Skip to content

Commit

Permalink
python: 2.7.14 -> 2.7.15 (bugfix + security)
Browse files Browse the repository at this point in the history 
Fixes CVE-2018-1000030, /cc #38993.

The ncurses patch no longer applied, and it appears the problems have
been resolved upstream https://bugs.python.org/issue25720
python/cpython@6ba0b583d67

(cherry picked from commit 59beaf7)
  • Loading branch information
@vcunat @FRidh
vcunat authored and FRidh committed May 27, 2018
1 parent fd72137 commit 30ff9ca
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 120 deletions.
6 changes: 2 additions & 4 deletions pkgs/development/interpreters/python/cpython/2.7/default.nix
View file
Expand Up @@ -31,7 +31,7 @@ with stdenv.lib;

let
majorVersion = "2.7";
minorVersion = "14";
minorVersion = "15";
minorVersionSuffix = "";
pythonVersion = majorVersion;
version = "${majorVersion}.${minorVersion}${minorVersionSuffix}";
Expand All @@ -40,7 +40,7 @@ let

src = fetchurl {
url = "https://www.python.org/ftp/python/${majorVersion}.${minorVersion}/Python-${version}.tar.xz";
sha256 = "0rka541ys16jwzcnnvjp2v12m4cwgd2jp6wj4kj511p715pb5zvi";
sha256 = "0x2mvz9dp11wj7p5ccvmk9s0hzjk2fa1m462p395l4r6bfnb3n92";
};

hasDistutilsCxxPatch = !(stdenv.cc.isGNU or false);
Expand All @@ -58,8 +58,6 @@ let
# if DETERMINISTIC_BUILD env var is set
./deterministic-build.patch

./properly-detect-curses.patch

] ++ optionals (x11Support && stdenv.isDarwin) [
./use-correct-tcl-tk-on-darwin.patch
] ++ optionals stdenv.isLinux [
Expand Down
116 changes: 0 additions & 116 deletions pkgs/development/interpreters/python/cpython/2.7/properly-detect-curses.patch
View file

This file was deleted.

7 comments on commit 30ff9ca

@xeji
Copy link
Contributor

@xeji xeji commented on 30ff9ca May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@vcunat @FRidh this broke > 2k builds, see https://hydra.nixos.org/eval/1459562 . Not yet sure why.

@FRidh
Copy link
Member

@FRidh FRidh commented on 30ff9ca May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Looking at it now. Seems CFFI is contributing here.

@FRidh
Copy link
Member

@FRidh FRidh commented on 30ff9ca May 28, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pushed a CFFI bump which should solve the issue, at least for as far as I can see now.
ab6d081

@xeji
Copy link
Contributor

@xeji xeji commented on 30ff9ca May 29, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, that fixed pretty much everything. I had to bump CherryPy, too: 2c26bc6 and b70664a

@FRidh
Copy link
Member

@FRidh FRidh commented on 30ff9ca May 29, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good, thanks.

@vcunat
Copy link
Member Author

@vcunat vcunat commented on 30ff9ca May 29, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, the thousands of failures are gone. There are a few dozen new ones, though these might be some transient problems.

@FRidh
Copy link
Member

@FRidh FRidh commented on 30ff9ca May 29, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As soon as the load on Hydra is a bit lower again I'll push some patch releases of Python packages, that may help. Note though we first aim at fixing test failures on release-18.03.

Please sign in to comment.