diff --git a/lang/python314/Makefile b/lang/python314/Makefile index d3513d47ad73..55ea7849a9cf 100644 --- a/lang/python314/Makefile +++ b/lang/python314/Makefile @@ -1,196 +1,196 @@ PORTNAME= python DISTVERSION= ${PYTHON_DISTVERSION} # see Makefile.version -PORTREVISION= 3 +PORTREVISION= 0 CATEGORIES= lang python MASTER_SITES= PYTHON/ftp/python/${DISTVERSION:C/[a-z].*//} PKGNAMESUFFIX= ${PYTHON_SUFFIX} DISTNAME= Python-${DISTVERSION} DIST_SUBDIR= python MAINTAINER= mandree@FreeBSD.org COMMENT= Interpreted object-oriented programming language WWW= https://www.python.org/ LICENSE= PSFL LIB_DEPENDS= libexpat.so:textproc/expat2 \ libffi.so:devel/libffi \ libzstd.so:archivers/zstd USES= compiler:c11 cpe ncurses pathfix pkgconfig readline \ shebangfix ssl tar:xz PATHFIX_MAKEFILEIN= Makefile.pre.in USE_LDCONFIG= yes GNU_CONFIGURE= yes python_CMD= ${PREFIX}/bin/python${PYTHON_DISTVERSION:R} SHEBANG_FILES= Lib/*.py Lib/*/*.py Lib/*/*/*.py Lib/*/*/*/*.py SHEBANG_FILES+= Lib/test/archivetestdata/exe_with_z64 \ Lib/test/archivetestdata/exe_with_zip \ Lib/test/archivetestdata/header.sh # Duplicate python.mk variables. TODO: Let lang/python?? ports use python.mk bits. PYTHON_VER= ${PYTHON_DISTVERSION:R} PYTHON_VERSION= python${PYTHON_VER} PYTHON_SUFFIX= ${PYTHON_VER:S/.//g} DISABLED_EXTENSIONS= _gdbm _sqlite3 _tkinter CONFIGURE_ARGS+= --enable-shared --without-ensurepip --with-system-expat CONFIGURE_ENV+= OPT="" # Null out OPT to respect user CFLAGS and remove optimizations INSTALL_TARGET= altinstall # Don't want cloberring of unprefixed files # TEST_TARGET= buildbottest # that's the --slow-ci with more resources/longer timeouts TEST_TARGET= test # that's the --fast-ci with tighter timeouts and using less resources # TEST_ARGS: test_gdb requires debug symbols for the test_gdb.test_pretty_print test, so skip it unless defined(WITH_DEBUG) TEST_ARGS= TESTOPTS="-j${MAKE_JOBS_NUMBER} ${WITH_DEBUG:U-x test_gdb}" MAKE_ARGS+= COMPILEALL_OPTS=-j${MAKE_JOBS_NUMBER} \ INSTALL_SHARED="${INSTALL_LIB}" # Strip shared library SUB_FILES= pkg-message SUB_LIST= PYTHON_SUFFIX=${PYTHON_SUFFIX} PLIST_SUB= ABI=${ABIFLAGS} \ XY=${PYTHON_SUFFIX} \ XYDOT=${PYTHON_VER} \ XYZDOT=${DISTVERSION:C/[a-z].*//} \ OSMAJOR=${OSVERSION:C/([0-9]*)[0-9]{5}/\1/} # For plat-freebsd* in pkg-plist. https://bugs.python.org/issue19554 OPTIONS_DEFINE= DEBUG IPV6 LIBMPDEC LTO NLS PYMALLOC OPTIONS_DEFAULT= LIBMPDEC LTO PYMALLOC OPTIONS_EXCLUDE_riscv64= LTO OPTIONS_RADIO= HASH OPTIONS_RADIO_HASH= FNV SIPHASH OPTIONS_SUB= yes LIBMPDEC_DESC= Use libmpdec from ports instead of bundled version LTO_DESC= Use Link-Time Optimization with -flto=thin LTOFULL_DESC= Use -flto=full (not =thin) (faster build at more CPU time) NLS_DESC= Enable gettext support for the locale module PYMALLOC_DESC= Enable specialized mallocs HASH_DESC= Hash Algorithm (PEP-456) FNV_DESC= Modified Fowler-Noll-Vo Algorithm SIPHASH_DESC= SipHash24 Algorithm FNV_CONFIGURE_ON= --with-hash-algorithm=fnv SIPHASH_CONFIGURE_ON= --with-hash-algorithm=siphash24 DEBUG_CONFIGURE_WITH= pydebug IPV6_CONFIGURE_ENABLE= ipv6 LIBMPDEC_CONFIGURE_ON= --with-system-libmpdec LIBMPDEC_LIB_DEPENDS= libmpdec.so:math/mpdecimal LTO_CONFIGURE_ON= --with-lto=full # Use CPPFLAGS over CFLAGS due to -I ordering, causing elementtree and pyexpat # to break in Python 2.7, or preprocessor complaints in Python >= 3.3 # Upstream Issue: https://bugs.python.org/issue6299 NLS_USES= gettext-runtime NLS_CPPFLAGS= -I${LOCALBASE}/include NLS_LIBS= -L${LOCALBASE}/lib -lintl NLS_CONFIGURE_ENV_OFF= ac_cv_lib_intl_textdomain=no ac_cv_header_libintl_h=no