gh-115009: Update Windows installer to use SQLite 3.45.3.

[felixxm]

• Issue: Upgrade Windows and macOS installers to use SQLite 3.45 #115009

[felixxm]

That's something new. Should I manually update SBOM 🤔 ?

[felixxm]

Should I create a 3rd PR for Android?

cpython/Android/android.py

Line 103 in 9dae05e

"sqlite-3.45.1-0", "xz-5.4.6-0"]:

[erlend-aasland]

That's something new. Should I manually update SBOM 🤔 ?

Yes, that's new to me too. Looks like this patch is needed:

diff --git a/Misc/externals.spdx.json b/Misc/externals.spdx.json
index 6df6401835..df7ca6f759 100644
--- a/Misc/externals.spdx.json
+++ b/Misc/externals.spdx.json
@@ -94,7 +94,7 @@
           "checksumValue": "6f0364a27375435a34137b138ca4fedef8d23eec6493ca1dfff33bfc0c34fda4"
         }
       ],
-      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/sqlite-3.45.1.0.tar.gz",
+      "downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/sqlite-3.45.2.0.tar.gz",
       "externalRefs": [
         {
           "referenceCategory": "SECURITY",
@@ -105,7 +105,7 @@
       "licenseConcluded": "NOASSERTION",
       "name": "sqlite",
       "primaryPackagePurpose": "SOURCE",
-      "versionInfo": "3.45.1.0"
+      "versionInfo": "3.45.2.0"
     },
     {
       "SPDXID": "SPDXRef-PACKAGE-tcl-core",

[erlend-aasland]

Should I create a 3rd PR for Android?

Sure, but we don't distribute binaries for Android (yet, or possibly ever), so it is not imperative. cc. @mhsmith

[felixxm]

Yes, that's new to me too. Looks like this patch is needed:

Updated 🤞

[sethmlarson]

Thanks for updating the SBOM! 🙏 If you did so manually, know that in the future you can update the version in get_externals.bat and run make regen-sbom and the script will take care of the rest.

[mhsmith]

Should I create a 3rd PR for Android?

Sure, but we don't distribute binaries for Android (yet, or possibly ever), so it is not imperative. cc. @mhsmith

The library dependencies for Android come from https://github.com/beeware/cpython-android-source-deps. I've just added a release of SQLite 3.45.2, so you can pick that up in CPython if you like.

If anyone wants to update Android dependency versions in the future, please create an issue in that repository. There's also cpython-apple-source-deps for iOS, although that doesn't include SQLite because it's supplied by iOS itself.

[sethmlarson]

@mhsmith TIL about the separate repositories for Apple/Android builds, is the long-term plan to fold those into python/cpython-source-deps? Is the source code for each project unmodified from upstream?

[erlend-aasland]

python/cpython-source-deps is unmodified. I can't speak for the iOS/Android repos. I would prefer it if we could use single repo, if possible.

[mhsmith]

Is the source code for each project unmodified from upstream?

There are some patch files in both the iOS and Android repositories.

I would prefer it if we could use single repo, if possible.

I agree; let's revisit this when we start talking about making official binary releases for Android and iOS, which I'd like to do during the Python 3.14 cycle.

[felixxm]

I created python/cpython-source-deps#35 to add the 3.45.3 source.

[felixxm]

Updated to SQLite 3.45.3.

[zooba]

FYI, we prefer to not merge PRs into the source-deps repository, as it means we need one of our committers to verify that you've provided exactly the same code (with no added backdoors, look up xz if you think this sounds unreasonable).

Doing that check is more work than just pushing it ourselves, so it's generally best to just notify us when there is a new version so that whichever of our maintainers looks after it most can bring in the new version.

[felixxm]

FYI, we prefer to not merge PRs into the source-deps repository, as it means we need one of our committers to verify that you've provided exactly the same code (with no added backdoors, look up xz if you think this sounds unreasonable).

Doing that check is more work than just pushing it ourselves, so it's generally best to just notify us when there is a new version so that whichever of our maintainers looks after it most can bring in the new version.

Noted 👍 I only had good intentions 💝

[erlend-aasland]

Thanks!

[zooba]

I only had good intentions

Didn't doubt them, but it's a policy that's easier to handle when we don't have exceptions. PRs on that repo should automatically close now (after ~hour).

[zooba]

@felixxm or @erlend-aasland can one of you do the backport? I can try to get to it later this week, but no guarantees I'll remember.

[felixxm]

@felixxm or @erlend-aasland can one of you do the backport? I can try to get to it later this week, but no guarantees I'll remember.

Will prepare it later today.

[bedevere-app]

GH-118008 is a backport of this pull request to the 3.12 branch.