Skip to content

Commit

Permalink
[#5727] OpenSSL August 2021 patches. (#152)
Browse files Browse the repository at this point in the history 
* Back to downloading with Start-BitsTransfer on Windows.

* Updated OpenSSL 1.1.1 sources to version 1.1.1l.

* Build OpenSSL 1.1.1l instead of 1.1.1k where needed.

* Patched OpenSSL 1.0.2 sources for CVE-2021-3712.

* Updated cffi sources to version 1.14.6.

* Use latest cffi version.

* Updated version for our patched OpenSSL 1.0.2v sources.

* Updated external deps docs.

* Use the paxctl package on Alpine 3.14.

* Use published CentOS 5.11 chevah setup.
  • Loading branch information
@dumol
dumol authored Sep 16, 2021
1 parent 039620e commit ad5a0e1
Show file tree
Hide file tree
Showing 5,573 changed files with 2,505 additions and 814 deletions.
The diff you're trying to view is too large. We only load the first 3000 changed files.
4 changes: 1 addition & 3 deletions .github/workflows/bare.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -176,9 +176,7 @@ jobs:
run: |
chocolatey install --yes --no-progress make nasm 7zip curl
# There's no vcpython27 choco pkg since Microsoft removed the installer.
#Start-BitsTransfer https://bin.chevah.com:20443/third-party-stuff/VCForPython27.msi
# Pending upstream fix for SFTPPlus, we use the real curl for now.
curl.exe -O https://bin.chevah.com:20443/third-party-stuff/VCForPython27.msi
Start-BitsTransfer https://bin.chevah.com:20443/third-party-stuff/VCForPython27.msi
msiexec /quiet /i VCForPython27.msi
- name: Clone sources independently
Expand Down
25 changes: 4 additions & 21 deletions .github/workflows/docker.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,9 @@ jobs:
strategy:
fail-fast: false
matrix:
container: [ 'alpine:3.14', 'centos:8.2.2004', 'centos:5.11' ]
# CentOS 5.11 setup was saved as an image pushed to Docker Hub. See the
# Overview section at https://hub.docker.com/r/proatria/centos for details.
container: [ 'alpine:3.14', 'centos:8.2.2004', 'proatria/centos:5.11-chevah1' ]
timeout-minutes: 30
steps:

Expand All @@ -39,9 +41,7 @@ jobs:
if: startsWith(matrix.container, 'alpine')
run: |
apk upgrade -U
apk add git curl bash gcc make m4 automake libtool patch zlib-dev libffi-dev ncurses-dev linux-headers musl-dev openssl-dev lddtree shadow sudo openssh-client
curl -o /usr/local/bin/paxctl https://bin.chevah.com:20443/third-party-stuff/alpine/paxctl-3.12
chmod +x /usr/local/bin/paxctl
apk add git curl bash gcc make m4 automake libtool patch zlib-dev libffi-dev ncurses-dev linux-headers musl-dev openssl-dev lddtree shadow sudo openssh-client paxctl
# Stick to CentOS 8.2 as OpenSSL got updated in 8.3 from 1.1.1c to 1.1.1g.
- name: CentOS 8.2 setup
Expand All @@ -52,23 +52,6 @@ jobs:
yum -y upgrade
yum -y install git curl gcc make m4 automake libtool patch openssl-devel zlib-devel libffi-devel ncurses-devel sudo which openssh-clients
# Final CentOS 5 version is used to build the generic Linux package.
- name: CentOS 5.11 setup
if: matrix.container == 'centos:5.11'
run: |
sed -i s/^mirrorlist=/#mirrorlist=/ /etc/yum.repos.d/*.repo
sed -i s@^#baseurl=http://mirror.centos.org/centos/\$releasever/@baseurl=http://vault.centos.org/5.11/@ /etc/yum.repos.d/*.repo
yum -y upgrade
# Use https://bin.chevah.com:20443/third-party-stuff/centos5/tuxad/
# when tuxad.de dissapears, it has the minimum required stuff.
rpm -i http://www.tuxad.de/rpms/tuxad-release-5-1.noarch.rpm
yum -y install wget curl gcc44 make m4 automake libtool patch sudo which openssh-clients
ln -s /usr/bin/gcc44 /usr/local/bin/gcc
wget --mirror --no-parent https://bin.chevah.com:20443/third-party-stuff/centos5/endpoint/
cd bin.chevah.com\:20443/third-party-stuff/centos5/endpoint/
rpm -i local-perl-*.rpm
rpm -i --nodeps git{-core,}-2.5.0-1.ep.x86_64.rpm
# On a Docker container, everything runs as root by default.
- name: Chevah user setup
run: |
Expand Down
10 changes: 4 additions & 6 deletions chevah_build
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,7 @@
#
# build
# test
# publish_production
# publish_staging
#
# compat (for the compat repo tests)

