CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

lang/python272.7.18_5

Interpreted object-oriented programming language

Maintainer
python@FreeBSD.org
Packages
python27 2.7.18_5
Upstream
Higher version available: 3.15.1
CPE
python:python from the port
WWW
https://www.python.org/
Links
cgit · VuXML

Unaddressed (35) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2022-485659.8published 2023-08-22

An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.

CVE-2007-45599.8published 2007-08-28

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

CVE-2017-175228.8published 2017-12-14

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the d…

CVE-2026-153088.7published 2026-07-09

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

CVE-2024-62327.5published 2024-09-03

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVE-2024-75927.5published 2024-08-19

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

CVE-2022-485607.5published 2023-08-22

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

CVE-2023-366327.5published 2023-06-25

The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data that was supposed to contain a name and an e-mail address. NOTE: email.utils.par…

CVE-2023-243297.5published 2023-02-17

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

CVE-2022-450617.5published 2022-11-09

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malic…

CVE-2022-03917.5published 2022-02-09

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks…

CVE-2015-56527.2published 2015-10-06

Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."

CVE-2026-45197.0published 2026-03-20

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

CVE-2022-264887.0published 2022-03-10

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repai…

CVE-2022-485646.5published 2023-08-22

read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.

CVE-2021-37336.5published 2022-03-10

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that th…

CVE-2017-182076.5published 2018-03-01

The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-by-zero and exception) via a crafted wav format audio file. NOTE: the vendor disputes this issue because Python applications "need to be prepared to handle a wide variety of except…

CVE-2026-72106.3published 2026-05-11

`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

CVE-2025-127816.3published 2026-01-21

When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alternative base64 alphabet" such as the URL safe alphabet. This behavior matches what is recommended in earlier bas…

CVE-2025-120846.3published 2025-12-03

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

CVE-2025-138366.3published 2025-12-01

When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

CVE-2026-30876.0published 2026-04-27

If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.

CVE-2026-42246.0published 2026-03-16

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

CVE-2026-36446.0published 2026-03-16

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().

CVE-2022-485665.9published 2023-08-22

An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

CVE-2021-233365.9published 2021-02-15

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cau…

CVE-2024-92875.3published 2024-10-22

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands wh…

CVE-2023-402175.3published 2023-08-25

An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket in…

CVE-2023-270435.3published 2023-04-19

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific dom…

CVE-2026-08644.1published 2026-06-23

When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value.

CVE-2026-60192.1published 2026-04-22

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

CVE-2025-138372.1published 2025-12-01

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

CVE-2026-43602.0published 2026-06-30

In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.

CVE-2025-134622.0published 2026-03-12

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

CVE-2025-60751.8published 2025-10-31

If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (10)

VuXML entries whose affected range this version has left.

Commits (342)

Martin Wilke (miwi)
- Fix shebang

Thanks to: amdmi3
d69a0b0f5d
Wen Heping (wen)
- Fix the pkg-plist when build with WITHOUT_NIS=yes
ab10a180af
Wen Heping (wen)
- Update to 2.7.13

PR:		215375
Submitted by:	wen@
Exp-run by:	antoine@
003329ce22
Mathieu Arnold (mat)
Mark some ports as not openssl-devel ready.

Sponsored by:	Absolight
703ff6d361
Tijl Coosemans (tijl)
Remove no-op patch.

This patch was submitted to upstream libffi and from there to upstream
libtool, but it doesn't do anything.  The original patch committed in
r158131 did do something but when it was no longer needed it was changed
into something that doesn't make sense in r221521 instead of being removed.
Remove it now before it causes more confusion.
0d2a64d2f9
Mathieu Arnold (mat)
Use USES=pathfix where applicable.

PR:		213195
Submitted by:	mat
Exp-run by:	antoine
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D8093
a0bcd2cf68
Wen Heping (wen)
- Update to version 2.7.12 - Remove patch that is included upstream - Switch USE_OPENSSL to USES= ssl [1] - Update documentation for python27 - Don't set CPE_VERSION, default is PORTVERSION [1]

PR:		210685
Submitted by:	wen@(myself), brnrd@ [1]
Exp-run by:	antoine
Differential Revision:	https://reviews.freebsd.org/D6994
427fad8f42
Ruslan Makhmatkhanov (rm)
lang/python[xx]: backport upstream fix for CVE-2016-5636

Add patch for integer overflow in zipimport module to all our python ports.

