PycURL changeLog:
Version 7.43.0.6 - 2020-09-02
-----------------------------------------------------------------
This release improves SSL backend detection on various systems, adds support for libcurl’s multiple SSL backend functionality and adds support for several libcurl options.
Signed-off-by: Waldemar Konik <informatyk74@interia.pl>
Compile tested: x86_64
OpenWrt added pcre/host recently. When it is available (installed)
erlang finds staging_dir/hostpkg/include/pcre.h before it finds its own
copy and the build fails.
CC obj/x86_64-pc-linux-gnu/opt/smp/erl_bif_chksum.o
CC obj/x86_64-pc-linux-gnu/opt/smp/erl_bif_re.o
beam/erl_bif_re.c: In function 'erts_init_bif_re':
beam/erl_bif_re.c:96:5: error: 'erts_pcre_malloc' undeclared (first use in this function)
erts_pcre_malloc = &erts_erts_pcre_malloc;
^~~~~~~~~~~~~~~~
beam/erl_bif_re.c:96:5: note: each undeclared identifier is reported only once for each function it appears in
beam/erl_bif_re.c:97:5: error: 'erts_pcre_free' undeclared (first use in this function)
erts_pcre_free = &erts_erts_pcre_free;
^~~~~~~~~~~~~~
This adds a patch from Romain Naour and Bernd Kuhls to prevent that.
Patch snatched from buildroot [1].
[1] https://github.com/buildroot/buildroot/blob/master/package/erlang/0002-erts-emulator-reorder-inclued-headers-paths.patch
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
This also removes PKG_BUILD_PARALLEL:=0 that was added for packages that
use HOST_PYTHON3_PACKAGE_BUILD_DEPENDS.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
In hash-checking mode[1], pip will verify downloaded package archives
(source tarballs in our case) against known SHA256 hashes before
installing the packages.
As a consequence, this requires the use of requirements files[2] and
pinning packages to known versions.
The syntax for package Makefiles has changed slightly;
HOST_PYTHON3_PACKAGE_BUILD_DEPENDS no longer accepts requirement
specifiers like "foo>=1.0", only requirements file names (which are the
same as package names in the most common case).
This also updates affected packages, in particular:
* python-zipp: "setuptools_scm[toml]" has been split into
"setuptools-scm toml" to reuse the requirements file for
setuptools-scm (the extra depends installed by "setuptools_scm[toml]"
is toml).
* python-pycparser: This previously used ply 3.10, whereas the
requirements file will now install 3.11.
[1]: https://pip.pypa.io/en/stable/reference/pip_install/#hash-checking-mode
[2]: https://pip.pypa.io/en/stable/user_guide/#requirements-files
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This adds a config option PYTHON3_HOST_PIP_CACHE_WORLD_READABLE; if
enabled, chmod will be run after pip install to make all
files/directories in the host pip cache world-readable.
Supersedes https://github.com/openwrt/packages/pull/13012.
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
This includes a fix for CVE-2020-16845 (encoding/binary: ReadUvarint and
ReadVarint can read an unlimited number of bytes from invalid inputs).
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
Fixes https://github.com/openwrt/packages/issues/13016
Patch [1] broke compilation for python-pynacl.
The fix is to patch PyNaCl to consider that
PYNACL_HAS_CRYPTO_SCALARMULT_ED25519 is always available.
[1] 3ef28a4ab0
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
upgrade npm to 6.14.6
update openssl to 1.1.1g
Vulnerabilities fixed:
* CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
* CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
* CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption (High).
Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
Waldemar Konik
Javier Marcet
Jan Pavlinec
Sebastian Kemper
Jeffery To
Vladimir Malyutin
Hirokazu MORIKAWA
Rosen Penev
Alexandru Ardelean
Karl Palsson
Michael Heimpold
Zbyněk Kocur
Peter Stadler