Skip to content

python27: switch to ActiveState's fork for Python 2#203428

Merged
thiagokokada merged 3 commits intoNixOS:stagingfrom
thiagokokada:python27-activestate
Nov 28, 2022
Merged

python27: switch to ActiveState's fork for Python 2#203428
thiagokokada merged 3 commits intoNixOS:stagingfrom
thiagokokada:python27-activestate

Conversation

@thiagokokada
Copy link
Contributor

@thiagokokada thiagokokada commented Nov 28, 2022 •
edited
Loading

Description of changes

ActiveState is a company that is maintaining a fork of Python 2 to fixes its security issues. Their support is paid, however the code is open-source. See the details here: https://www.activestate.com/products/python/python-2-end-of-life-security-updates/

This enable us to drop a bunch of CVE's patches for Python 2.7 and also it should be easier to maintain, since we can just bump the version once ActiveState tags a new version.

See the discussion of #201859 for the reasoning.

Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 22.11 Release Notes (or backporting 22.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@thiagokokada
python27: switch to ActiveState's fork for Python 2
14334cb 
ActiveState is a company that is maintaining a fork of Python 2 to fixes
its security issues. Their support is paid, however the code is
open-source. See the details here:
https://www.activestate.com/products/python/python-2-end-of-life-security-updates/

This enable us to drop a bunch of CVE's patches for Python 2.7 and also
it should be easier to maintain, since we can just bump the version once
ActiveState tags a new version.
@thiagokokada
python27: add thiagokokada as maintainer
b3d02fb
@thiagokokada thiagokokada requested a review from FRidh as a code owner November 28, 2022 09:42
@github-actions github-actions bot added the 6.topic: python Python is a high-level, general-purpose programming language. label Nov 28, 2022
thiagokokada
thiagokokada commented Nov 28, 2022
View reviewed changes
pkgs/development/interpreters/python/cpython/2.7/default.nix
./profile-task.patch

# https://www.activestate.com/products/python/python-2-end-of-life-security-updates/
./CVE-2019-20907.patch
Copy link
Contributor Author

@thiagokokada thiagokokada Nov 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ActiveState/cpython@e8efbb4

thiagokokada
thiagokokada commented Nov 28, 2022
View reviewed changes
pkgs/development/interpreters/python/cpython/2.7/default.nix

# https://www.activestate.com/products/python/python-2-end-of-life-security-updates/
./CVE-2019-20907.patch
./CVE-2020-8492.patch
Copy link
Contributor Author

@thiagokokada thiagokokada Nov 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ActiveState/cpython@33e2642

thiagokokada
thiagokokada commented Nov 28, 2022
View reviewed changes
pkgs/development/interpreters/python/cpython/2.7/default.nix
# https://www.activestate.com/products/python/python-2-end-of-life-security-updates/
./CVE-2019-20907.patch
./CVE-2020-8492.patch
./CVE-2020-26116.patch
Copy link
Contributor Author

@thiagokokada thiagokokada Nov 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ActiveState/cpython@15b0c63

thiagokokada
thiagokokada commented Nov 28, 2022
View reviewed changes
pkgs/development/interpreters/python/cpython/2.7/default.nix
./CVE-2019-20907.patch
./CVE-2020-8492.patch
./CVE-2020-26116.patch
./CVE-2020-27619.patch
Copy link
Contributor Author

@thiagokokada thiagokokada Nov 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ActiveState/cpython@ec1b465

thiagokokada
thiagokokada commented Nov 28, 2022
View reviewed changes
pkgs/development/interpreters/python/cpython/2.7/default.nix
./CVE-2020-8492.patch
./CVE-2020-26116.patch
./CVE-2020-27619.patch
./CVE-2021-3177.patch
Copy link
Contributor Author

@thiagokokada thiagokokada Nov 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ActiveState/cpython@21f322e

thiagokokada
thiagokokada commented Nov 28, 2022
View reviewed changes
pkgs/development/interpreters/python/cpython/2.7/default.nix
./CVE-2020-26116.patch
./CVE-2020-27619.patch
./CVE-2021-3177.patch
./CVE-2021-23336.patch
Copy link
Contributor Author

@thiagokokada thiagokokada Nov 28, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ActiveState/cpython@dbdd134

@thiagokokada thiagokokada mentioned this pull request Nov 28, 2022
Merged
13 tasks
@ofborg ofborg bot added 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 10.rebuild-darwin: 101-500 This PR causes between 101 and 500 packages to rebuild on Darwin. 10.rebuild-linux: 101-500 This PR causes between 101 and 500 packages to rebuild on Linux. labels Nov 28, 2022
@thiagokokada
Copy link
Contributor Author

thiagokokada commented Nov 28, 2022

CC @mweinelt since you reviewed #203362.