While I'm here, get rid of -f flag in ${RM} invocation, because ${RM} already
expands to rm -f, so in result we are getting something like:

/bin/rm -f -f /wrkdirs/usr/ports/lang/python35/work/stage/usr/local/lib/libpython3.so

PR:		210325
Submitted by:	 Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Security:	1d0f6852-33d8-11e6-a671-60a44ce6887b
With hat:	python
5643ed620a
Dmitry Marakasov (amdmi3)
Remove NLS, DOCS, EXAMPLES and IPV6 from OPTIONS_DEFAULT, they are enabled by default anyway and don't need to be listed

Approved by:	portmgr blanket
c86e9d9724
Dimitry Andric (dim)
For the various lang/python* ports, improve the __FreeBSD_version check in pyport.h for working around a very old ctype issue.

If the workaround for this issue is enabled, pyport.h redefines
toupper() and some other ctype macros, and this wreaks havoc when
including newer libc++ headers (or any other system header which tries
to declare those functions).

Approved by:	portmgr (antoine)
PR:		208486
MFH:		2016Q2
3ab35818fc
Mathieu Arnold (mat)
Remove ${PORTSDIR}/ from dependencies, categories h, i, j, k, and l.

With hat:	portmgr
Sponsored by:	Absolight
a9dcad2fff
Kubilay Kocak (koobs)
lang/python{27,3*}: Backport patch in upstream issue20397

In certain situations, file references (.py[co]) for Python files that
fail to compile with compileall() are still added to distutils --record
output.

This output is used for pkg-plist generation and must only contain
references to files that will be installed.

One example of a failure condition is when a Python 2/3 compatible
package containing a file containing Python 3.x only code is built with
Python 2.x, such as Gunicorn's _gaiohttp.py [1]

This change backports patches submitted against upstream issue 20397 [2]
that has not yet been committed.

 - For Python 2.7 and 3.5, backport both install_lib and test
 - For Python 3.2, 3.3 and 3.4, only backport install_lib

[1] https://svnweb.freebsd.org/changeset/ports/404558
[2] https://bugs.python.org/issue20397

Thank you to Brendan Molloy for producing and submitting the patches
against upstream sources.

Reviewed by:		sbz (python)
MFH:			2016Q1
Differential Revision:	D4832
474ff0ec6a
John Marino (marino)
lang/python27(3*), Mk/Uses/python.mk: remove make spawn

There are some inefficiencies in python.mk that significantly slow down
full tree scanning.  The use of bmake to obtain the current version of
a specific python is responsible for the majority of the slow done.

This commit splits out the PYTHON_PORTVERSION definition (which is the
same as the lang/python* PORTVERSION) into separate files.  With this
change, python.mk can simple include the makefile fragment instead of
spawning a new instance of make.

Different Revision:	https://reviews.freebsd.org/D4660
Approved by:		antoine (python), mva (python)
6256117d69
Martin Wilke (miwi) · 2.7.11
- Switch regression-test to TEST_TARGED

Discussed in:   D4695
Reviewed by:	koobs
b05bb8a6fb
Conrad Meyer (cem) · 2.7.11
lang/python: Update to 2.7.11

Announcement: https://www.python.org/downloads/release/python-2711/
Mailing list: https://mail.python.org/pipermail/python-announce-list/2015-December/010999.html
Changelog:    https://hg.python.org/cpython/raw-file/v2.7.11/Misc/NEWS

Important changes for this release:
 - Python 2.7.11 is a bug fix release of the Python 2.7.x series.

Reviewed by:	koobs
Sponsored by:	EMC / Isilon Storage Division
Differential Revision:	https://reviews.freebsd.org/D4413
6905cd6f14
Kubilay Kocak (koobs) · 2.7.10_1
lang/python{27,32,33}: Fix missing shlib path in python-config

In Python 3.4+, upstream added and switched to using a shell
implementation of the python-config script [1]. The Python
implementation  (python-config.py) remained used by all versions < 3.4.

While the shell implementation returns the path to the Python
shared library when using the --ldflags script argument, the Python
implementation of the script does not. The bug has been reported, but
has not yet been merged [2].

The Python ports currently default to including ${LOCALBASE}/lib
in LIBS when the NLS option is enabled (which it is by default).

When built *with* NLS (gettext) support, the flags added to LIBS
are returned in `pythonX.Y-config --ldflags` output, which happens
to match the path to the Python shared library.

If the NLS option is disabled, ${LOCALBASE}/lib is not added to LIBS,
and are therefore not returned in --ldflags output.

