Bug 241586 - lang/python35: Update to 3.5.9 (python.org shipped broken 3.5.8, tread carefully)
Summary: lang/python35: Update to 3.5.9 (python.org shipped broken 3.5.8, tread carefu...
Status: In Progress
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Many People
Assignee: Wen Heping
URL:
Keywords: needs-patch, needs-qa, security
Depends on:
Blocks:
 
Reported: 2019-10-30 10:59 UTC by Peter van Dijk
Modified: 2019-11-29 10:38 UTC (History)
2 users (show)

See Also:
koobs: maintainer-feedback? (python)
koobs: merge-quarterly?


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Peter van Dijk 2019-10-30 10:59:54 UTC
https://www.python.org/downloads/release/python-358/ has a .xz and a .tgz. At this moment, the .xz tarball is actually 3.5.8-rc2 rebranded as 3.5.8. This means it is missing the fix for bpo-38243 mentioned at https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-8-final

I have emailed security@python.org, suggesting a reroll as 3.5.9 to remove any confusion.
Comment 1 Kubilay Kocak freebsd_committer freebsd_triage 2019-10-30 11:02:10 UTC
Thank you for the heads-up and report Peter

If you could keep us abreast of updates from security@p.o if they are forthcoming and no public upstream issue is created for this, that would greatly appreciated
Comment 2 Peter van Dijk 2019-10-30 17:42:52 UTC
the .xz link now has the correct MD5 and the correct contents.
Comment 3 Peter van Dijk 2019-10-30 17:44:25 UTC
(I have had no word from upstream.)
Comment 4 Peter van Dijk 2019-10-31 08:10:53 UTC
Thanks for the heads-up.  During the 3.5.8 release process, I actually generated the tarball multiple times, and although I never officially released these previous versions, somehow the CDN latched onto this one .xz file from one of these test versions.  As you note, the MD5 sum and file size on the release page were correct for the final version; also, the v3.5.8 tag in the Git repo and the GPG checksum file also match this final (correct) version.

Still, it's a messy situation.  Fedora has already updated to 3.5.8, and they got the tarball without the fix for bpo-38243.

As you suggest, the best way to ameliorate this debacle is to just release a 3.5.9.  I'll do that in the next day or so.  In the meantime I'll send a quick note to the clp newsgroups.
Comment 5 Peter van Dijk 2019-10-31 08:13:09 UTC
Sorry - previous comment is the response from security@python.org.
Comment 7 Kubilay Kocak freebsd_committer freebsd_triage 2019-11-02 06:37:56 UTC
Author: wen
Date: Sat Nov  2 06:25:16 2019
New Revision: 516287
URL: https://svnweb.freebsd.org/changeset/ports/516287

Log:
  - Update python35 to 3.5.9

Modified:
  head/lang/python-doc-html/distinfo
  head/lang/python35/Makefile.version
  head/lang/python35/distinfo
  head/lang/python35/pkg-plist

Modified: head/lang/python-doc-html/distinfo