@thiagokokada thiagokokada mentioned this pull request Nov 28, 2022
Merged
13 tasks
@thiagokokada
Copy link
Contributor Author

thiagokokada commented Nov 28, 2022

BTW, this will fix CVE-2022-0391 (see ActiveState/cpython@8c70fb4), that was not fixed in #203362, so we should merge it ASAP if this is the way we want to go.

@thiagokokada
Copy link
Contributor Author

thiagokokada commented Nov 28, 2022 •
edited
Loading

In master branch of ActiveState there is one other CVE that will be included in the 2.7.18.6 release: ActiveState/cpython@eeb7fe5

However, this CVE-2021-3733 is a DoS bug so it shouldn't be that problematic. And it should be fixed soon anyway (once ActiveState tags a new release).

@thiagokokada thiagokokada added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Nov 28, 2022
@thiagokokada
Copy link
Contributor Author

thiagokokada commented Nov 28, 2022

In master branch of ActiveState there is one other CVE that will be included in the 2.7.18.6 release: ActiveState/cpython@eeb7fe5

However, this CVE-2021-3733 is a DoS bug so it shouldn't be that problematic. And it should be fixed soon anyway (once ActiveState tags a new release).

Decided to backport this patch. Now all known issues from ActiveState should be fixed.

FRidh
FRidh approved these changes Nov 28, 2022
View reviewed changes
Copy link
Member

@FRidh FRidh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a good idea.

I have not tested the build but by reading what it is about and skimming the commits they added I see no reason why there would be any issues.

@thiagokokada thiagokokada merged commit 8bfb5da into NixOS:staging Nov 28, 2022
@thiagokokada thiagokokada deleted the python27-activestate branch November 28, 2022 14:16
@fabianhjr
Copy link
Member

fabianhjr commented Nov 28, 2022

Hey, I remember some time ago reading that the Python foundation made a public position that they would send c&d to forks of python 2 that created new tags (like 2.7.18.5) nad didn't differentiate the name enough from python.

@github-actions github-actions bot mentioned this pull request Nov 28, 2022
Merged
1 task
@github-actions
Copy link
Contributor

github-actions bot commented Nov 28, 2022

Successfully created backport PR #203458 for staging-22.11.

@thiagokokada
Copy link
Contributor Author

thiagokokada commented Nov 28, 2022 •
edited
Loading

Hey, I remember some time ago reading that the Python foundation made a public position that they would send c&d to forks of python 2 that created new tags (like 2.7.18.5) nad didn't differentiate the name enough from python.

I wouldn't worry it too much right now, unless Python started to enforce it.

In the worst case, we can patch ActiveState to show 2.7.18 instead. If I remember correctly, it is a one file patch.

@fabianhjr
Copy link
Member

fabianhjr commented Nov 28, 2022

A thread about trademark anda "Python 2.8" fork.

naftaliharris/tauthon#47

@thiagokokada
Copy link
Contributor Author

thiagokokada commented Nov 28, 2022 •
edited
Loading

A thread about trademark anda "Python 2.8" fork.

naftaliharris/tauthon#47

tauthon is very much a different beast though. It add new features and even has a few breaking changes compared to Python 2.7, so it is pretty much not Python.

ActivateState's fork is just a few security fixes, no new features. It is not that much different from us shipping a few extra security patches with the exception of the add prefix to the version. If Python devs complain about it, I can happily patch the version out. Otherwise let's just keep it as-is.

@fabianhjr
Copy link
Member

fabianhjr commented Nov 28, 2022

Sounds good

@fabianhjr fabianhjr mentioned this pull request Nov 28, 2022
Merged
vcunat added a commit that referenced this pull request Nov 30, 2022
@vcunat
Merge #203428: python27: switch to ActiveState's fork
21716f1 
...into staging-next.  This is a topologically earlier re-merge
(than 8bfb5da) as the rebuild amount isn't large.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mweinelt mweinelt mweinelt approved these changes

+1 more reviewer

@FRidh FRidh FRidh approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 6.topic: python Python is a high-level, general-purpose programming language. 10.rebuild-darwin: 101-500 This PR causes between 101 and 500 packages to rebuild on Darwin. 10.rebuild-linux: 101-500 This PR causes between 101 and 500 packages to rebuild on Linux. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@thiagokokada @fabianhjr @mweinelt @FRidh