This results in potential linking errors for software that uses
python-config to obtain the correct library path, when the NLS option is
disabled:

$ make WITH=PYTHON -C audio/alsa-lib
[...]
--- smixer-python.la ---
CCLD     smixer-python.la
/usr/bin/ld: cannot find -lpython2.7

This change modifies the python-config.in script to match the shell
implementation, outputting the library path in --ldflags output.

While I'm here:

for Python 3.2 and Python 3.3 ports, backport a library order
change [3]. This could affect linking with static libraries.

Use standard length lines and reduce diffs in pkg-message

[1] https://bugs.python.org/issue16235
[2] https://bugs.python.org/issue7352
[2] https://bugs.python.org/issue18096

PR:		197757
Submitted by:	jbeich
MFH:		2015Q4
479c987464
Kubilay Kocak (koobs) · 2.7.10
lang/python{27,32,33,34}: Mark MAKE_JOBS_UNSAFE

Parser/pgen code intermittently and non-deterministically fails
at build time causing errors including, among others:

 * Parser/pgen.o: file not recognized: File truncated
 * pgenmain.c:(.text+0x244): undefined reference to `_Py_pgen'

This is apparently due to incorrect uses of recursive make [1] which
was fixed in the upstream Python 'default' (3.5) branch [2].

This change marks all Python port versions as MAKE_JOBS_UNSANFE until
the the original changeset [1] and the resulting regression in
cross-builds [3], whos fix is still pending, can be backported.

[1] https://bugs.python.org/issue22359
[2] https://hg.python.org/cpython/rev/c2a53aa27cad
[3] https://bugs.python.org/issue22625

PR:		200622
Reported by:	marino
MFH:		2015Q3
63e4144b8e
Bernard Spil (brnrd) · 2.7.10
lang/python: Update to 2.7.10

The FreeBSD Python team welcomes Python 2.7.10 to the Ports tree!

Announcement:	https://www.python.org/downloads/release/python-2710/
Changelog:	https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS

Important changes for this release:
 - Python 2.7.10 is a bug fix release of the Python 2.7.x series.
 - Fixes issues with LibreSSL 2.2+

PR: 		192511, 201088
Differentialr Revision:	D2637
Reviewed by:	koobs (mentor), vsevolod (mentor), antoine
Approved by:	koobs (mentor)
9390be9165
Sean Bruno (sbruno) · 2.7.9_1
Add AARCH64 to the list of 64bit targets that require PLIST handling

PR:	201182
Differential Revision:	https://reviews.freebsd.org/D2948
Reviewed by:	koobs lwhsu emaste
5c1d3cc752
Mathieu Arnold (mat) · 2.7.9_1
MASTER_SITES cleanup.

- Replace ${MASTER_SITE_FOO} with FOO.
- Merge MASTER_SITE_SUBDIR into MASTER_SITES when possible. (This means 99.9%
  of the time.)
- Remove occurrences of MASTER_SITE_LOCAL when no subdirectory was present and
  no hint of what it should be was present.
- Fix some logic.
- And generally, make things more simple and easy to understand.

While there, add magic values to the FESTIVAL, GENTOO, GIMP, GNUPG, QT and
SAMBA macros.

Also, replace some EXTRACT_SUFX occurences with USES=tar:*.

Checked by:	make fetch-urlall-list
With hat:	portmgr
Sponsored by:	Absolight
60d1a83c2a
Bryan Drewery (bdrewery) · 2.7.9_1
Force a rebuild/upgrade to chase head r280306 which removed SSLv2 support. This fixes head package users so they have working SSL support. There was already a built-time fix for this.
412afd34ba
John Marino (marino) · 2.7.9
lang category: Remove $PTHREAD_LIBS

Note: ecl did not pass check-plist (pre-existing), PR 198897 submitted.

approved by:	PTHREAD blanket
d945d5ea98
Kubilay Kocak (koobs) · 2.7.9
lang/python27: Fix packaging for mips64

- Fix packaging for mips64 (Reported by: sbruno)

mips64 is also not a 32-bit ${ARCH}, so add it to the list of
architectures for which imageop.so and dl.so aren't packaged:

  %%32BIT_ONLY%%lib/python2.7/lib-dynload/dl.so
  %%32BIT_ONLY%%lib/python2.7/lib-dynload/imageop.so

Both dl and imageop have been removed in Python 3.x [1][2][3][4]

Thanks jhibbits@ for his help testing.

- Add BROKEN for i386 without LIBFFI option, and add upstream
  issue references.