PYMALLOC_CONFIGURE_WITH= pymalloc .include "${.CURDIR}/Makefile.version" .include .if ${PORT_OPTIONS:MDEBUG} ABIFLAGS:= d${ABIFLAGS} .endif .if !empty(ABIFLAGS) PLIST_FILES+= bin/python${PYTHON_VER}${ABIFLAGS} \ bin/python${PYTHON_VER}${ABIFLAGS}-config \ libdata/pkgconfig/python-${PYTHON_VER}${ABIFLAGS}.pc \ libdata/pkgconfig/python-${PYTHON_VER}${ABIFLAGS}-embed.pc .endif # See https://bugs.freebsd.org/115940 and https://bugs.freebsd.org/193650 .if !exists(/usr/bin/ypcat) || defined(WITHOUT_NIS) PLIST_SUB+= NO_NIS="@comment " DISABLED_EXTENSIONS+= nis .else PLIST_SUB+= NO_NIS="" .endif # Python 3.10 requires OpenSSL >= 1.1.1 (PEP 644), so with # libressl, some modules are not built .if ${SSL_DEFAULT:Mlibressl*} PLIST_SUB+= SUPPORTED_OPENSSL="@comment " .else PLIST_SUB+= SUPPORTED_OPENSSL="" .endif post-patch: # disable the detection of includes and library from e2fsprogs-libuuid, # which introduces hidden dependency and breaks build @${REINPLACE_CMD} -e 's|uuid/uuid.h|ignore_&|' ${WRKSRC}/configure # disable detection of multiarch as it breaks with clang >= 13, which adds a # major.minor version number in -print-multiarch output, confusing Python @${REINPLACE_CMD} -e 's|^\( *MULTIARCH=\).*--print-multiarch.*|\1|' ${WRKSRC}/configure # Apply DISABLED_EXTENSIONS @${ECHO_CMD} '*disabled*' > ${WRKSRC}/Modules/Setup.local . for _module in ${DISABLED_EXTENSIONS} @${ECHO_CMD} ${_module} >> ${WRKSRC}/Modules/Setup.local . endfor # Strip Expat module ${RM} -R ${WRKSRC}/Modules/expat post-install: .if ! ${PORT_OPTIONS:MDEBUG} ${RM} ${STAGEDIR}${PREFIX}/lib/libpython3.so # Upstream Issue: https://bugs.python.org/issue17975 .endif ${LN} -sf libpython${PYTHON_VER}${ABIFLAGS}.so.1.0 ${STAGEDIR}${PREFIX}/lib/libpython${PYTHON_VER}${ABIFLAGS}.so.1 # This code block exists for the qemu-user enabled cross build environment. # When using this environment in poudriere, CC is not set to the default # of /usr/bin/cc and a cross-compile toolchain is used. We need to hand # edit this so that the run time configuration for python matches what the # FreeBSD base system provides. sbruno 02Aug2017 .if ${CC} == /nxb-bin/usr/bin/cc @${REINPLACE_CMD} -e 's=/nxb-bin==g' \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py @cd ${WRKSRC} && ${SETENV} LD_LIBRARY_PATH=${WRKSRC} \ ./python -E -m compileall -d ${PREFIX}/lib/python${PYTHON_VER} \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py @cd ${WRKSRC} && ${SETENV} LD_LIBRARY_PATH=${WRKSRC} \ ./python -E -O -m compileall -d ${PREFIX}/lib/python${PYTHON_VER} \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/_sysconfigdata_${ABIFLAGS}_freebsd_.py @${REINPLACE_CMD} -e 's=/nxb-bin==g' \ ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/config-${PYTHON_VER}${ABIFLAGS}/Makefile .endif for i in ${STAGEDIR}${PREFIX}/lib/python${PYTHON_VER}/lib-dynload/*.so; do \ ${STRIP_CMD} $$i; done # Strip shared extensions ${INSTALL_DATA} ${WRKSRC}/Tools/gdb/libpython.py \ ${STAGEDIR}${PREFIX}/lib/libpython${PYTHON_VER}${ABIFLAGS}.so.1.0-gdb.py _sigstorebundle=${DISTFILES}.sigstore ${_sigstorebundle}: ${FETCH_CMD} ${MASTER_SITES}/${_sigstorebundle} sigstore-verify: ${_sigstorebundle} checksum sigstore verify identity \ --bundle ${DISTFILES}.sigstore \ --cert-identity hugo@python.org \ --cert-oidc-issuer https://github.com/login/oauth \ ${DISTDIR}/${DIST_SUBDIR}/${DISTFILES} pre-test: @${ECHO_CMD} "=== NOTE: the py314-* gdbm, sqlite3, tkinter modules must be rebuilt before the test ===" .if ${PORT_OPTIONS:MDEBUG} @${ECHO_CMD} "=== NOTE: The test_ssl test is known to fail with DEBUG option enabled ===" .endif .if