[#52] Fix CVE-2023-40217. (#53)

* Updated paver version to use.

* Use Python 3.11.6.

* Removed the GH-107588 patch to fix test_asyncio failure on 3.11.4.

* Updated OpenSSL version for Python's "ssl" module.

* Updated cryptography to 41.0.4.

* Try building Linux ARM64 builds on Laja.

* Revert "Try building Linux ARM64 builds on Laja."

This reverts commit 6f45388.

* Update pythia.conf

Co-authored-by: Adi Roiban <[email protected]>

* Updated other Python modules to latest versions.

* Updated SQLite to latest version.

---------

Co-authored-by: Adi Roiban <[email protected]>

build.conf

@@ -7,7 +7,7 @@ BUILD_DIR="build"
 DIST_DIR="dist"
 
 # Python and lib versions.
-PYTHON_BUILD_VERSION="3.11.4"
+PYTHON_BUILD_VERSION="3.11.6"
 LIBFFI_VERSION="3.4.4"
 ZLIB_VERSION="1.3"
 BZIP2_VERSION="1.0.8"
@@ -21,32 +21,32 @@ XZ_VERSION="5.4.4"
 # A newer patch is available at https://github.com/python/cpython/issues/57710.
 LIBEDIT_VERSION="20170329-3.1"
 # OpenSSL is only used for Python's "ssl" module lately.
-OPENSSL_VERSION="3.1.2"
+OPENSSL_VERSION="3.1.3"
 # Use the version of the "sqlite-autoconf-VERSION.tar.gz" upstream download.
 # To get its SHA3-256 signature: "openssl dgst -sha3-256 sqlite-autoconf-*".
 # When updating this, also update the year in src/sqlite/chevahbs, if needed.
-SQLITE_VERSION="3420000"
+SQLITE_VERSION="3430100"
 
 # If latest get-pip.py stops working on older platforms, use something like:
 # https://web.archive.org/web/20220122185015/https://bootstrap.pypa.io/.
 BOOTSTRAP_GET_PIP="https://bootstrap.pypa.io/get-pip.py"
 
 # These are used by get-pip.py.
 PIP_VERSION="23.2.1"
-SETUPTOOLS_VERSION="68.1.2"
+SETUPTOOLS_VERSION="68.2.2"
 
 # Python modules versions to be used everywhere possible.
 # Latest cryptography/bcrypt require Rust, use only wheels for them.
-CFFI_VERSION="1.15.1"
+CFFI_VERSION="1.16.0"
 # When updating cryptography, also update "expecting_openssl_version" in
 # the file src/chevah-python-tests/test_python_binary_dist.py to pass tests.
-CRYPTOGRAPHY_VERSION="41.0.3"
+CRYPTOGRAPHY_VERSION="41.0.4"
 PYNACL_VERSION="1.5.0"
 BCRYPT_VERSION="4.0.1"
 PSUTIL_VERSION="5.9.5"
-SETPROCTITLE_VERSION="1.3.2"
+SETPROCTITLE_VERSION="1.3.3"
 MARKUPSAFE_VERSION="2.1.3"
-CHARSETNORMALIZER_VERSION="3.2.0"
+CHARSETNORMALIZER_VERSION="3.3.0"
 PYWIN32_VERSION="306"
 
 # pycparser is explicitly installed to work around setuptools auto dependencies.

pythia.conf

@@ -1,11 +1,11 @@
 PYTHON_CONFIGURATION="[email protected]"
 # This is defined as a Bash array of options to be passed to commands.
-BASE_REQUIREMENTS=("chevah-brink==1.0.12" "paver==1.2.4")
+BASE_REQUIREMENTS=("chevah-brink==1.0.13" "paver==1.3.4")
 # Use our production server instead of the GitHub releases set by default.
 BINARY_DIST_URI="https://bin.chevah.com:20443/production"
 # For testing packages, make sure this one is the last uncommented instance:
 #BINARY_DIST_URI="https://bin.chevah.com:20443/testing"
 # Also overwrite the default pypi.org site set by default in pythia.sh.
 PIP_INDEX_URL="https://bin.chevah.com:20443/pypi/simple"
 # This is used by the Python runtime.
-CHEVAH_BUILD_DIR="build-pythia"
+CHEVAH_BUILD_DIR="build-py3"