While I'm here, clean up after the LIBFFI option addition:

- Sort options variables: OPTIONS_* and *_DESC
- Use OPTIONS helpers

References:

[1] The :mod:`imageop` module has been removed in Python 3.0.
[2] dl Added: https://hg.python.org/cpython/file/aac1ee966f56/setup.py
[3] dl Removed: https://hg.python.org/cpython/file/859ff5c7c60a/setup.py
[4] PEP-3108: https://www.python.org/dev/peps/pep-3108/

Approved by:	python
262bb77a67
Marcus von Appen (mva) · 2.7.9
- Revert the previous NIS check, since it does not help at all

PR:		196195
Submitted by:	ache@
With hat:	python@
21c90c5467
Marcus von Appen (mva) · 2.7.9
lang/python27: Update to 2.7.9

The FreeBSD Python team welcomes Python 2.7.9 to the Ports tree!

Announcement: https://www.python.org/downloads/release/python-279/
Changelog:    http://hg.python.org/cpython/raw-file/v2.7.9/Misc/NEWS

Important changes for this release:
- The entirety of Python 3.4's ssl module has been backported for Python
  2.7.9. See PEP 466 for justification.
- HTTPS certificate validation using the system's certificate store is
  now enabled by default. See PEP 476 for details.
- SSLv3 has been disabled by default in httplib and its reverse
  dependencies due to the POODLE attack.
- The ensurepip module module has been backported, which provides the
  pip package manager in every Python 2.7 installation. See PEP 477.

- While updating, try to improve the NIS detection for FreeBSD

PR:		193650
Differential Revision:	https://reviews.freebsd.org/D1323
Reviewed by:	koobs
With hat:	python
130b611758
Dmitry Sivachenko (demon) · 2.7.8_6
Add an option to use libffi from ports instead of bundled version.

Submitted by:	cy
Reviewed by:	koobs
aa02163c14
Baptiste Daroussin (bapt) · 2.7.8_5
Cleanup plist
77cba41a62
Antoine Brodin (antoine) · 2.7.8_5
Do not define __BSD_VISIBLE/_XOPEN_SOURCE/_POSIX_C_SOURCE in include/python2.7/pyconfig.h This fixes x11-toolkits/py-wxPython30 build on head

PR:		192365
Exp-run:	self
Reviewed by:	jilles
With hat:	portmgr
530b17b7f1
Antoine Brodin (antoine) · 2.7.8_4
Change INSTALL_DATA to install with mode 644 Remove patches and hacks that were used to work around the previous situation This allows to stage more ports as a regular user

Differential Revision:	https://reviews.freebsd.org/D703
Reviewed by and discussed with:	bapt
With hat:	portmgr
228ab58873
Kubilay Kocak (koobs) · 2.7.8_4
lang/python{27,33,34}: Bump PORTREVISION, sanitizes builds.

Bump PORTREVISION, as prior to the previous change that fixed upstream Issue
#21166, Python builds could be potentially polluted by the host environment
which could caused runtime issues because of ABI differences.
0d6e53966b
Kubilay Kocak (koobs) · 2.7.8_3
lang/python{27,33,34}: Backport fix for upstream Issue #21166

Backport fix for upstream Issue #21166:

Prevent possible segfaults and other random failures of python
--generate-posix-vars in pybuilddir.txt build target by ensuring
that pybuilddir.txt is always regenerated when configure is run and
that the newly built skeleton python does not inadvertently import
modules from previously installed instances. [1]

This changeset has been committed for release in 2.7.9, 3.4.2, and 3.5.0.

A HUGE thank you to Ned Deily from the Python Core Development Team
for helping to identify the underlying cause, produce a fix and
wonderfully document the explanation.

[1] http://bugs.python.org/issue21166
3e8425cb1e
Marcus von Appen (mva) · 2.7.8_3
- Add USE_OPENSSL, since all lang/python ports build the _ssl module, which   requires a working OpenSSL implementation

Phabric:		D569
Reviewed by:	wg@
With hat:	python@
600af559c2
Antoine Brodin (antoine) · 2.7.8_2
Add back ac_cv_opt_olimit_ok=no, this is misdected with clang and causes failures for ports using python's BASEFLAGS (devel/py-mx-experimental for instance)

See also:	r335669
With hat:	portmgr
c9eb3747b1
Marcus von Appen (mva) · 2.7.8_1
- Remove everything related to USE_PYTHON and bsd.python.mk. This is a   preparatory step to convert bsd.python.mk into a USES file. - Remove the shared/static build separation, which is the source of many   problems and even more hacks. Instead build only the shared version, which   greatly simplifies the build. - Remove the FPECTL option to align the build with the clean "template" from   lang/p

Phabric:		D488
Exp-run:	192242, 192244
Reviewed by:	koobs
With hat:	python@
fc8d424c6b
Kubilay Kocak (koobs) · 2.7.8
lang/python27: Update to 2.7.8

The FreeBSD Python team welcomes Python 2.7.8 to the Ports tree!

