This specific statement in ostree recipe breaks the YP compatible
status (yocto-check-layer):
RDEPENDS_${PN}-ptest += " \
...
${@bb.utils.contains('BBFILE_COLLECTIONS', 'meta-python', 'python3-pyyaml', '', d)} \
...
"
Recently python3-pyyaml was moved to OE-core (0a8600f9cec0), and the
ostree recipe was fixed with:
b9ede0cb18 (python3-pyyaml: Do not check for meta-python)
In dunfell, moving python3-pyyaml to OE-core is not a great idea, but
moving it from meta-python to meta-oe allows us to fix ostree YP
compatible issue. Since meta-python depends on meta-oe, it should not
be a change with any visible effect.
python3-cython and python3-pyparsing are collateral damages since they are
dependency for python3-pyyaml, so needed to be moved too.
Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
It was moved to OE-core/dunfell in
cc0f56a788c3 (python3-jinja2: Import from meta-oe/meta-python)
However it was not removed from meta-oe, as such this recipe is now
duplicated, for no good reason. Worse than that, the version in
meta-oe and oe-core differ. OE-core has 2.11.3 and meta-oe is older
with 2.11.2.
Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
It was moved to OE-core/dunfell in
ec222f6af5f8 (python3-markupsafe: Import from meta-oe/meta-python)
However it was not removed from meta-oe, as such this recipe is now
duplicated, for no good reason. The version in meta-oe and oe-core
match so, it's really a no-op.
Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Version 2.2.24 contains a fix for CVE-2021-33571 and is the latest LTS
release.
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fa2d3338fb)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit c51e79dd85)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2.2.23 is a bugfix release:
- Fixed a regression in Django 2.2.21 where saving FileField would raise a
SuspiciousFileOperation even when a custom upload_to returns a valid
file path (#32718).
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit f07a8c1376)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b2716ef06a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2.2.x is LTS, so upgrade to latest release 2.2.20.
This upgrade fixes several CVEs such as CVE-2021-3281.
Also, CVE-2021-28658.patch is dropped as it's already in 2.2.20.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit e705d4932a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8,
MultiPartParser allowed directory traversal via uploaded files with
suitably crafted file names. Built-in upload handlers were not affected
by this vulnerability.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-28658
Upstream patches:
4036d62bda
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit aef354a0c2)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Summary of release notes from https://docs.djangoproject.com/en/2.2/releases/
2.2.14 release notes:
- Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings
raised by cache key validation (#31654).
2.2.15 release notes:
- Allowed setting the SameSite cookie flag in HttpResponse.delete_cookie()
(#31790).
- Fixed crash when sending emails to addresses with display names longer than
75 chars on Python 3.6.11+, 3.7.8+, and 3.8.4+ (#31784).
2.2.16 release notes:
- Fixed CVE-2020-24583: Incorrect permissions on intermediate-level directories
on Python 3.7+
- Fixed CVE-2020-24584: Permission escalation in intermediate-level directories
of the file system cache on Python 3.7+
- Fixed a data loss possibility in the select_for_update(). When using related
fields pointing to a proxy model in the of argument, the corresponding model
was not locked (#31866).
- Fixed a data loss possibility, following a regression in Django 2.0, when
copying model instances with a cached fields value (#31863).
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit eb69aad33f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upgrade from 2.2.7 for:
- Bugfixes, including CVE-2020-13254, CVE-2020-13596, many
others;
- Official support for Python 3.8 (as of Django 2.2.8)
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8c4e201c62)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
its been shoved out of setuptools3 in oe-core now
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
(cherry picked from commit 50bbf80abf)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit fbe2e79ab0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
aiohttp implicitly RDEPENDs on html, json, and socketserver modules,
which are part of python3 recipe. They can't be properly imported if
they are missing from RDEPENDS
Signed-off-by: Vyacheslav Yurkov <uvv.mail@gmail.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry-picked from commit 8e7c57bd8f)
Signed-off-by: Enrico Jorns <ejo@pengutronix.de>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Optimize _encode_invalid_chars for a denial of service (CPU consumption)
CVE: CVE-2020-7212
Signed-off-by: Haiqing Bai <Haiqing.Bai@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Harpritkaur Bhandari <Harpritkaur.Bhandari@kpit.com>
[Add CVE: CVE-2020-7212 to the patch itself]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upgrade to release 1.0.5:
- Fix regression in read_parquet() when reading from file-like
objects.
- Fix regression in reading from public S3 buckets.
- Fixed regression in replace() raising an AssertionError when
replacing values in an extension dtype with values of a
different dtype
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5dbc25ea9d)
[ak: fixes build issue on CentOS7: Bug fix only update
https://github.com/pandas-dev/pandas/releases]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upgrade to release 1.3.17:
- orm Bug fixes
- orm Added an accessor ColumnProperty.Comparator.expressions
which provides access to the group of columns mapped under a
multi-column ColumnProperty attribute.
- orm Introduce _orm.relationship.sync_backref flag in a
relationship to control if the synchronization events that
mutate the in-Python attributes are added. This supersedes the
previous change #5149, which warned that viewonly=True
relationship target of a back_populates or backref configuration
would be disallowed.
- engine Bug fixes
- schema Bug fixes
- schema Add comment attribute to _schema.Column __repr__ method.
