TLS version. ++ + + :class:`SSLContext` objects have the following methods and attributes: + +diff --git a/Lib/test/test_nntplib.py b/Lib/test/test_nntplib.py +index 89a2004dfb..d27e4abae8 100644 +--- a/Lib/test/test_nntplib.py ++++ b/Lib/test/test_nntplib.py +@@ -37,6 +37,8 @@ else: + + class NetworkedNNTPTestsMixin: + ++ ssl_context = None ++ + def test_welcome(self): + welcome = self.server.getwelcome() + self.assertEqual(str, type(welcome)) +@@ -269,6 +271,13 @@ class NetworkedNNTPTestsMixin: + return False + return True + ++ kwargs = dict( ++ timeout=support.INTERNET_TIMEOUT, ++ usenetrc=False ++ ) ++ if self.ssl_context is not None: ++ kwargs["ssl_context"] = self.ssl_context ++ + try: + with self.NNTP_CLASS(self.NNTP_HOST, timeout=TIMEOUT, usenetrc=False) as server: + self.assertTrue(is_connected()) +@@ -306,15 +315,21 @@ class NetworkedNNTPTests(NetworkedNNTPTestsMixin, unittest.TestCase): + @classmethod + def setUpClass(cls): + support.requires("network") +- with support.transient_internet(cls.NNTP_HOST): ++ kwargs = dict( ++ timeout=support.INTERNET_TIMEOUT, ++ usenetrc=False ++ ) ++ if cls.ssl_context is not None: ++ kwargs["ssl_context"] = cls.ssl_context ++ with socket_helper.transient_internet(cls.NNTP_HOST): + try: +- cls.server = cls.NNTP_CLASS(cls.NNTP_HOST, timeout=TIMEOUT, +- usenetrc=False) ++ cls.server = cls.NNTP_CLASS(cls.NNTP_HOST, **kwargs) + except SSLError as ssl_err: + # matches "[SSL: DH_KEY_TOO_SMALL] dh key too small" + if re.search(r'(?i)KEY.TOO.SMALL', ssl_err.reason): + raise unittest.SkipTest(f"{cls} got {ssl_err} connecting " + f"to {cls.NNTP_HOST!r}") ++ print(cls.NNTP_HOST) + raise + except EOF_ERRORS: + raise unittest.SkipTest(f"{cls} got EOF error on connecting " +@@ -347,6 +362,9 @@ class NetworkedNNTP_SSLTests(NetworkedNNTPTests): + # Disabled as the connection will already be encrypted. + test_starttls = None + ++ ssl_context = ssl._create_unverified_context() ++ ssl_context.set_ciphers("DEFAULT") ++ ssl_context.maximum_version = ssl.TLSVersion.TLSv1_2 + + # + # Non-networked tests using a local server (or something mocking it). +diff --git a/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst b/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst +new file mode 100644 +index 0000000000..6a40346128 +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2021-05-01-13-13-40.bpo-43998.xhmWD7.rst +@@ -0,0 +1,5 @@ ++The :mod:`ssl` module sets more secure cipher suites defaults. Ciphers ++without forward secrecy and with SHA-1 MAC are disabled by default. Security ++level 2 prohibits weak RSA, DH, and ECC keys with less than 112 bits of ++security. :class:`~ssl.SSLContext` defaults to minimum protocol version TLS ++1.2. Settings are based on Hynek Schlawack's research. +diff --git a/Modules/_ssl.c b/Modules/_ssl.c +index bc665db0d5..01a2067596 100644 +--- a/Modules/_ssl.c ++++ b/Modules/_ssl.c +@@ -300,15 +300,27 @@ SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s) + #ifndef PY_SSL_DEFAULT_CIPHER_STRING + #error "Py_SSL_DEFAULT_CIPHERS 0 needs Py_SSL_DEFAULT_CIPHER_STRING" + #endif ++ #ifndef PY_SSL_MIN_PROTOCOL ++ #define PY_SSL_MIN_PROTOCOL TLS1_2_VERSION ++ #endif + #elif PY_SSL_DEFAULT_CIPHERS == 1 + /* Python custom selection of sensible cipher suites +- * DEFAULT: OpenSSL's default cipher list. Since 1.0.2 the list is in sensible order. ++ * @SECLEVEL=2: security level 2 with 112 bits minimum security (e.g. 2048 bits RSA key) ++ * ECDH+*: enable ephemeral elliptic curve Diffie-Hellman ++ * DHE+*: fallback to ephemeral finite field Diffie-Hellman ++ * encryption order: AES AEAD (GCM), ChaCha AEAD, AES CBC + * !aNULL:!eNULL: really no NULL ciphers +- * !MD5:!3DES:!DES:!RC4:!IDEA:!SEED: no weak or broken algorithms on old OpenSSL versions. + * !aDSS: no authentication with discrete logarithm DSA algorithm +- * !SRP:!PSK: no secure remote password or pre-shared key authentication ++ * !SHA1: no weak SHA1 MAC ++ * !AESCCM: no CCM mode, it's uncommon and slow ++ * ++ * Based on Hynek's excellent blog post (update 2021-02-11) ++ * https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ + */ +- #define PY_SSL_DEFAULT_CIPHER_STRING "DEFAULT:!aNULL:!eNULL:!MD5:!3DES:!DES:!RC4:!IDEA:!SEED:!aDSS:!SRP:!PSK" ++ #define PY_SSL_DEFAULT_CIPHER_STRING "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" ++ #ifndef PY_SSL_MIN_PROTOCOL ++ #define PY_SSL_MIN_PROTOCOL TLS1_2_VERSION ++ #endif + #elif PY_SSL_DEFAULT_CIPHERS == 2 + /* Ignored in SSLContext constructor, only used to as _ssl.DEFAULT_CIPHER_STRING */ + #define PY_SSL_DEFAULT_CIPHER_STRING SSL_DEFAULT_CIPHER_LIST +@@ -3249,8 +3261,25 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) + ERR_clear_error(); + PyErr_SetString(PySSLErrorObject, + "No cipher can be selected."); +- return NULL; ++ goto error; ++ } ++#ifdef PY_SSL_MIN_PROTOCOL ++ switch(proto_version) { ++ case PY_SSL_VERSION_TLS: ++ case PY_SSL_VERSION_TLS_CLIENT: ++ case PY_SSL_VERSION_TLS_SERVER: ++ result = SSL_CTX_set_min_proto_version(ctx, PY_SSL_MIN_PROTOCOL); ++ if (result == 0) { ++ PyErr_Format(PyExc_ValueError, ++ "Failed to set minimum protocol 0x%x", ++ PY_SSL_MIN_PROTOCOL); ++ goto error; ++ } ++ break; ++ default: ++ break; + } ++#endif + + #if defined(SSL_MODE_RELEASE_BUFFERS) + /* Set SSL_MODE_RELEASE_BUFFERS. This potentially greatly reduces memory +@@ -3303,6 +3332,10 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) + #endif + + return (PyObject *)self; ++ error: ++ Py_XDECREF(self); ++ ERR_clear_error(); ++ return NULL; + } + + static int +-- +2.32.0 + diff --git a/programming/language/python3/python3-idle/pspec.xml b/programming/language/python3/python3-idle/pspec.xml index 037b2346a5..f3142e72be 100644 --- a/programming/language/python3/python3-idle/pspec.xml +++ b/programming/language/python3/python3-idle/pspec.xml @@ -12,7 +12,7 @@ programming.language An Integrated Development Environment for Python An Integrated Development Environment for Python - https://www.python.org/ftp/python/3.8.11/Python-3.8.11.tar.xz + https://www.python.org/ftp/python/3.8.12/Python-3.8.12.tar.xz bzip2 @@ -31,8 +31,13 @@ mpdecimal-devel - + gentoo/0001-Install-libpythonX.Y.a-in-usr-lib-instead-of-usr-lib.patch + gentoo/0004-setup.py-exit-with-non-zero-status-on-failure.patch + gentoo/0005-Improve-distutils-C-support.patch + gentoo/0006-h2py-use-binary-I-O-to-avoid-encoding-issues.patch + gentoo/0008-distutils-make-OO-enable-both-opt-1-and-opt-2-optimi.patch + gentoo/0016-bpo-43650-Fix-MemoryError-on-zip.read-in-shutil._unp.patch + gentoo/0017-bpo-43998-Default-to-TLS-1.2-and-increase-cipher-sui.patch @@ -76,6 +81,13 @@ + + 2021-10-18 + 3.8.12 + Version bump. + Mustafa Cinasal + muscnsl@gmail.com + 2021-10-18 3.8.11