Announcement: https://www.python.org/download/releases/2.7.8/
Changelog:    http://hg.python.org/cpython/raw-file/v2.7.8/Misc/NEWS

- Update to 2.7.8, update pkg-plist
- OPTIONS: Reorder and sort alphabetically
- OPTIONS: Make POSIX SEM(aphores) a DEFAULT (Hi binary package users!)
- OPTIONS: Add better descriptions for UCS2 and UCS4
- OPTIONS: Use options helpers
- Remove patch-CVE-2014-1912: upstream, was backported
- Remove patch-issue20374: upstream, was backported
- Rename patch-Doc__library__fcntl.rst: underscore convention
- Rename patch-Modules__fcntlmodule.c: underscore convention
- Patch: setup.py: Remove ncurses overrides and return to upstream code
- Patch: setup.py: Add partial backport for ossaudio OS checks
- pkg-message: Remove warning for POSIX Semaphores. They are now in
  GENERIC for FreeBSD 8.x 9.x, 10.x and tested well upstream
- pkg-message: No longer needs substitutions, remove .in suffix and
  SUB_FILES
- Rework and simplify the platformX mechanism, update pkg-plist
  accordingly
- Add regression-test target
- Deprecate NOPORTDATA, remove pkg-plist entries with %%PORTDATA%%
- Replace bsd.{pre,post}.mk with bsd.port.options.mk

Based on original patch submitted by wen@ and worked on by lwhsu@,
thank you!

PR:             191405
PR:             178301
PR:             171246
Phabric:        D364
Reviewed by:    antoine, bapt, mat, mva, wg
26ae40b6bc
Sofian Brabez (sbz) · 2.7.6_4
- Add CPE entries for python - Remove NOPORTDATA as it's deprecated since r359061
b5d9bfb7a4
Tijl Coosemans (tijl) · 2.7.6_4
Support LIBS like LDFLAGS.

- Add LIBS="${LIBS}" to MAKE_ENV and CONFIGURE_ENV.
- Add an option helper for LIBS.
- Adjust all ports that already use LIBS.  Also remove references to
  PTHREAD_CFLAGS and PTHREAD_LIBS while here.
- Some ports did not support having a LIBS environment variable and
  required additional patches.

Somewhat simplified a linker command line looks like:

${CC} ${src_LDFLAGS} ${LDFLAGS} ${src_LIBS} ${LIBS}

where src_LDFLAGS and src_LIBS are controlled by upstream and LDFLAGS and
LIBS can be controlled by us.  If possible -L and -l flags need to be
added to LIBS to make sure they appear after any -L and -l flags set by
upstream.  Many ports currently add -L${LOCALBASE}/lib to LDFLAGS but this
may appear too early on the command line causing installed libraries to
be linked in instead of freshly built ones.

Additional changes:
benchmarks/netio: Replace WITH_IPV6 with an IPV6 option.
comms/gnokii: Replace some patches with USES=pathfix.  Also remove -fPIC.
graphics/gimageview: USES=libtool and install desktop file in DESKTOPDIR.
graphics/visionworkbench: Remove FreeBSD 7 support.
multimedia/libmovtar: New LIB_DEPENDS syntax.
multimedia/opencinematools: Use standard do-build.
net/siproxd: USES=libtool:keepla (port actually needs .la files for plugins)
net-mgmt/nagios: Remove -fPIC.
net-mgmt/nagios4: Remove -fPIC.
print/cups-base: Only add -lssp_nonshared on i386 and OSVERSION < 1000036.
security/p11-kit: Replace PTHREAD_LIBS in CONFIGURE_ENV with
ac_cv_func_pthread_mutexattr_init=no in CONFIGURE_ARGS.  This skips a test
in configure that falsely detects pthread_mutexattr_init in our libc.
sysutils/dar: Fix iconv detection.
x11/rxvt-unicode: Remove -lstdc++ and patch configure to remove a FreeBSD
hack and use $CXX as linker as on other platforms.

