python27: mark as vulnerable/insecure #201859
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
SamLukeYes
added
the
1.severity: security
fabianhjr
commented
Nov 19, 2022
fabianhjr
force-pushed
the
mark-python2-unsecure
branch
from
ad974d0 to
40dc105
Compare
13 tasks
|
Now that the branchoff has happened this is ready. |
fabianhjr
force-pushed
the
mark-python2-unsecure
branch
from
e7447d4 to
9b1c19e
Compare
fabianhjr
changed the title
|
I don't think we can merge this as-is. It would drop hundreds of x86_64-linux packages. List of attributes, from executing afl altair amarok-kf5 amarok ams-lv2 ankisyncd anki antlr2 apache-directory-server apacheHttpdPackages_2_4.mod_python apacheHttpdPackages_2_4.mod_wsgi2 apacheHttpdPackages_2_4.mod_wsgi apacheHttpdPackages.mod_python apacheHttpdPackages.mod_wsgi2 apacheHttpdPackages.mod_wsgi apfelgrid appimage-run-tests appimage-run applgrid arch-install-scripts aspcud ballerina bash-preexec bashup-events32 bashup-events44 bats bazel_3 bazel_4 bazel_5 bazel_6 bazel-watcher bazel beekeeper-studio betterdiscord-installer bisq-desktop blackmagic blitz bloomrpc boogie btanks buttercup-desktop calamares-nixos calamares caprine-bin cassandra_3_0 cassandra_3_11 cassandra chirp chrysalis cider clipgrab collectd conky coq_8_5 coq_8_6 coq_8_7 coq_8_8 coq_8_9 cozy-drive cppcheck cppcms crypto-org-wallet csound-qt CuboCore.corepdf cutemarked-ng cutter cvs2svn cytoscape dafny deliantra-arch deliantra-maps deliantra-server devdocs-desktop dgoss dia dictdDBs.wiktionary dictdDBs.wordnet digikam dotnetPackages.Boogie_2_4_1 dotnetPackages.Boogie dotnetPackages.Dafny echidna eclair eclipse-mat eclipses.eclipse-committers eclipses.eclipse-cpp eclipses.eclipse-java eclipses.eclipse-jee eclipses.eclipse-modeling eclipses.eclipse-platform eclipses.eclipse-rcp eclipses.eclipse-sdk ecopcr edgetx electron-mail electronplayer empathy envoy erlang_javac erlang_odbc_javac fastddsgen fcitx5-chinese-addons fcitx-engines.libpinyin fcitx-engines.mozc fehlstart fiji firefly-desktop flatpak-builder fluxus fmsynth foundationdb51 foundationdb52 foundationdb60 foxdot framesh freecad freeorion freeplane frescobaldi fspy fstar gcc-arm-embedded-10 gcc-arm-embedded-6 gcc-arm-embedded-7 gcc-arm-embedded-8 gcc-arm-embedded-9 gcc-arm-embedded ghostwriter git-doc git-ftp gitFull gitqlient gitstats gitSVN globalprotect-openconnect globulation2 gnome2.gnome_python_desktop gnome2.gnome_python gnome2.gtksourceview gnome2.python_rsvg gnome.empathy gnome.polari gnubg golden-cheetah gpsbabel-gui gradle_5 gradle_6 gremlin-console gremlin-server gringo grml-zsh-config hal-hardware-analyzer haskellPackages.crackNum haskellPackages.hevm haskellPackages.hz3 haskellPackages.linearEqSolver haskellPackages.ntha haskellPackages.sbv haskellPackages.z3 heptagon hexio huggle hydrus ibus-engines.kkc igv irccloud isabelle-components.isabelle-linter isabelle ix jackmix_jack1 jackmix janusgraph javaPackages.openjfx11 jd-gui jdk11 jellyfin-media-player jellyfin-mpv-shim joplin-desktop kbibtex kchmviewer kdeltachat keeweb keybinder keystore-explorer kiwix klee klick klipper-firmware klipper-flash klipper-genconf kmymoney kotlin-language-server lbry ldtk ledger-live-desktop lens libbap libixp libkkc-data libkkc libsForQt512.qt5.qtwebengine libsForQt512.qt5.qtwebview libsForQt512.qtwebengine libsForQt512.qtwebview libsForQt514.qt5.qtwebengine libsForQt514.qt5.qtwebview libsForQt514.qtwebengine libsForQt514.qtwebview libsForQt515.akonadi-calendar-tools libsForQt515.akonadi-calendar libsForQt515.akonadiconsole libsForQt515.akonadi-contacts