PYTHON_BUILD_VERSION="2.7.18"
LIBFFI_VERSION="3.2.1"
Expand All @@ -15,12 +13,12 @@ BZIP2_VERSION="1.0.8"
# We statically build the BSD libedit on selected platforms to get the
# readline module available without linking to the GPL-only readline libs.
LIBEDIT_VERSION="20170329-3.1"
OPENSSL_VERSION="1.1.1k"
OPENSSL_VERSION="1.1.1l"
SQLITE_VERSION="3.36.0"

# Python modules versions to be used everywhere possible.
PYSQLITE_VERSION="2.8.3"
CFFI_VERSION="1.14.5"
CFFI_VERSION="1.14.6"
# 19.1.0 is used with OpenSSL 1.0.2 libs.
PYOPENSSL_VERSION="20.0.1"
SCANDIR_VERSION="1.10.0"
Expand Down Expand Up @@ -196,7 +194,7 @@ case $OS in
# As of January 2021, OpenSSL 1.0.2u is the latest version from IBM.
export BUILD_OPENSSL="yes"
# 1.1.1 tests fail on AIX, use 1.0.2 with patches from Ubuntu 16.04 LTS.
OPENSSL_VERSION="1.0.2v-chevah2"
OPENSSL_VERSION="1.0.2v-chevah3"
# Perl's Test::Simple and its deps are required for building OpenSSL.
execute perl -MTest::Simple -e 1
# cryptography 3.2.x, last version to support OpenSSL 1.0.2.
Expand Down
32 changes: 16 additions & 16 deletions external_deps.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,21 @@ OS,AIX,,,Amazon,Alpine,,Debian,FreeBSD,,HP-UX,macOS,OS X,RHEL,,,,SLES,,Solaris,,
OS Version,5.3³,6.1³,7.1¹,2¹,3.12³,3.14¹,5.0+³,11.4³,12.2²,11.31²,10.13+¹,10.8³,5.11¹,6.x¹,7.x¹,8.x¹,11SP4¹,12SP3¹,10u8+³,11.0/11.1³,11.2²,11.4²,14.04²,16.04¹,18.04¹,20.04¹,"XP, 2003, 2008²","2012r2, 2016, 2019¹"
"OpenSSL /
LibreSSL⁶","1.0.2v-chevah2 (statically linked with stdlib “ssl”)
1.0.2v-chevah2 (statically linked with cryptography)",1.0.2k (from AIX Web Download Pack Programs),"1.0.2v-chevah2 (statically linked with stdlib “ssl”)
1.0.2v-chevah2 (statically linked with cryptography)","1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)",1.1.1j,1.1.1k,"1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)",1.0.1u,1.0.2s,1.0.2h,"1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)","1.1.1g (statically built for stdlib “ssl”)
1.1.1g (bundled with upstream cryptography 2.9.1)","1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)","1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)","1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)",1.1.1c FIPS,"1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)","1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)",1.0.2n (from upstream Oracle patches),1.0.0x,1.0.1h,1.0.2o,"1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)","1.1.1k (statically linked with stdlib “ssl”)
1.1.1k (statically linked with cryptography)",1.1.0g,1.1.1f,"1.0.2t (bundled with upstream Python 2.7.18)
1.0.2v-chevah2 (statically linked with cryptography)",1.0.2k (from AIX Web Download Pack Programs),"1.0.2v-chevah3 (statically linked with stdlib “ssl”)
1.0.2v-chevah3 (statically linked with cryptography)","1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)",1.1.1j,1.1.1l,"1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)",1.0.1u,1.0.2s,1.0.2h,"1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)","1.1.1g (statically built for stdlib “ssl”)
1.1.1g (bundled with upstream cryptography 2.9.1)","1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)","1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)","1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)",1.1.1c FIPS,"1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)","1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)",1.0.2n (from upstream Oracle patches),1.0.0x,1.0.1h,1.0.2o,"1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)","1.1.1l (statically linked with stdlib “ssl”)
1.1.1l (statically linked with cryptography)",1.1.0g,1.1.1f,"1.0.2t (bundled with upstream Python 2.7.18)