empty(PORT_OPTIONS:MIPV6) @${ECHO_CMD} "=== NOTE: Some asynch tests require IPV6 support enabled, expect some test failures ===" .endif .if empty(PORT_OPTIONS:MPYMALLOC) @${ECHO_CMD} "=== NOTE: Some tests depend on PYMALLOC option enabled, expect some test failures ===" .endif sleep 5 post-clean: @${RM} ${_sigstorebundle} .include diff --git a/lang/python314/Makefile.version b/lang/python314/Makefile.version index c8ccfa3963b0..01917fa79e66 100644 --- a/lang/python314/Makefile.version +++ b/lang/python314/Makefile.version @@ -1,7 +1,7 @@ # Mk/Uses/python.mk includes this file, don't remove it! # Do not forget to # 1. Update python documentation (lang/python-doc-*) # Run "make -C lang/python-doc-html makesum" # 2. Remove PORTREVISION in Makefile -PYTHON_DISTVERSION= 3.14.4 +PYTHON_DISTVERSION= 3.14.5 diff --git a/lang/python314/distinfo b/lang/python314/distinfo index 7c5dead58955..762b3cb841c8 100644 --- a/lang/python314/distinfo +++ b/lang/python314/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1775640582 -SHA256 (python/Python-3.14.4.tar.xz) = d923c51303e38e249136fc1bdf3568d56ecb03214efdef48516176d3d7faaef8 -SIZE (python/Python-3.14.4.tar.xz) = 23855332 +TIMESTAMP = 1778513616 +SHA256 (python/Python-3.14.5.tar.xz) = 7e32597b99e5d9a39abed35de4693fa169df3e5850d4c334337ffd6a19a36db6 +SIZE (python/Python-3.14.5.tar.xz) = 23903332 diff --git a/lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers b/lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers deleted file mode 100644 index 989f22a0529b..000000000000 --- a/lang/python314/files/patch-gh-146211-reject-CR_LF-in-HTTP-tunnel-request-headers +++ /dev/null @@ -1,108 +0,0 @@ -From afdd351544e8112d4070a31f2218f99256697472 Mon Sep 17 00:00:00 2001 -From: Seth Larson -Date: Fri, 10 Apr 2026 10:21:42 -0500 -Subject: [PATCH] gh-146211: Reject CR/LF in HTTP tunnel request headers - (GH-146212) (cherry picked from commit - 05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69) - -Co-authored-by: Seth Larson -Co-authored-by: Illia Volochii ---- - Lib/http/client.py | 11 ++++- - Lib/test/test_httplib.py | 45 +++++++++++++++++++ - ...-03-20-09-29-42.gh-issue-146211.PQVbs7.rst | 2 + - 3 files changed, 57 insertions(+), 1 deletion(-) - create mode 100644 Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst - -diff --git a/Lib/http/client.py b/Lib/http/client.py -index 77f8d26291dfc2..6fb7d254ea9c27 100644 ---- ./Lib/http/client.py -+++ b/Lib/http/client.py -@@ -972,13 +972,22 @@ def _wrap_ipv6(self, ip): - return ip - - def _tunnel(self): -+ if _contains_disallowed_url_pchar_re.search(self._tunnel_host): -+ raise ValueError('Tunnel host can\'t contain control characters %r' -+ % (self._tunnel_host,)) - connect = b"CONNECT %s:%d %s\r\n" % ( - self._wrap_ipv6(self._tunnel_host.encode("idna")), - self._tunnel_port, - self._http_vsn_str.encode("ascii")) - headers = [connect] - for header, value in self._tunnel_headers.items(): -- headers.append(f"{header}: {value}\r\n".encode("latin-1")) -+ header_bytes = header.encode("latin-1") -+ value_bytes = value.encode("latin-1") -+ if not _is_legal_header_name(header_bytes): -+ raise ValueError('Invalid header name %r' % (header_bytes,)) -+ if _is_illegal_header_value(value_bytes): -+ raise ValueError('Invalid header value %r' % (value_bytes,)) -+ headers.append(b"%s: %s\r\n" % (header_bytes, value_bytes)) - headers.append(b"\r\n") - # Making a single send() call instead of one per line encourages - # the host OS to use a more optimal packet size instead of -diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py -index bcb828edec7c39..6f3eac6b98a4de 