| Message ID | 20261023174401.3617912-2-leon.anavi@konsulko.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-python,1/9] python3-alembic: Upgrade 1.20.0 -> 1.20.1 | expand |
diff --git a/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch b/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch index 0161b09eb5..7573b1f5a6 100644 --- a/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch +++ b/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch @@ -1,4 +1,4 @@ -From 2afdc29c60812d16708041c3c48ebf8674a5d16f Mon Sep 17 00:00:00 2001 +From bfcf66157dab06a8f4f718cc0016e799f6b9e284 Mon Sep 17 00:00:00 2001 From: Leon Anavi <leon.anavi@konsulko.com> Date: Mon, 20 Jul 2026 15:52:32 +0300 Subject: [PATCH] Skip -march guessing for external cross toolchains diff --git a/meta-python/recipes-devtools/python/python3-autobahn_26.10.1.bb b/meta-python/recipes-devtools/python/python3-autobahn_26.10.2.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-autobahn_26.10.1.bb rename to meta-python/recipes-devtools/python/python3-autobahn_26.10.2.bb index 9150e92981..03ea85111f 100644 --- a/meta-python/recipes-devtools/python/python3-autobahn_26.10.1.bb +++ b/meta-python/recipes-devtools/python/python3-autobahn_26.10.2.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=49165a577911c4178e915dc26e2802a3" SRC_URI += "file://0001-Skip-march-guessing-for-external-cross-toolchains.patch" -SRC_URI[sha256sum] = "0acc00895d4d3b06b55e4c945592d426033062c989ca2910749777a855faa27a" +SRC_URI[sha256sum] = "6c69fca89106567060941c5568e67a5369738813d883db4e3d62b76f0a2c497e" CVE_PRODUCT = "autobahn"
Upgrade to release 26.10.2: - Fix reading the TLS peer certificate (TransportDetails.peer_cert) with pyOpenSSL 26.2.0 and later: autobahn.twisted.util.extract_peer_certificate() raised AttributeError: 'X509' object has no attribute 'get_extension' for every certificate with extensions, as pyOpenSSL removed its X.509 extension API (and deprecates the rest of its X509 API). The certificate is now read with cryptography, in the new backend-neutral autobahn.util.peer_certificate_details(), which also never raises on certificate content it cannot parse (it is peer data, read before authentication): extensions, or a subject or issuer, that cannot be read are left empty. The peer_cert dict keeps its keys and formats, except: ⚠ extensions[].value was OpenSSL's text; a subject or issuer alternative name is still given as OpenSSL prints it (DNS:localhost, IP Address:127.0.0.1), other extensions now as cryptography prints them; and signature_algorithm is ed25519 instead of ED25519 for Ed25519 certificates - Fix the TLS peer certificate never being available on Twisted WebSocket and RawSocket connections: it was read when the TCP connection was made, before the TLS handshake, and so was always None. It is now read when the TLS handshake is complete, together with the TLS channel ID. With this, TLS client certificate authentication (Crossbar.io authmethod tls, and dynamic authenticators reading transport.peer_cert) works again - Fix asyncio: fill TransportDetails.peer_cert (it was always None), and treat a TLS server connection without a client certificate as secure, with a TLS channel ID: is_secure was derived from the peer certificate, so WAMP-cryptosign with channel binding failed on asyncio servers - Behaviour change - the TLS channel ID tls-unique on Twisted now follows RFC 5929 (the first TLS Finished message of the handshake, in a full handshake the client's), as Python's ssl module, and so autobahn on asyncio, already did. Twisted used the server's Finished message, so WAMP-cryptosign with channel binding failed between Twisted and asyncio peers over WebSocket, and between Twisted RawSocket peers (whose protocols did not set is_server, so the client side used the wrong message). Twisted peers on autobahn 26.10.1 or older and on 26.10.2 no longer agree on the channel ID over WebSocket: upgrade both sides of connections that use channel binding (#2014) Work around a PyPy bug: PyPy's ssl module (up to at least PyPy 7.3.23) returns the server's TLS Finished message from get_channel_binding("tls-unique") instead of the first (the client's), so autobahn on asyncio on PyPy disagreed with all other peers on the channel ID. The new autobahn.util.tls_unique() uses PyPy's own tls_unique_cb() on PyPy, which returns the right message - TransportDetails.is_server is now set on Twisted RawSocket and asyncio WebSocket connections (it was None) Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> --- ...0001-Skip-march-guessing-for-external-cross-toolchains.patch | 2 +- ...{python3-autobahn_26.10.1.bb => python3-autobahn_26.10.2.bb} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename meta-python/recipes-devtools/python/{python3-autobahn_26.10.1.bb => python3-autobahn_26.10.2.bb} (87%)