Python update to 2.7.15

[chickenandpork]

Motivation: This is basically @ymartin59's #3552 but with:

• builds successfully (I wasn't able to repro the problem is with python: 2.7.15 update with dependencies #3552)
• rebased to latest SynoCommunity/spksrc/master
• cross/python/PLIST is parameterized
• updates to libsodium's patches used instead of rewriting
• some text/descriptions slightly different (shouldn't affect build)
• Apachev2 license is ASL2

The changes above are minimal, and reflect the kind of cleanup that @ymartin59 tends to do to mine anyhow :) So, honestly, I haven't really done anything to his work except redo it by hand, which can avoid maybe quotation marks that look like other quotes or something else.

Maybe the rebasing to recent version is what did it.

Linked issues: #3546

Checklist

• Build rule all-supported completed successfully
• Package upgrade completed successfully
• New installation of package completed successfully

Checked upgrade of 2.7.14-19 to 2.7.15-20

Basic in-place test is:

/var/packages/python/target/bin/python   -c 'import _ctypes; import lxml; import sqlite3; print("x");'

[ymartin59]

@chickenandpork Thanks Allan. Looks great. You are correct when you wrote all Python 2 based applications have now to be rebuilt and published... That was in my plans since vulnerability alerts about "requests" in almost all "requirements.txt": https://github.com/SynoCommunity/spksrc/network/alerts

[chickenandpork]

Hmm. Another big build job. It’s like we need to have some sort of a fan-out on validation of builds and acceptance.

…

On Feb 16, 2019, at 09:24, Yves Martin ***@***.***> wrote: @chickenandpork Thanks Allan. Looks great. You are correct when you wrote all Python 2 based applications have now to be rebuilt and published... That was in my plans since vulnerability alerts about "requests" in almost all "requirements.txt": https://github.com/SynoCommunity/spksrc/network/alerts — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[Safihre]

So what is different from the other PR #3552? Looks exactly the same. Strange it builds now.

The only reason all packages need to be rebuild is the requests package vulnerability?

[chickenandpork]

I think the biggest thing was rebasing. I hand-replicates the same changes, skipping what was rebased out. Bumped bcrypt as a side-effect. I parameterized the PLIST after but it should not affect compile.

…

On Feb 17, 2019, at 07:31, Safihre ***@***.***> wrote: So what is different from the other PR #3552? Looks exactly the same. Strange it builds now. The only reason all packages need to be rebuild is the requests package vulnerability? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[Safihre]

@ymartin59 Did you actually read the vulnerability that was fixed in requests?
https://github.com/kennethreitz/requests/issues/4716

This is not something that requires republishing of all packages, as it requires a potential attacker to be able to perform man-in-the-middle attacks on networks.

[Safihre]

Python 2.7.16 will come in the near future.
https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.16rc1.rst

I am not sure if this will affect this PR.. I certainly hope not because users have been waiting for months to get the new SABnzbd and this is all blocked by this update.

[chickenandpork]

I would suggest merging this now and doing 2.7.16 when it’s available. Always waiting for the next release means we never move ahead. This builds, I think the builds are already in my beta space (spk.chickenandporn.com), rather work on 2.7.16 when it drops.

…

On Feb 23, 2019, at 13:42, Safihre ***@***.***> wrote: Python 2.7.16 will come in the near future. https://github.com/python/cpython/blob/2.7/Misc/NEWS.d/2.7.16rc1.rst I am not sure if this will affect this PR.. I certainly hope not because users have been waiting for months to get the new SABnzbd and this is all blocked by this update. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[Safihre]

@chickenandpork this is a bit off topic: what email can I reach you on? I would also like to setup maybe a spk server. You can also reach me at [email protected] :)