[3.14] gh-151544: Fixes CVE-2026-12003 by removing the fallback to %VPATH%/Modules/Setup.local for discovering sources in getpath.py (GH-151545)#151565
Conversation
…ATH%/Modules/Setup.local for discovering sources in getpath.py (pythonGH-151545) (cherry picked from commit 9e863fa) Co-authored-by: Steve Dower <steve.dower@python.org>
|
I'm looking into the WASI failure. Best hint so far (thanks Brett!) is that the --argv0 option was added to the 3.15 build but isn't in earlier versions. That seems likely, as it would affect the |
| pybuilddir_txt = working_dir / "pybuilddir.txt" | ||
| if not pybuilddir_txt.exists(): | ||
| os.symlink(CHECKOUT / "pybuilddir.txt", pybuilddir_txt) | ||
| log("📝", f"Symlinked {pybuilddir_txt} to normal location") |
There was a problem hiding this comment.
@savannahostrowski @brettcannon Without the ../../Modules/Setup.local fallback (the security risk I'm fixing here) and without the --argv0 argument to fix up the path (not available in this version of wasmtime), this seems to be the best way to help it find pybuilddir.txt. Any thoughts/comments?
2 participants
(cherry picked from commit 9e863fa)
Co-authored-by: Steve Dower steve.dower@python.org