libsForQt515.akonadi-import-wizard libsForQt515.akregator libsForQt515.alkimia libsForQt515.angelfish libsForQt515.aura-browser libsForQt515.bismuth libsForQt515.calendarsupport libsForQt515.discover libsForQt515.eventviews libsForQt515.falkon libsForQt515.incidenceeditor libsForQt515.kaccounts-providers libsForQt515.kaddressbook libsForQt515.kalarm libsForQt515.kalendar libsForQt515.kde-cli-tools libsForQt515.kdepim-addons libsForQt515.kdepim-runtime libsForQt515.kdeplasma-addons libsForQt515.kdevelop-unwrapped libsForQt515.kdevelop libsForQt515.kdev-php libsForQt515.kdev-python libsForQt515.kgpg libsForQt515.khotkeys libsForQt515.kinfocenter libsForQt515.kio-gdrive libsForQt515.kmail-account-wizard libsForQt515.kmailtransport libsForQt515.kmail libsForQt515.kmenuedit libsForQt515.knotes libsForQt515.konqueror libsForQt515.kontact libsForQt515.korganizer libsForQt515.krohnkite libsForQt515.ksystemstats libsForQt515.kwin-dynamic-workspaces libsForQt515.kwin-tiling libsForQt515.kzones libsForQt515.libgravatar libsForQt515.libkdepim libsForQt515.libkgapi libsForQt515.libksieve libsForQt515.libksysguard libsForQt515.mailcommon libsForQt515.mailimporter libsForQt515.marble libsForQt515.mbox-importer libsForQt515.messagelib libsForQt515.parachute libsForQt515.pimcommon libsForQt515.pim-data-exporter libsForQt515.pim-sieve-editor libsForQt515.plasma-bigscreen libsForQt515.plasma-browser-integration libsForQt515.plasma-desktop libsForQt515.plasma-disks libsForQt515.plasma-mobile libsForQt515.plasma-remotecontrollers libsForQt515.plasma-systemmonitor libsForQt515.plasma-vault libsForQt515.plasma-workspace libsForQt515.powerdevil libsForQt515.qt5.qtwebengine libsForQt515.qt5.qtwebview libsForQt515.qtwebengine libsForQt515.qtwebview libsForQt515.systemsettings libsForQt515.zanshin libsForQt5.akonadi-calendar-tools libsForQt5.akonadi-calendar libsForQt5.akonadiconsole libsForQt5.akonadi-contacts libsForQt5.akonadi-import-wizard libsForQt5.akregator libsForQt5.alkimia libsForQt5.angelfish libsForQt5.aura-browser libsForQt5.bismuth libsForQt5.calendarsupport libsForQt5.discover libsForQt5.eventviews libsForQt5.falkon libsForQt5.incidenceeditor libsForQt5.kaccounts-providers libsForQt5.kaddressbook libsForQt5.kalarm libsForQt5.kalendar libsForQt5.kde-cli-tools libsForQt5.kdepim-addons libsForQt5.kdepim-runtime libsForQt5.kdeplasma-addons libsForQt5.kdevelop-unwrapped libsForQt5.kdevelop libsForQt5.kdev-php libsForQt5.kdev-python libsForQt5.kgpg libsForQt5.khotkeys libsForQt5.kinfocenter libsForQt5.kio-gdrive libsForQt5.kmail-account-wizard libsForQt5.kmailtransport libsForQt5.kmail libsForQt5.kmenuedit libsForQt5.knotes libsForQt5.konqueror libsForQt5.kontact libsForQt5.korganizer libsForQt5.krohnkite libsForQt5.ksystemstats libsForQt5.kwin-dynamic-workspaces libsForQt5.kwin-tiling libsForQt5.kzones libsForQt5.libgravatar libsForQt5.libkdepim libsForQt5.libkgapi libsForQt5.libksieve libsForQt5.libksysguard libsForQt5.mailcommon libsForQt5.mailimporter libsForQt5.marble libsForQt5.mbox-importer libsForQt5.messagelib libsForQt5.parachute libsForQt5.pimcommon libsForQt5.pim-data-exporter libsForQt5.pim-sieve-editor libsForQt5.plasma-bigscreen libsForQt5.plasma-browser-integration libsForQt5.plasma-desktop libsForQt5.plasma-disks libsForQt5.plasma-mobile libsForQt5.plasma-remotecontrollers libsForQt5.plasma-systemmonitor libsForQt5.plasma-vault libsForQt5.plasma-workspace libsForQt5.powerdevil libsForQt5.qt5.qtwebengine libsForQt5.qt5.qtwebview libsForQt5.qtwebengine libsForQt5.qtwebview libsForQt5.systemsettings libsForQt5.zanshin