mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-03 04:40:23 +00:00
Code Issues Projects Releases Wiki Activity
40,007 Commits 64 Branches 0 Tags
459f241b3991ddc9632cf92cde57988ac85abbcc
Commit Graph
4 Commits
Author SHA1 Message Date
Devansh Patel ae093476ee python3-waitress: correct CVE_PRODUCT mapping 
The current product-only "waitress" mapping emits a wildcard-vendor identity instead of the exact identities assigned to the packaged Pylons source.

Use "pylons:waitress" for the CNA affected-data identity and "agendaless:waitress" for the NVD dictionary CPE and configuration identity. This changes the generated product identity, but sbom-cve-check 1.3.3 with the pinned databases leaves the current CVE report unchanged.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-08-24 12:14:07 -07:00
Gyorgy Sarvari 38eaab2241 python3-waitress: add ptest support 
It takes <10s to execute.

Some (54) tests are not compatible with musl[1] - due to this the tests are on the problem-list.

Sample output snippet:

root@qemux86-64:~# ptest-runner
START: ptest-runner
2026-01-07T09:57
BEGIN: /usr/lib/python3-waitress/ptest
PASS: tests.test_adjustments.TestAdjustments.test_bad_port
PASS: tests.test_adjustments.TestAdjustments.test_badvar
PASS: tests.test_adjustments.TestAdjustments.test_default_listen
[...many lines...]
PASS: tests.test_wasyncore.Test_readwrite.test_socketerror_in_disconnected
PASS: tests.test_wasyncore.Test_readwrite.test_socketerror_not_in_disconnected
PASS: tests.test_wasyncore.Test_write.test_gardenpath
PASS: tests.test_wasyncore.Test_write.test_non_reraised
PASS: tests.test_wasyncore.Test_write.test_reraised

============================================================================
Testsuite summary
\# TOTAL: 783
\# PASS: 775
\# SKIP: 8
\# XFAIL: 0
\# FAIL: 0
\# XPASS: 0
\# ERROR: 0
DURATION: 7
END: /usr/lib/python3-waitress/ptest
2026-01-07T09:57
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2026-01-12 08:53:42 -08:00
Gyorgy Sarvari 16c2efd07b python3-waitress: set CVE_PRODUCT 
The CVEs for this recipes are tracked using the agendaless:waitress CPE,
which doesn't match the default python:waitress CPE, making the cve-checker
miss relevant CVEs.

See CVE db query:
sqlite> select * from products where PRODUCT like 'waitress';
CVE-2019-16785|agendaless|waitress|||1.3.1|<=
CVE-2019-16786|agendaless|waitress|||1.3.1|<
CVE-2019-16789|agendaless|waitress|||1.4.0|<=
CVE-2019-16792|agendaless|waitress|||1.3.1|<=
CVE-2020-5236|agendaless|waitress|1.4.2|=||
CVE-2022-24761|agendaless|waitress|||2.1.1|<
CVE-2022-31015|agendaless|waitress|2.1.0|>=|2.1.2|<
CVE-2024-49768|agendaless|waitress|2.0.0|>=|3.0.1|<
CVE-2024-49769|agendaless|waitress|||3.0.1|<

Set CVE_PRODUCT accordingly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2025-12-31 08:28:56 -08:00
Leon Anavi 72524d02e7 python3-waitress: Upgrade 3.0.0 -> 3.0.2 
Upgrade to version 3.0.2:

- When using Waitress to process trusted proxy headers, Waitress
  will now update the headers to drop any untrusted values, thereby
  making sure that WSGI apps only get trusted and validated values
  that Waitress itself used to update the environ.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
 2024-11-29 07:56:57 -08:00