This is a bug and security fix release, including:
- CVE-2015-3900 Request hijacking vulnerability in RubyGems 2.4.6 and earlier
http://svn.ruby-lang.org/repos/ruby/tags/v2_2_3/ChangeLog
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
It's better to install setuptools-enabled Python packages with a special
flag that makes a flatter structure of the egg and does not create
site.py file. Already done for python-pip recently. Also, version was
bumped to 18.1.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
PIP's installation procedure was too complicated, requiring obscure
postinstall and prerm scripts to move files created by setup procedure.
But since setuptools is required anyway, it's better to use a special
flag created for the purpose of package creation. Resulting directory
structure is flatter and unnecessary files that had to be moved by
prerm/postinstall scripts are not created anymore.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
Patch removing multiarch paths from build should be applied only when
Python is built for target, but not for host. When the paths are removed
during host build, host python throws some ugly errors when importing
some hashlib modules. Also it reports that modules crypt and nis failed
to build (tested on Ubuntu 14.04 host).
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
Python 3 prefers usage of wcsftime() over strftime() if it's available,
however this function returns just an empty string in some older
uClibc versions. Proposed solution disables detection of wcsftime() in
./configure that results in HAVE_WCSFTIME being undefined, effectively
disabling branches of code that use possibly broken wcsftime().
See: http://lists.busybox.net/pipermail/uclibc/2014-November/048718.html
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
This is the pyserial package ported from oldpackages. It is a
bumped version and depends on python-light instead of python-mini
Signed-off-by: Micke Prag <micke.prag@telldus.se>
gethostbyname_r is available when _GNU_SOURCE is defined, add a patch to check for it instead of __GLIBC__, build with -D_GNU_SOURCE, bump release number
Signed-off-by: Nicolas Thill <nico@openwrt.org>
- Add patch to inhibit the libm IEEE math switch on musl
- Add postprocessing for config.sh to the Makefile to fixup
defines for musl, idea taken
from http://patchwork.openembedded.org/patch/91707/
This is the least invasive approach I could come up to fix the build
failure asap. Another possibility is maintaining yet another set of
musl specific architecture config files, but I think that this introduces
a lot of maintenance overhead.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This fixes the following CVEs:
- in PCRE: CVE-2015-2325, CVE-2015-2326
- in sqlite3: CVE-2015-3414, CVE-2015-3415, CVE-2015-3416
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Builtbots currently fail to compile this package with (example message):
... /libevent-0.1.0/libevent.c:1403:42: error: 'EVBUFFER_READ' undeclared (first use in this function)
REGISTER_LONG_CONSTANT("EVBUFFER_READ", EVBUFFER_READ, CONST_CS | CONST_PERSISTENT);
With libevent2, the main include file event.h is deprecated, but includes
enough stuff and other compat includes that it _should work_. I could not figure
out why it fails (all locally builds work out-of-the-box), so this is a trial to
circumvent this compat header file and include the libevent2 headers directly.
While at, add a missing dependency to the sockets extension.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
While host-perl only exists to run build scripts(and thus, should have
no influence on built packages at all), most packages depend heavily on the
feature set of the perl installation that ran their configuration scripts.
This change makes them see that threading support is enabled(if it actually
is selected).
We can't use configuration symbol overrides for this one, as they are
visible to host-perl as well. Using overrides would make it act as if it
had threading support enabled without actually having it.
Signed-off-by: Marcel Denia <naoir@gmx.net>
This will not change any existing packages' functionality. All packages
that used this symbol before during build(with it's value being "cc -E") most
likely would've failed compilation.
Note that this change is only in effect during build.
Signed-off-by: Marcel Denia <naoir@gmx.net>
This fixes CVE-2006-7243, a multipart/form-data remote dos vulnerability,
a heap buffer overflow in unpack and a integer overflow in ftp_genlist,
which also results in a heap overflow.
For more details, see http://php.net/ChangeLog-5.php#5.6.9
Also sync the timezone patch with latest version from Debian and
adopt this patch for the changes in this php release.
