SRU: update Python 2.7 to 2.7.16, Python 3.7 to 3.7.3 and 3.6 to 3.6.8

[Matthias Klose]

SRU: update Python 3.7 to the 3.7.3 release, update Python 3.6 to the 3.6.8 release.

python3-stdlib-extensions also updates the modules to the 3.6.8 release for Python 3.6.

Acceptance Criteria: The package builds, and the test suite doesn't show regressions. The test suite passes in the autopkg tests. The new packages don't cause regressions in a test rebuild of the main component.

http://people.canonical.com/~doko/ftbfs-report/test-rebuild-20190404-cosmic.html
http://people.canonical.com/~doko/ftbfs-report/test-rebuild-20190404-gcc8-cosmic.html

The test rebuilds are finished, and don't show any regressions for the main component.

Regression Potential: Python 3.7 isn't used by default, so we don't have many default users.
Regression Potential: Python 3.6 could see some regressions, although we are trying to minimize the risk by doing the test rebuild.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python2.7 into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python2.7/2.7.16-2~18.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python-stdlib-extensions into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-stdlib-extensions/2.7.16-2~18.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python3.7 into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3.7/3.7.3-2~18.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python3.6 into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3.6/3.6.8-1~18.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python3-stdlib-extensions into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3-stdlib-extensions/3.6.8-1~18.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python3-stdlib-extensions into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python3-stdlib-extensions/3.6.8-1~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Matthias, or anyone else affected,

Accepted python-stdlib-extensions into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-stdlib-extensions/2.7.16-2~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Matthias Klose (doko)]

The disco packages are now successfully built. All autopkg tests except for ironic, murano and murano-agent pass. These are no regressions, related to Python 3.7, and according to Corey:

"If you are ok with it I don't think there's much priority in fixing these.
They appear to be Python3.7 issues that are fixed in disco".

If that's ok, we are good for cosmic-updates. The bionic updates are still stalled by the OpenSSL updates.

[Łukasz Zemczak (sil2100)]

I checked those and hinted them for cosmic. This looks now good to release.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python3.6 - 3.6.8-1~18.10

---------------
python3.6 (3.6.8-1~18.10) cosmic-proposed; urgency=medium

  * PPA upload.
  * SRU: LP: #1822993. Update to the 3.6.8 release.
  * d/p/arm-alignment.diff: Don't allow unaligned memory accesses in the
    _sha3 extension (Dave Jones). LP: #1821869. Issue #36515.

python3.6 (3.6.8-1) unstable; urgency=medium

  * Python 3.6.8 release.
  * Revert the link optimization changes which appeared after the
    release candidate.

python3.6 (3.6.8~rc1-1) unstable; urgency=medium

  * Python 3.6.8 release candidate 1.
  * Update symbols files.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 06:59:38 +0200

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for python3.6 has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python3.7 - 3.7.3-2~18.10

---------------
python3.7 (3.7.3-2~18.10) cosmic; urgency=medium

  * SRU: LP: #1822993. Update to the 3.7.3 release.

python3.7 (3.7.3-2) unstable; urgency=medium

  * d/p/arm-alignment.diff: Don't allow unaligned memory accesses in the
    _sha3 extension (Dave Jones). LP: #1821869. Issue #36515.
  * Tweak the asyncio/ssl test again.

python3.7 (3.7.3-1) unstable; urgency=medium

  * Python 3.7.3 release.
  * Work around issue #35988, reducing the payload size for the asyncio/ssl
    tests.

python3.7 (3.7.3~rc1-1) unstable; urgency=medium

  * Python 3.7.3 release candidate 1.
  * CVE-2019-9636. Fix issue #36216: Add check for characters in netloc that
    normalize to separators. Closes: #924072.
  * Use a build profile for libbluetooth-dev (<!pkg.python3.7.nobluetooth>).

python3.7 (3.7.2-3) unstable; urgency=medium

  * Update to 20190227 from the 3.7 branch.
  * Add more breaks for packages not compatible with Python 3.7:
    - xapers. Closes: #916914.
  * Move the test/ann_module{,2,3} modules into libpython-stdlib.
    Closes: #922285.
  * Limit the import checks for some extension modules to native builds.
    Closes: #921742.

python3.7 (3.7.2-2) unstable; urgency=medium

  * Update to 20190202 from the 3.7 branch.

python3.7 (3.7.2-1) unstable; urgency=medium

  * Python 3.7.2 release.
  * Revert the link optimization changes which appeared after the
    release candidate.
  * Make the build compatible with sphinx 1.6.x.
  * Loosen the pyzo break. Closes: #916548.

python3.7 (3.7.2~rc1-1) unstable; urgency=medium

  * Python 3.7.2 release candidate 1.
  * Add more breaks for packages not compatible with Python 3.7:
    - python3-dns. Closes: #912988.
    - python3-dkim. Closes: #912084.
    - pyzo. Closes: #914332.
  * Update VCS attributes. Closes: #904097.
  * Update symbols files.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 06:56:51 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package python2.7 - 2.7.16-2~18.10

---------------
python2.7 (2.7.16-2~18.10) cosmic-proposed; urgency=medium

  * SRU: LP: #1822993.

python2.7 (2.7.16-2) unstable; urgency=high

  [ Matthias Klose ]
  * CVE-2019-9636. Fix issue #36216: Add check for characters in netloc that
    normalize to separators. Closes: #924073.
  * CVE-2019-9948. Fix issue #35907: Stop urllib exposing the local_file schema
    (file://).

