Build: update Python, OpenSSL, libtiff, libxml2 to new versions for security #109133

Brecht Van Lommel · 2023-06-19T18:58:00+02:00

Brecht Van Lommel commented

2023-06-19 18:58:00 +02:00

Ref #104895

Brecht Van Lommel added 1 commit 2023-06-19 18:58:11 +02:00

d8ff55892c Build: update Python, OpenSSL, libtiff, libxml2 to new versions for security

Brecht Van Lommel changed title from ~~Build: update Python, OpenSSL, libtiff, libxml2 to new versions for security~~ to Build: update Python, OpenSSL, libtiff, libxml2 to new versions for security

2023-06-19 18:58:22 +02:00

brecht changed target branch from main to blender-v3.6-release

2023-06-19 18:58:23 +02:00

Brecht Van Lommel added 1 commit 2023-06-20 13:58:35 +02:00

af4d317c66 Workaround build error in TIFF tests

Brecht Van Lommel requested review from Campbell Barton 2023-06-20 14:19:51 +02:00

Brecht Van Lommel requested review from Ray molenkamp 2023-06-20 14:20:01 +02:00

Brecht Van Lommel referenced this pull request

2023-06-20 14:34:22 +02:00

Library changes for Blender 3.6 #104895

Ray molenkamp commented

2023-06-20 18:33:33 +02:00

It'll require some messing about but looks like i can make openssl3/python3.10 work on windows, given i have no idea how to update someone-else's patch just land this as is, i'll fix it afterwards.

While browsing the python tracker i did bump into this one highlighting some debug issues on darwin-aarch64

https://github.com/python/cpython/issues/99079#issuecomment-1546511824

unsure if that's a problem for us or not, but something to be aware of nonetheless i suppose.

It'll require some messing about but looks like i can make openssl3/python3.10 work on windows, given i have no idea how to update someone-else's patch just land this as is, i'll fix it afterwards. While browsing the python tracker i did bump into this one highlighting some debug issues on darwin-aarch64 https://github.com/python/cpython/issues/99079#issuecomment-1546511824 unsure if that's a problem for us or not, but something to be aware of nonetheless i suppose.

Ray molenkamp approved these changes 2023-06-20 18:33:48 +02:00

Brecht Van Lommel commented

2023-06-20 20:03:19 +02:00

It seems Python itself will use 3.0 since that is still going to be supported for a long time. I think we might as well use the same version as Python then, to minimize the chance of other bugs.

Brecht Van Lommel added 1 commit 2023-06-20 20:14:56 +02:00

4b0d34611e Change SSL to 3.0.9

Ray molenkamp commented

2023-06-20 21:07:11 +02:00

3.0.9 is ok on windows, no issues. I know we usually don't run tests of deps, but given we're a bit off the beaten path here, may i suggest at least manually running the python ssl tests just to make sure the libs check out?

C:\db\build\S\VS1564R\build\python\src\external_python\PCbuild\amd64>python c:\db\build\S\VS1564R\build\python\src\external_python\Lib\test\test_ssl.py

test_ssl: testing with 'OpenSSL 3.0.9 30 May 2023' (3, 0, 0, 9, 0)
          under Windows ('10', '10.0.19044', 'SP0', 'Multiprocessor Free')

[lots of noise here] 

Ran 169 tests in 56.036s

OK (skipped=13)

it was crucial it was run from the build folder on windows, unsure how picky linux/mac will be there.

`3.0.9` is ok on windows, no issues. I know we usually don't run tests of deps, but given we're a bit off the beaten path here, may i suggest at least manually running the python ssl tests just to make sure the libs check out? ``` C:\db\build\S\VS1564R\build\python\src\external_python\PCbuild\amd64>python c:\db\build\S\VS1564R\build\python\src\external_python\Lib\test\test_ssl.py test_ssl: testing with 'OpenSSL 3.0.9 30 May 2023' (3, 0, 0, 9, 0) under Windows ('10', '10.0.19044', 'SP0', 'Multiprocessor Free') [lots of noise here] Ran 169 tests in 56.036s OK (skipped=13) ``` it was crucial it was run from the build folder on windows, unsure how picky linux/mac will be there.

Campbell Barton commented

2023-06-21 09:32:53 +02:00

Tested the patch with Blender & ensure tests pass.

Attached a patch with some changes.

Update linux_rocky8_setup.sh deps.
Changes for openssl to be found by Python: --with-openssl=${LIBDIR}/ssl wasn't working (was looking in ${LIBDIR}/ssl/lib instead of the new location: ${LIBDIR}/ssl/lib64). Now PKG_CONFIG_PATH is used to ensure it's detected.

Tested the patch with Blender & ensure tests pass. Attached a patch with some changes. - Update `linux_rocky8_setup.sh` deps. - Changes for openssl to be found by Python: `--with-openssl=${LIBDIR}/ssl` wasn't working (was looking in `${LIBDIR}/ssl/lib` instead of the new location: `${LIBDIR}/ssl/lib64`). Now `PKG_CONFIG_PATH` is used to ensure it's detected.

patch_109133_update_for_linux.diff

4.8 KiB

Campbell Barton approved these changes 2023-06-21 09:34:51 +02:00

Campbell Barton left a comment

Accepting, attached patch w/ changes for Linux although these should be tested on macOS too.

Brecht Van Lommel added 1 commit 2023-06-21 15:12:26 +02:00

46b79c8731 Linux fixes from Campbell

Brecht Van Lommel merged commit 97ab330a77 into blender-v3.6-release

2023-06-21 15:14:50 +02:00

Brecht Van Lommel referenced this issue from a commit

2023-06-21 15:14:51 +02:00

Build: update Python, OpenSSL, libtiff, libxml2 to new versions for security