#32957 Python uses a bundled expat

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Marius Bakke <mbakke@fastmail.com>

To: bug-guix@gnu.org

Subject: Python uses a bundled expat

Date: Sat, 06 Oct 2018 16:58:13 +0200

[Message part 1 (text/plain, inline)]

Python 2 and 3 are using a bundled Expat (residing under Modules/).

This has been the cause of security vulnerabilities in the past and
should be changed to use Expat from Guix.

[signature.asc (application/pgp-signature, inline)]

Message #12 received at 32957@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: Marius Bakke <mbakke@fastmail.com>

Cc: 32957@debbugs.gnu.org

Subject: Re: bug#32957: Python uses a bundled expat

Date: Wed, 10 Oct 2018 15:27:14 -0400

[Message part 1 (text/plain, inline)]

On Sat, Oct 06, 2018 at 04:58:13PM +0200, Marius Bakke wrote:
> Python 2 and 3 are using a bundled Expat (residing under Modules/).
> 
> This has been the cause of security vulnerabilities in the past and
> should be changed to use Expat from Guix.

Looks like Debian uses an external Expat to fill the dependency, so it
should be possible:

https://packages.debian.org/stretch/python3.5-minimal

We should look into the difference between the bundled Expat and
upstream Expat.

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 32957-done@debbugs.gnu.org (full text, mbox, reply):

From: Marius Bakke <mbakke@fastmail.com>

To: Leo Famulari <leo@famulari.name>

Cc: 32957-done@debbugs.gnu.org

Subject: Re: bug#32957: Python uses a bundled expat

Date: Sat, 23 Mar 2019 23:34:02 +0100

[Message part 1 (text/plain, inline)]

Leo Famulari <leo@famulari.name> writes:

> On Sat, Oct 06, 2018 at 04:58:13PM +0200, Marius Bakke wrote:
>> Python 2 and 3 are using a bundled Expat (residing under Modules/).
>> 
>> This has been the cause of security vulnerabilities in the past and
>> should be changed to use Expat from Guix.
>
> Looks like Debian uses an external Expat to fill the dependency, so it
> should be possible:
>
> https://packages.debian.org/stretch/python3.5-minimal
>
> We should look into the difference between the bundled Expat and
> upstream Expat.

Looking at the Debian package did help me figure out how to make it use
system Expat.  We needed this patch:
<https://salsa.debian.org/cpython-team/python3/blob/master/debian/patches/setup-modules.diff>.

That patch only works *after* the configure step and requires
regenerating some files (see the rules file around PyExpat), so I took a
simpler approach.

Fixed in d1659c0fb27c4f71c8ddc6a85d3cd9f3a10cca97.

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.