libtensorflow libtorrent-rasterbar-1_2_x libxml2Python lightly-qt linuxKernel.packages.linux_4_14_hardened.hyperv-daemons linuxKernel.packages.linux_4_14.hyperv-daemons linuxPackages_4_14_hardened.hyperv-daemons liquidsoap losslesscut-bin luminanceHDR lvtk lxde.lxpanel lxpanel ma1sd manta marktext mellowplayer merkaartor mindforger mnemosyne mobilecoin-wallet mod_python mod_wsgi mongodb-3_4 mongodb monotoneViz mons msmtp mucommander musescore mycrypto napari nco neard neo4j neovide neuron-full nextcloud-client nixos-install-tools nmapsi4 notepadqq nova-filters nsis nuclear nzbhydra2 octant-desktop onionshare-gui opam_1_2 openjdk11 openjfx11 openshot-qt opentsdb opentx p3x-onenote packcc PageEdit palemoon pam_usb passky-desktop patray pdf2odt pdfsam-basic pentobi perl534Packages.SVNSimple perl536Packages.SVNSimple petrinizer plasma5Packages.akonadi-calendar-tools plasma5Packages.akonadi-calendar plasma5Packages.akonadiconsole plasma5Packages.akonadi-contacts plasma5Packages.akonadi-import-wizard plasma5Packages.akregator plasma5Packages.alkimia plasma5Packages.angelfish plasma5Packages.aura-browser plasma5Packages.bismuth plasma5Packages.calendarsupport plasma5Packages.discover plasma5Packages.eventviews plasma5Packages.falkon plasma5Packages.incidenceeditor plasma5Packages.kaccounts-providers plasma5Packages.kaddressbook plasma5Packages.kalarm plasma5Packages.kalendar plasma5Packages.kde-cli-tools plasma5Packages.kdepim-addons plasma5Packages.kdepim-runtime plasma5Packages.kdeplasma-addons plasma5Packages.kdevelop-unwrapped plasma5Packages.kdevelop plasma5Packages.kdev-php plasma5Packages.kdev-python plasma5Packages.kgpg plasma5Packages.khotkeys plasma5Packages.kinfocenter plasma5Packages.kio-gdrive plasma5Packages.kmail-account-wizard plasma5Packages.kmailtransport plasma5Packages.kmail plasma5Packages.kmenuedit plasma5Packages.knotes plasma5Packages.konqueror plasma5Packages.kontact plasma5Packages.korganizer plasma5Packages.krohnkite plasma5Packages.ksystemstats plasma5Packages.kwin-dynamic-workspaces plasma5Packages.kwin-tiling plasma5Packages.kzones plasma5Packages.libgravatar plasma5Packages.libkdepim plasma5Packages.libkgapi plasma5Packages.libksieve plasma5Packages.libksysguard plasma5Packages.mailcommon plasma5Packages.mailimporter plasma5Packages.marble plasma5Packages.mbox-importer plasma5Packages.messagelib plasma5Packages.parachute plasma5Packages.pimcommon plasma5Packages.pim-data-exporter plasma5Packages.pim-sieve-editor plasma5Packages.plasma-bigscreen plasma5Packages.plasma-browser-integration plasma5Packages.plasma-desktop plasma5Packages.plasma-disks plasma5Packages.plasma-mobile plasma5Packages.plasma-remotecontrollers plasma5Packages.plasma-systemmonitor plasma5Packages.plasma-vault plasma5Packages.plasma-workspace plasma5Packages.powerdevil plasma5Packages.qt5.qtwebengine plasma5Packages.qt5.qtwebview plasma5Packages.qtwebengine plasma5Packages.qtwebview plasma5Packages.systemsettings plasma5Packages.zanshin platypus plex-media-player polychromatic pomerium pony-corral ponyc portfolio prooftree proxmark3-rrg proxmark3-unstable proxmark3 proxysql psi purple-plugin-pack purple-signald py3c pyditz pypy27 pypy2 pypy37 pypy38 pypy39 pypy3 pypy python27Full python27 python2Full python2 python310Packages.adb-enhanced python310Packages.aeppl python310Packages.aesara python310Packages.arviz python310Packages.augmax python310Packages.bap python310Packages.baselines python310Packages.catboost python310Packages.chex python310Packages.dalle-mini python310Packages.distrax python310Packages.dm-haiku