100644 ---- ./Lib/test/test_httplib.py -+++ b/Lib/test/test_httplib.py -@@ -369,6 +369,51 @@ def test_invalid_headers(self): - with self.assertRaisesRegex(ValueError, 'Invalid header'): - conn.putheader(name, value) - -+ def test_invalid_tunnel_headers(self): -+ cases = ( -+ ('Invalid\r\nName', 'ValidValue'), -+ ('Invalid\rName', 'ValidValue'), -+ ('Invalid\nName', 'ValidValue'), -+ ('\r\nInvalidName', 'ValidValue'), -+ ('\rInvalidName', 'ValidValue'), -+ ('\nInvalidName', 'ValidValue'), -+ (' InvalidName', 'ValidValue'), -+ ('\tInvalidName', 'ValidValue'), -+ ('Invalid:Name', 'ValidValue'), -+ (':InvalidName', 'ValidValue'), -+ ('ValidName', 'Invalid\r\nValue'), -+ ('ValidName', 'Invalid\rValue'), -+ ('ValidName', 'Invalid\nValue'), -+ ('ValidName', 'InvalidValue\r\n'), -+ ('ValidName', 'InvalidValue\r'), -+ ('ValidName', 'InvalidValue\n'), -+ ) -+ for name, value in cases: -+ with self.subTest((name, value)): -+ conn = client.HTTPConnection('example.com') -+ conn.set_tunnel('tunnel', headers={ -+ name: value -+ }) -+ conn.sock = FakeSocket('') -+ with self.assertRaisesRegex(ValueError, 'Invalid header'): -+ conn._tunnel() # Called in .connect() -+ -+ def test_invalid_tunnel_host(self): -+ cases = ( -+ 'invalid\r.host', -+ '\ninvalid.host', -+ 'invalid.host\r\n', -+ 'invalid.host\x00', -+ 'invalid host', -+ ) -+ for tunnel_host in cases: -+ with self.subTest(tunnel_host): -+ conn = client.HTTPConnection('example.com') -+ conn.set_tunnel(tunnel_host) -+ conn.sock = FakeSocket('') -+ with self.assertRaisesRegex(ValueError, 'Tunnel host can\'t contain control characters'): -+ conn._tunnel() # Called in .connect() -+ - def test_headers_debuglevel(self): - body = ( - b'HTTP/1.1 200 OK\r\n' -diff --git a/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst b/Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst -new file mode 100644 -index 00000000000000..4993633b8ebebb ---- /dev/null -+++ ./Misc/NEWS.d/next/Security/2026-03-20-09-29-42.gh-issue-146211.PQVbs7.rst -@@ -0,0 +1,2 @@ -+Reject CR/LF characters in tunnel request headers for the -+HTTPConnection.set_tunnel() method. diff --git a/lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser b/lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser deleted file mode 100644 index 7dffa8ff1cfe..000000000000 --- a/lang/python314/files/patch-gh-146333-Fix-quadratic-regex-backtracking-in-configparser +++ /dev/null @@ -1,83 +0,0 @@ -From ab8704a8e05e2f926c10f994e4085e8726048fa4 Mon Sep 17 00:00:00 2001 -From: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com> -Date: Tue, 7 Apr 2026 16:10:34 +0200 -Subject: [PATCH] gh-146333: Fix quadratic regex backtracking in configparser - option parsing (GH-146399) - -Use negative lookahead in option regex to prevent backtracking, and to avoid changing logic outside the regexes (since people could use the regex directly). -(cherry picked from commit 7e0a0be4097f9d29d66fe23f5af86f18a34ed7dd) - -Co-authored-by: Joshua Swanson <22283299+joshuaswanson@users.noreply.github.com> ---- - Lib/configparser.py | 8 ++++++-- - Lib/test/test_configparser.py | 20 +++++++++++++++++++ - ...3-25-00-51-03.gh-issue-146333.LqdL__bn.rst | 3 +++ - 3 files changed, 29 insertions(+), 2 deletions(-) - create mode 100644 Misc/NEWS.d/next/Security/2026-03-25-00-51-03.gh-issue-146333.LqdL__bn.rst - -diff --git a/Lib/configparser.py b/Lib/configparser.py -index d435a5c2fe0da2..e76647d339e913 100644 ---- ./Lib/configparser.py -+++ b/Lib/configparser.py -@@ -613,7 +613,9 @@ class RawConfigParser(MutableMapping): - \] # ] - """ - _OPT_TMPL = r""" -- (?P