  [ Dimitri John Ledkov ]
  * Bump Build-Depedency and Dependency of libssl-dev and libss1.1 to
    1.1.1 or higher. As TLS1.3 constants leak into ssl module, thus one
    shouldn't mix and match python2.7 & libssl1.1. LP: #1808476

python2.7 (2.7.16-1) unstable; urgency=medium

  * Python 2.7.16 release.
    - Now has a version without a trailing '+'. Closes: #914072.

python2.7 (2.7.16~rc1-1) unstable; urgency=medium

  * Python 2.7.16 release candidate 1.

python2.7 (2.7.15-9) unstable; urgency=medium

  * Update to 20190216 from the 2.7 branch.
    - Backport of TLS 1.3 related fixes from 3.7.
  * Drop the local TLS 1.3 backports.

python2.7 (2.7.15-8) unstable; urgency=medium

  * Fix typo in autopkg test.

python2.7 (2.7.15-7) unstable; urgency=medium

  * Expect the test_site test failing as in 3.7.

python2.7 (2.7.15-6) unstable; urgency=medium

  * Update to 20190201 from the 2.7 branch.
    - CVE-2013-1752: Limit imaplib.IMAP4_SSL.readline().
    - CVE-2018-14647: _elementtree.c doesn't call XML_SetHashSalt().
      Closes: #921039.
    - CVE-2019-5010: DsO vulnerability exists in the X509 certificate parser.
      Closes: #921040.
  * Bump standards version.
  * Update symbols file.

python2.7 (2.7.15-5) unstable; urgency=medium

  * Update to 20181127 from the 2.7 branch.
    - Fix issue #20744, running an external 'zip' in shutil.make_archive().
      CVE-2018-1000802. Closes: #909673.
  * Cherrypick in-progress backports to 2.7 branch from 3.6 branch to fix
    test_ssl assertions with openssl 1.1.1. Resolves autopkgtest failure
    of the 2.7 with openssl 1.1.1 (Dimitri John Ledkov).
  * Don't hard code location of netinet/in.h. Closes: #912422.
  * Update VCS attributes.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 06:50:39 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package python3-stdlib-extensions - 3.6.8-1~18.10

---------------
python3-stdlib-extensions (3.6.8-1~18.10) cosmic-proposed; urgency=medium

  * SRU: LP: #1822993.
  * Update 3.6 extensions and modules to 3.6.8.
  * Update 3.7 extensions and modules to 3.7.3.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 07:04:33 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-stdlib-extensions - 2.7.16-2~18.10

---------------
python-stdlib-extensions (2.7.16-2~18.10) cosmic-proposed; urgency=medium

  * SRU: LP: #1822993.

python-stdlib-extensions (2.7.16-2) unstable; urgency=medium

  * Re-pack the orig tarball without the VCS repo.

python-stdlib-extensions (2.7.16-1) unstable; urgency=medium

  * Python 2.7.16 release.

python-stdlib-extensions (2.7.16~rc1-1) unstable; urgency=medium

  * Python 2.7.16 release candidate.
  * Bump standards version.
  * Fix FTCBFS (Helmut Grohne). Closes: #913417.
    + Multiarchify Build-Depends.
    + Set up PYTHONPATH for cross compilation.
    + cross.patch: Don't import built modules.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 06:54:11 +0200

[Łukasz Zemczak (sil2100)]

Autopkgtests are passing for both of the remaining bionic uploads. There is one ADT regression from sphinx, but the failure is the same as for any other package so it can be ignored. Setting as verified and releasing.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-stdlib-extensions - 2.7.16-2~18.04

---------------
python-stdlib-extensions (2.7.16-2~18.04) bionic-proposed; urgency=medium

  * SRU: LP: #1822993.

python-stdlib-extensions (2.7.16-2) unstable; urgency=medium

  * Re-pack the orig tarball without the VCS repo.

python-stdlib-extensions (2.7.16-1) unstable; urgency=medium

  * Python 2.7.16 release.

python-stdlib-extensions (2.7.16~rc1-1) unstable; urgency=medium

  * Python 2.7.16 release candidate.
  * Bump standards version.
  * Fix FTCBFS (Helmut Grohne). Closes: #913417.
    + Multiarchify Build-Depends.
    + Set up PYTHONPATH for cross compilation.
    + cross.patch: Don't import built modules.

python-stdlib-extensions (2.7.15-1) unstable; urgency=medium

  * Python 2.7.15 release.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 06:54:11 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package python3-stdlib-extensions - 3.6.8-1~18.04

---------------
python3-stdlib-extensions (3.6.8-1~18.04) bionic-proposed; urgency=medium

  * SRU: LP: #1822993.
  * Update 3.6 extensions and modules to 3.6.8.
  * Update 3.7 extensions and modules to 3.7.3.

 -- Matthias Klose <email address hidden> Tue, 09 Apr 2019 07:04:33 +0200