Refresh 950-Fix-dl-cross-compiling-issue.patch.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
This patch adds build infrastructure for PHP's OPcache extension.
Compared with the other extension, this is a Zend module and it
need a little workaround during cross-compiling.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
* fix failure on buildbot where lua devel files are searched in home directory
* add a patch to pass proper target optimization flags
* remove unused PKG_INSTALL & Build/Install
Signed-off-by: Nicolas Thill <nico@openwrt.org>
This fixes the following CVEs:
- CVE-2015-1351
- CVE-2015-1352
- CVE-2015-2783
- CVE-2015-3329
- CVE-2015-3330
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
libyaml is an optional dep for ruby psych. When missing, it uses
a bundled version of yaml. However, when libyaml is present in
openwrt build, ruby-psych packaging failed with deps not declared.
Now libyaml is configured as a hard dep for ruby-psych.
Also, the tk module was disabled in order to avoid a possible similar
problem if tk+x11 is provided in openwrt build. It was currently not
build because of missing deps.
Other minor changes:
- win32* modules where disabled (avoid err msg, no compile changes)
- Some files where removed in 2.2.x (like gserver.rb). They were already
not packaged but generates a build warning message. Now removed from install.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
This is a small ruby release, mainly to fix
CVE-2015-1855: Ruby OpenSSL Hostname Verification
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Previous build was missing module socket.unix that is required for
interaction with Unix domain sockets and is distributed in a separate
shared library. This commit adds the file to the created package.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
python-package.mk now defines (extends) CONFIGURE_ARGS that are
adjusting PREFIX and EXEC_PREFIX in distutils.sysconfig during
compilation. These variables are sometimes used by autotools to detect
path to Python header files. Adding these variables to python-package.mk
fixes compilation of legacy autotools-configured packages that already
include python-package.mk and do not overwrite CONFIGURE_ARGS.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
Cc: Alexandru Ardelean <ardeleanalex@gmail.com>
Some notes about the 'encodings' module, which is about 1.7 MB.
Unfortunately that one cannot be moved into the 'python3-codecs'
package, because Python tries to load up all available encodings
at startup.
Some efforts to add a dummy folder/python file have failed so far,
since there's a C code (Python/codecs.c) that tries to evaluate that
all encodings (in the encodings folder/module) are valid.
Basically the encodings module is a repository of encodings,
and it seemst there are quite a few of them.
Maybe a request to upstream Python would work for this, to
make encodings a bit more decoupled from the interpreter.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Based on the idea that 'what-works-on-python-should-work-on-python3'
because they share the same trunk, these patches have been copied over
from the python package.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Rule of thumb is: any Python file that is greater than 100kb
(or adds a dependency with which it adds more than 100 kb)
should be a pretty useful/commonly used lib to stay in `python-light`.
An example, is the Python IO lib, which summarized (Python source +
binary module) is over 200kb.
Also moved some files that should have been put into previously
existing packages before, and re-organized the packages a bit.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Seems removing the PyPackage rule and/or adding dummy install rule
causes some issues inside the build-system, where the libpython2.7.so.1.0
is not seen by packages that depend on python.
Even though that libpython2.7.so.1.0 file is installed properly by `python-base`.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Calling `PyPackage` will install some default install rules for
python packages that are not required for the `python` package specifically
are not required.
That will lead to some conflicts with `python-light` because the
`/usr/lib/python2.7/site-packages` folder (+contents) will be
available in both packages.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
When cross-compiling, we do not need to add runtime lib dirs.
Also, the cross compilers that are used on OpenWRT do not support
the '-R' option, which causes build failures.
These build failures existed before, but were not noticed,
because it fails only on some setups.
This is because Python's `setup.py` does a lot of voo-doo
automagic that needs handling for some cross-compilation cases.
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Packetize some Python modules to reduce size of the overall Python package.
Basically, a new package is introduced, call `python-light`,
and everything that's extra (or big) is put in other packages.
The `python` package becomes a metapackage that installs `python-light`
along with the rest of the packages.
Base work started by Jan Čermák.
Signed-off-by: Jan Čermák <jan.cermak@nic.cz>
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