1.1.1g (bundled with upstream cryptography 2.9.1)","1.0.2t¹⁰ (bundled with upstream Python 2.7.18)
1.1.1k (built from upstream sources)"
1.1.1l (built from upstream sources)"
Python,2.7.18+patches,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.8⁴,2.7.18¹¹,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18+patches,2.7.18¹¹,2.7.18¹³
SQLite,3.34.1,3.34.1,3.36.0,3.36.0,3.34.1,3.36.0,3.36.0,3.30.1,3.34.1,3.34.1,3.36.0,3.30.1,3.36.0,3.36.0,3.36.0,3.36.0,3.36.0,3.36.0,3.34.1,3.30.1,3.34.1,3.34.1,3.36.0,3.36.0,3.36.0,3.36.0,3.30.1 (we overwrite version from upstream Python at build time),3.36.0 (we overwrite version from upstream Python at build time)
Expat,2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.1.0⁵ (bundled with Python 2.7.8),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python),2.2.8 (bundled with Python)
Expand All @@ -27,13 +27,13 @@ libedit,n/a,n/a,n/a,n/a,20170329-3.1,20170329-3.1,n/a,20170329-3.1,20170329-3.1,
pysqlite,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,2.8.3,"n/a, upstream sqlite3 is used","n/a, upstream sqlite3 is used"
pip,20.3.4,9.0.3,20.3.4,20.3.4,9.0.3,20.3.4,20.3.4,9.0.3,20.3.4,20.3.4,20.3.4,9.0.3,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4,9.0.3,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4,20.3.4
setuptools,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,41.6.0,41.6.0,41.6.0,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1,44.1.1
wheel,0.36.2,0.33.6,0.36.2,0.36.2,0.33.6,0.36.2,0.36.2,0.33.6,0.36.2,0.36.2,0.36.2,0.33.6,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2,0.33.6,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2,0.36.2
wheel,0.36.2,0.33.6,0.37.0,0.37.0,0.33.6,0.37.0,0.37.0,0.33.6,0.37.0,0.36.2,0.37.0,0.33.6,0.37.0,0.37.0,0.37.0,0.37.0,0.37.0,0.37.0,0.36.2,0.33.6,0.36.2,0.37.0,0.37.0,0.37.0,0.37.0,0.37.0,0.36.2,0.37.0
pycparser,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20,2.20
setproctitle,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10
cryptography,3.2.1¹²,2.9.2¹²,3.2.1¹²,3.3.2,3.3.2,3.3.2,3.3.2,2.9.2¹²,3.3.2,n/a,3.3.2,2.9.2¹² (wheel includes OpenSSL),3.3.2,3.3.2,3.3.2,3.3.2,3.3.2,3.3.2,n/a,n/a,n/a,3.2.1¹²,3.3.2,3.3.2,3.3.2,3.3.2,2.9.2¹² (wheel includes OpenSSL),3.3.2 (wheel includes OpenSSL)
six,1.15.0,1.13.0,1.15.0,1.15.0,1.15.0,1.15.0,1.15.0,1.11.0,1.15.0,1.15.0,1.15.0,1.11.0,1.15.0,1.15.0,1.15.0,1.15.0,1.15.0,1.15.0,1.15.0,1.11.0,1.15.0,1.15.0,1.11.0,1.11.0,1.11.0,1.11.0,1.11.0,1.11.0
ipaddress,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,n/a,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,n/a,n/a,n/a,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23,1.0.23
cffi,1.14.5,1.14.0,1.14.5,1.14.5,1.14.0,1.14.5,1.14.5,1.14.0,1.14.5,n/a,1.14.5,1.14.0,1.14.5,1.14.5,1.14.5,1.14.5,1.14.5,1.14.5,n/a,1.14.0,1.14.5,1.14.5,1.14.5,1.14.5,1.14.5,1.14.5,1.14.0,1.14.5
cffi,1.14.5,1.14.0,1.14.6,1.14.6,1.14.0,1.14.6,1.14.6,1.14.0,1.14.6,n/a,1.14.6,1.14.0,1.14.6,1.14.6,1.14.6,1.14.6,1.14.6,1.14.6,n/a,1.14.0,1.14.5,1.14.6,1.14.6,1.14.6,1.14.6,1.14.6,1.14.0,1.14.6
asn1crypto,n/a,1.2.0,n/a,n/a,n/a,n/a,n/a,1.2.0,n/a,n/a,n/a,1.2.0,n/a,n/a,n/a,n/a,n/a,n/a,n/a,1.2.0,n/a,n/a,n/a,n/a,n/a,n/a,1.2.0,n/a
enum34,1.1.10,1.1.6,1.1.10,1.1.10,1.1.6,1.1.10,1.1.10,1.1.6,1.1.10,n/a,1.1.10,1.1.6,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,,,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.10,1.1.6,1.1.10
idna,n/a,2.6,n/a,n/a,n/a,n/a,n/a,2.6,n/a,n/a,n/a,2.6,n/a,n/a,n/a,n/a,n/a,n/a,n/a,2.6,n/a,n/a,n/a,n/a,n/a,n/a,2.6,n/a
Expand Down
Loading

0 comments on commit ad5a0e1

Please sign in to comment.