python310Packages.dm-sonnet python310Packages.edward python310Packages.elegy python310Packages.flax python310Packages.foundationdb51 python310Packages.foundationdb52 python310Packages.foundationdb60 python310Packages.foxdot python310Packages.gpt-2-simple python310Packages.jaxlib-build python310Packages.jaxlibWithoutCuda python310Packages.jaxlib python310Packages.jax python310Packages.jmp python310Packages.magicgui python310Packages.napari-npe2 python310Packages.napari python310Packages.numpyro python310Packages.objax python310Packages.optax python310Packages.pot python310Packages.pymanopt python310Packages.pymc python310Packages.pyqtwebengine python310Packages.pyside2-tools python310Packages.pyside2 python310Packages.pywebview python310Packages.rlax python310Packages.scikit-tda python310Packages.shap python310Packages.spyder python310Packages.tensorflow-build python310Packages.tensorflow-datasets python310Packages.tensorflow-probability python310Packages.tensorflowWithoutCuda python310Packages.tensorflow python310Packages.tflearn python310Packages.treeo python310Packages.treex python310Packages.trfl python310Packages.umap-learn python39Packages.adb-enhanced python39Packages.aeppl python39Packages.aesara python39Packages.arviz python39Packages.augmax python39Packages.bap python39Packages.baselines python39Packages.catboost python39Packages.chex python39Packages.dalle-mini python39Packages.distrax python39Packages.dm-haiku python39Packages.dm-sonnet python39Packages.edward python39Packages.elegy python39Packages.flax python39Packages.foundationdb51 python39Packages.foundationdb52 python39Packages.foundationdb60 python39Packages.foxdot python39Packages.gpt-2-simple python39Packages.jaxlib-build python39Packages.jaxlibWithoutCuda python39Packages.jaxlib python39Packages.jax python39Packages.jmp python39Packages.magicgui python39Packages.manticore python39Packages.napari-npe2 python39Packages.napari python39Packages.numpyro python39Packages.objax python39Packages.optax python39Packages.pot python39Packages.pymanopt python39Packages.pymc python39Packages.pyqtwebengine python39Packages.pyside2-tools python39Packages.pyside2 python39Packages.pywebview python39Packages.rlax python39Packages.scikit-tda python39Packages.shap python39Packages.spyder python39Packages.tensorflow-build python39Packages.tensorflow-datasets python39Packages.tensorflow-probability python39Packages.tensorflowWithoutCuda python39Packages.tensorflow python39Packages.tflearn python39Packages.treeo python39Packages.treex python39Packages.trfl python39Packages.umap-learn python-qt qmapshack qmk qolibri qsyncthingtray qt512.qtwebengine qt512.qtwebview qt514.qtwebengine qt514.qtwebview qt515.qtwebengine qt515.qtwebview qt5.qtwebengine qt5.qtwebview qutebrowser rabbitmq-java-client radicle-upstream raven-reader reptyr resholve rethinkdb retrofe root5 rssguard rsstail rstudioWrapper rstudio rubyPackages_2_7.libv8 rubyPackages_3_0.libv8 rubyPackages_3_1.libv8 rubyPackages.libv8 satysfi scenebuilder scenic-view sdrangel seafile-client semantik session-desktop shattered-pixel-dungeon shunit2 sigil signald skrooge sl1-to-photon soapui solc sonic-pi sonixd springLobby spring spyder sqlitecpp ssb-patchwork standardnotes station steam-rom-manager storm streamdeck-ui strelka stremio subversionClient supercolliderPlugins.sc3-plugins supercollider_scel supercollider-with-plugins supercollider-with-sc3-plugins supercollider surelog svg2tikz svn2git swiften sx Sylk syncplay syncthingtray system-config-printer tageditor tailor telepathy-gabble telepathy-haze