The year in LICENSE has been updated so LIC_FILES_CHKSUM was
changed.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5fef53b998)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
fix errors:
ModuleNotFoundError: No module named 'distutils'
ModuleNotFoundError: No module named 'asyncore'
ModuleNotFoundError: No module named 'xmlrpc'
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1d6071e971)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
[ python3-docutils was already in the Yocto 3.1 release of OE-core ]
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
It is either append or +=, but not both.
Pick append to be the correct one
Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 19867269ba)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upgrade to release 1.0.3 and consolidate into a single file.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9b1a1c270a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
python3-iso8601 relies on the decimal module from the standard
library, but it is not in iso8601's RDEPENDS:
|root@qemux86-64:~# python3
|Python 3.8.2 (default, Apr 27 2020, 08:51:00)
|[GCC 9.3.0] on linux
|Type "help", "copyright", "credits" or "license" for more information.
|>>> import iso8601
|Traceback (most recent call last):
|File "<stdin>", line 1, in <module>
|File "/usr/lib64/python3.8/site-packages/iso8601/_init_.py", line 1, in <module>
|from .iso8601 import *
|File "/usr/lib64/python3.8/site-packages/iso8601/iso8601.py", line 12, in <module>
|from decimal import Decimal
|ModuleNotFoundError: No module named 'decimal'
Add it to RDEPENDS to fix the import error.
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9e60abcabd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
werkzeug relies on the logging module, but it is not in RDEPENDS,
so add it:
|Python 3.8.2 (default, Apr 27 2020, 08:51:00)
|[GCC 9.3.0] on linux
|Type "help", "copyright", "credits" or "license" for more information.
|>>> import werkzeug
|Traceback (most recent call last):
|File "<stdin>", line 1, in <module>
|File "/usr/lib64/python3.8/site-packages/werkzeug/_init_.py", line 15, in <module>
|from .serving import run_simple
|File "/usr/lib64/python3.8/site-packages/werkzeug/serving.py", line 50, in <module>
|from ._internal import _log
|File "/usr/lib64/python3.8/site-packages/werkzeug/_internal.py", line 12, in <module>
|import logging
|ModuleNotFoundError: No module named 'logging'
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f92b959f4a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
pyyaml relies on the base64 module (which is in python3-netclient),
but it is not in RDEPENDS, so add it:
|Python 3.8.2 (default, Apr 27 2020, 08:51:00)
|[GCC 9.3.0] on linux
|Type "help", "copyright", "credits" or "license" for more information.
|>>> import yaml
|Traceback (most recent call last):
|File "<stdin>", line 1, in <module>
|File "/usr/lib64/python3.8/site-packages/yaml/_init_.py", line 8, in <module>
|from .loader import *
|File "/usr/lib64/python3.8/site-packages/yaml/loader.py", line 8, in <module>
|from .constructor import *
|File "/usr/lib64/python3.8/site-packages/yaml/constructor.py", line 14, in <module>
|import collections.abc, datetime, base64, binascii, re, sys, types
|ModuleNotFoundError: No module named 'base64'
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5fceaa4964)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Running the "non-gpl3" builder in my local autobuilder fails
almost immediately because python3-dbusmock is not available. It
appears that during the creation of meta-python2 and cleanup of
meta-python that the recipe for python3-dbusmock got removed
entirely, so I've re-added it, and renamed the corresponding
patch folder so that it can find the patches listed in the
recipe.
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0acb9d90bc)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Error messages like the following are encountered if datetime and stringold
are not in RDEPENDS for pytoml, so add them:
|Python 3.8.2 (default, Apr 27 2020, 08:51:00)
|[GCC 9.3.0] on linux
|Type "help", "copyright", "credits" or "license" for more information.
|>>> import pytoml
|Traceback (most recent call last):
|File "<stdin>", line 1, in <module>
|File "/usr/lib64/python3.8/site-packages/pytoml/_init_.py", line 2, in <module>
|from .parser import load, loads
|File "/usr/lib64/python3.8/site-packages/pytoml/parser.py", line 3, in <module>
|from .utils import rfc3339_re, parse_rfc3339_re
|File "/usr/lib64/python3.8/site-packages/pytoml/utils.py", line 1, in <module>
|import datetime
|ModuleNotFoundError: No module named 'datetime'
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 75b3d7e7bf)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
python3-pyrsistent requires python3-numbers, so add it to RDEPENDS:
|Python 3.8.2 (default, Apr 27 2020, 08:51:00)
|[GCC 9.3.0] on linux
|Type "help", "copyright", "credits" or "license" for more information.
|>>> import pyrsistent
|Traceback (most recent call last):
|File "<stdin>", line 1, in <module>
|File "/usr/lib64/python3.8/site-packages/pyrsistent/_init_.py", line 3, in <module>
|from pyrsistent._pmap import pmap, m, PMap
|File "/usr/lib64/python3.8/site-packages/pyrsistent/_pmap.py", line 4, in <module>
|from pyrsistent._pvector import pvector
|File "/usr/lib64/python3.8/site-packages/pyrsistent/_pvector.py", line 3, in <module>
|from numbers import Integral
|ModuleNotFoundError: No module named 'numbers'
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 06916cbfbe)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