PR:		190592
Exp-run by:	antoine
Approved by:	portmgr (antoine)
9f8b4bcde3
Kubilay Kocak (koobs) · 2.7.6_4
lang/python{27,31,32}: Replace USE_XZ with USES=tar:xz

USE_XZ has been deprecated, replace it with the new USES value.

Python 3.3 and 3.4 ports have already been converted.
5d7a9aceb6
Kubilay Kocak (koobs) · 2.7.6_4
lang/python{31,32,33}: Fix stage/package as non-root

Copy the second part of a change previously made to python27 [1], to
python31, python32 and python33.

This fixes staging and packaging of these ports by a non-root user by
running ranlib on the archive prior to it being installed read-only.

While I'm here:

- python27: Add breadcrumbs and references to the patch header
- python34: Update breadcrumbs and references to the patch header

[1] https://svnweb.freebsd.org/ports?view=revision&revision=350207

Submitted by:	antoine
Reviewed by:	kwm, sbz
aab3da8d2a
Kubilay Kocak (koobs) · 2.7.6_4
lang/python{31,32,33}: Add clang 3.4 fix from python27

Copy change committed to python27 [1] to python31, python32 and
python33 to fix builds of some extensions with Clang 3.4.

Also add breadcrumbs to the patch header in lang/python27 referencing
the upstream issue. [2]

The Python 3.4 port (lang/python34) already carries the patch.

[1] https://svnweb.freebsd.org/ports?view=revision&revision=346428
[2] http://bugs.python.org/issue20767
21c7eb2952
Sunpoet Po-Chuan Hsieh (sunpoet) · 2.7.6_4
- Pet portlint: use PYTHON_DISTNAME instead of PYTHON_DISTFILE
c5569783bd
Antoine Brodin (antoine) · 2.7.6_4
Allow staging/packaging as a regular user: - pycompile only once, previously it would pycompile 3 imported modules   (getopt, struct and py_compile) and make them read-only, and later try   to pycompile them again and fail - ranlib before installing archive read-only

With hat:	portmgr
7acf693fdf
Antoine Brodin (antoine) · 2.7.6_4
- Fix build with readline 6.3 from ports   the patch was obtained from upstream (issue #20374) - Add missing USES=readline

PR:		ports/187174
Reported by:	O. Hartmann
Reviewed by:	koobs
Obtained from:	python
8376e27862
Kubilay Kocak (koobs) · 2.7.6_4
lang/python*: Backport security fix for CVE-2014-1912

A vulnerability was reported [1] in Python's socket module, due to a
boundary error within the sock_recvfrom_into() function, which could be
exploited to cause a buffer overflow.

This could be used to crash a Python application that uses the
socket.recvfrom_info() function or, possibly, execute arbitrary code
with the permissions of the user running vulnerable Python code.

This vulnerable function, socket.recvfrom_into(), was introduced in
Python 2.5. Earlier versions are not affected by this flaw.  This is
fixed in upstream branches for version 2.7, 3.1, 3.2 and 3.3.

[1] http://bugs.python.org/issue20246

MFH:		2014Q1
Security:	8e5e6d42-a0fa-11e3-b09a-080027f2d077
7a2c2ce6e7
Sean Bruno (sbruno) · 2.7.6_3
Unbreak python module builds across the tree as a result of clang 3.4 import now disallowing the use of -R.

Submitted by:	antoine
Reviewed by:	gjb
6de6c75db3
Marcus von Appen (mva) · 2.7.6_2
- Fix bad libpython* symlinks after enabling the lang/python* ports to   be stagedir-aware

PR:		ports/186284
Submitted by:	marino@
Pointyhat to:	myself
a23998721f
Alexey Dokuchaev (danfe) · 2.7.6_1
Remove references to long unsupported alpha.
542dbc8cc7
Marcus von Appen (mva) · 2.7.6_1
- Enable stagedir support - Convert to new LIB_DEPENDS
6e3723845d
Kubilay Kocak (koobs) · 2.7.6_1
Bump PORTREVISION for all Python ports to pickup the recent ARM patch

PR:		ports/149167
7db9db9528
Kubilay Kocak (koobs) · 2.7.6
Reduce diffs, sort sections & Add LICENSE for Python 2.6, 2.7 & 3.3

- Sort USE_*, *_WRKSRC and CONFIGURE/MAKE sections
- Whitespace alignment for readability
- Add LICENSE (PSFL)

Reviewed by:	milki
9b3e3f814b