telepathy-idle telepathy-logger tellico tennix tests.nixos-functions.nixos-test tests.writers texmaker thunderbolt tlaps toluapp trustedGrub-for-HP trustedGrub tts tusk tvheadend txt2tags unison usync vampire vdrift-bin verible verifast vial via vimPlugins.ctrlp-cmatcher vimPlugins.vim-wakatime vivisect vnote wacomtablet webmacs weka wmii wootility wxhexeditor xdgmenumaker xe-guest-utilities xtrlock-pam yacas-gui yadm youtube-music ytmdesktop yuzu-early-access yuzu-mainline z3_4_11 z3_4_4_0 z3_4_7 z3_4_8 z3-tptp z3 zeal-qt5 zeal zecwallet-lite zettlr zombietrackergps zsh-git-prompt zulip zz |
|
Like 90% of that is probably leaking through Qt, which we can (and should) fix. |
|
I'd propose the following process. Keep creating individual pull requests that free packages of (transitive) python2 dependency, filed against master or staging as appropriate and not waiting for python2 marking. And keep one meta-issue/PR like this one. At some point we should get good enough to really merge marking |
|
More than 50% of these don't have |
|
It's qtwebkit/qtwebengine, qtbase should be good |
|
Ah, right, I'm sorry for the confusion. But it still works as an upper bound. |
77 tasks
|
qt6.qtwebengine is already being built using python3: it should just be a matter of replacing python2 with python3 in |
If python2 has unpatched CVEs, it should be marked insecure on 22.11 as well. |
|
Update on impact: |
fabianhjr
force-pushed
the
mark-python2-unsecure
branch
from
1ac0b5c to
c9a0dab
Compare
thiagokokada
reviewed
Jan 7, 2023
fabianhjr
force-pushed
the
mark-python2-unsecure
branch
from
c9a0dab to
ce1051f
Compare
ofborg
bot
added
10.rebuild-darwin: 1
10.rebuild-linux: 1-10
and removed
10.rebuild-linux: 11-100
labels
fabianhjr
force-pushed
the
mark-python2-unsecure
branch
from
ce1051f to
d9fbb33
Compare
13 tasks
|
Updated |
test.writers is gone from the impacted list, this could be mergeable now as it is. |
13 tasks
dasJ
added a commit
that referenced
this pull request
Jan 10, 2023
proxysql: fix build after #201859
13 tasks
4 tasks
12 tasks
OPNA2608
added a commit
to OPNA2608/nixpkgs
that referenced
this pull request
May 18, 2023
It has Python 2.x as a build-time dependency, which has been EOL for years and was finally marked as insecure in NixOS#201859. As such, it has been unbuildable on master without enabling insecure packages for almost half a year. Upstream has no plans to migrate their build system away from py2 (though they might accept help with it), so we'll have to drop it: https://forum.palemoon.org/viewtopic.php?f=62&t=28863&p=232152
AndersonTorres
pushed a commit
that referenced
this pull request
May 18, 2023
It has Python 2.x as a build-time dependency, which has been EOL for years and was finally marked as insecure in #201859. As such, it has been unbuildable on master without enabling insecure packages for almost half a year. Upstream has no plans to migrate their build system away from py2 (though they might accept help with it), so we'll have to drop it: https://forum.palemoon.org/viewtopic.php?f=62&t=28863&p=232152
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
Impacted packages:
aflcassandra{,_3_0,_3_11,_4}diadictdDBs.wiktionarydictdDBs.wordnetfcitx-engines.mozcfoundationdb{51,52,60}gnome2.gnome_python_desktopgnome2.gnome_pythongnubghexiolinuxPackages.hyperv-daemonsmantaneardneuron-fullpalemoonpam_usbplatypusrabbitmq-java-clientrethinkdbretrofestormstrelkatrustedGrubxtrlock-pamz3_4_4_0Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)nixos/doc/manual/md-to-db.shto update generated release notes