src/Python-Windows/sha512.sum

@@ -1 +1 @@
-3f93c2a16764b9ea6343315b70c0c6319aac8edaefbf4e21206fb30eff365e8fe37264a9133bebe12e664ea5d8fd232d587a5603a51fd96e1252a2fc01a2e550  python-3.11.4.amd64.zip
+b66791f0caaa1b376504fb0e1dac5ca3b0324e0bcef3546316d2141415d4eb4c1dea7203d13f1311490bb1a688a3440abdbd474c7e07c3c20d1e495d75683c99  python-3.11.6.amd64.zip

src/Python/chevahbs

@@ -26,11 +26,6 @@ chevahbs_patch() {
     echo "# Applying disabled_modules.patch... #"
     execute patch < disabled_modules.patch
 
-    # Fixes https://github.com/python/cpython/issues/107077 for Python 3.11.
-    # Should fail for versions >3.11.4, signaling the need to remove it.
-    echo "# Applying GH-107588 patch to fix test_asyncio failure... #"
-    execute patch -p 1 < GH-107588.patch
-
     if [ "$BUILD_LIBEDIT" = "yes" ]; then
         # Adapted from https://bugs.python.org/issue13501.
         echo "# Applying readline_libedit.patch... #"

src/Python/sha512.sum

@@ -1 +1 @@
-cc9b23638fa69c62fdec6c42781c14f3f46efc74cb6b9387401e1e23fe2fa055ab2e9bef444b140c414f5888f3fc697b7852f4fc27de3898eaa3a6f4f9f637aa  Python-3.11.4.tgz
+ab3e0e00e5bb03810f4edcd6ea4db276c16ad3e3334862bed5e397856c47b5e9a5ef0bc0033d9487098d6b29a2d31a671ada97f6f8d46f968f710c46e4fe5ddd  Python-3.11.6.tgz

src/chevah-python-tests/test_python_binary_dist.py

@@ -351,7 +351,7 @@ def main():
         import cryptography
         # OpenSSL is embedded within the cryptography wheel.
         current_openssl_version = backend.openssl_version_text()
-        expecting_openssl_version = u'OpenSSL 3.1.2 1 Aug 2023'
+        expecting_openssl_version = u'OpenSSL 3.1.3 19 Sep 2023'
         if current_openssl_version != expecting_openssl_version:
             sys.stderr.write('Expecting %s, got %s.\n' % (
                 expecting_openssl_version, current_openssl_version))

src/openssl/sha512.sum

@@ -1 +1 @@
-9f41113e5537aee4c3f92711ff85fa12da080363fef0c8b8b34e5b3fc608473c6e4cadd9d8c78f2fcbe97462e51f26a0bb6781656a69ad40226e68af2cf2c762  openssl-3.1.2.tar.gz
+2388eaa8e99acf1e8af4691a645b9b9af456900c74959e82d4cb02808301e11dcfecc86954a922262b16fa4b664b459894d133ab7d35ec82e1633a33194b7b20  openssl-3.1.3.tar.gz

src/sqlite-autoconf/sha512.sum

@@ -1 +1 @@
-f54a8993433b4787dde99b11754f26cb525389446f12c78100b47ed342933385c819621c5384387aec7be68aed92d729acb1e5391d3c786f4f9cf1c767a743bd  sqlite-autoconf-3420000.tar.gz
+aab2cdb2cf073d0ef804c9340c2b55f6bf3923eb2563ff4b1d6ebd61c3927ffc4ba912f0cdf2ebcfea9c6a033344f1a8611b1a052b407771a304cf1c4b5ca590  sqlite-autoconf-3430100.tar.gz