relenv 0.21.1__py3-none-any.whl → 0.22.0__py3-none-any.whl

relenv/build/linux.py

@@ -1,16 +1,39 @@
 # Copyright 2025 Broadcom.
 # SPDX-License-Identifier: Apache-2
+# mypy: ignore-errors
 """
 The linux build process.
 """
+from __future__ import annotations
+
+import glob
+import io
+import os
 import pathlib
+import shutil
+import tarfile
 import tempfile
-from .common import *
-from ..common import arches, LINUX, Version
+import time
+import urllib.request
+from typing import IO, MutableMapping
+
+from .common import (
+    Dirs,
+    build_openssl,
+    build_openssl_fips,
+    build_sqlite,
+    builds,
+    finalize,
+    get_dependency_version,
+    update_sbom_checksums,
+)
+from ..common import LINUX, Version, arches, runcmd
 
 
 ARCHES = arches[LINUX]
 
+EnvMapping = MutableMapping[str, str]
+
 # Patch for Python's setup.py
 PATCH = """--- ./setup.py
 +++ ./setup.py
@@ -25,7 +48,7 @@ PATCH = """--- ./setup.py
 """
 
 
-def populate_env(env, dirs):
+def populate_env(env: EnvMapping, dirs: Dirs) -> None:
     """
     Make sure we have the correct environment variables set.
 
@@ -68,7 +91,7 @@ def populate_env(env, dirs):
     env["PKG_CONFIG_PATH"] = f"{dirs.prefix}/lib/pkgconfig"
 
 
-def build_bzip2(env, dirs, logfp):
+def build_bzip2(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build bzip2.
 
@@ -112,7 +135,7 @@ def build_bzip2(env, dirs, logfp):
     shutil.copy2("libbz2.so.1.0.8", os.path.join(dirs.prefix, "lib"))
 
 
-def build_libxcrypt(env, dirs, logfp):
+def build_libxcrypt(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build libxcrypt.
 
@@ -139,7 +162,7 @@ def build_libxcrypt(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-def build_gdbm(env, dirs, logfp):
+def build_gdbm(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build gdbm.
 
@@ -166,7 +189,7 @@ def build_gdbm(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-def build_ncurses(env, dirs, logfp):
+def build_ncurses(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build ncurses.
 
@@ -225,7 +248,7 @@ def build_ncurses(env, dirs, logfp):
     )
 
 
-def build_readline(env, dirs, logfp):
+def build_readline(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build readline library.
 
@@ -251,7 +274,7 @@ def build_readline(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-def build_libffi(env, dirs, logfp):
+def build_libffi(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build libffi.
 
@@ -282,7 +305,7 @@ def build_libffi(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-def build_zlib(env, dirs, logfp):
+def build_zlib(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build zlib.
 
@@ -309,7 +332,7 @@ def build_zlib(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-def build_krb(env, dirs, logfp):
+def build_krb(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Build kerberos.
 
@@ -342,7 +365,66 @@ def build_krb(env, dirs, logfp):
     runcmd(["make", "install"], env=env, stderr=logfp, stdout=logfp)
 
 
-def build_python(env, dirs, logfp):
+def update_expat(dirs: Dirs, env: EnvMapping) -> None:
+    """
+    Update the bundled expat library to the latest version.
+
+    Python ships with an older bundled expat. This function updates it
+    to the latest version for security and bug fixes.
+    """
+    # Get version from JSON
+    expat_info = get_dependency_version("expat", "linux")
+    if not expat_info:
+        # No update needed, use bundled version
+        return
+
+    version = expat_info["version"]
+    version_tag = version.replace(".", "_")
+    url = f"https://github.com/libexpat/libexpat/releases/download/R_{version_tag}/expat-{version}.tar.xz"
+
+    expat_dir = pathlib.Path(dirs.source) / "Modules" / "expat"
+    if not expat_dir.exists():
+        # No expat directory, skip
+        return
+
+    # Download expat tarball
+    tmpbuild = pathlib.Path(dirs.tmpbuild)
+    tarball_path = tmpbuild / f"expat-{version}.tar.xz"
+    urllib.request.urlretrieve(url, str(tarball_path))
+
+    # Extract tarball
+    with tarfile.open(tarball_path) as tar:
+        tar.extractall(path=str(tmpbuild))
+
+    # Copy source files to Modules/expat/
+    expat_source_dir = tmpbuild / f"expat-{version}" / "lib"
+    updated_files = []
+    for source_file in ["*.h", "*.c"]:
+        for file_path in glob.glob(str(expat_source_dir / source_file)):
+            target_file = expat_dir / pathlib.Path(file_path).name
+            # Remove old file if it exists
+            if target_file.exists():
+                target_file.unlink()
+            shutil.copy2(file_path, str(expat_dir))
+            updated_files.append(target_file)
+
+    # Touch all updated files to ensure make rebuilds them
+    # (The tarball may contain files with newer timestamps)
+    now = time.time()
+    for target_file in updated_files:
+        os.utime(target_file, (now, now))
+
+    # Update SBOM with correct checksums for updated expat files
+    files_to_update = {}
+    for target_file in updated_files:
+        # SBOM uses relative paths from Python source root
+        relative_path = f"Modules/expat/{target_file.name}"
+        files_to_update[relative_path] = target_file
+
+    update_sbom_checksums(dirs.source, files_to_update)
+
+
+def build_python(env: EnvMapping, dirs: Dirs, logfp: IO[str]) -> None:
     """
     Run the commands to build Python.
 
@@ -353,6 +435,9 @@ def build_python(env, dirs, logfp):
     :param logfp: A handle for the log file
     :type logfp: file
     """
+    # Update bundled expat to latest version
+    update_expat(dirs, env)
+
     ldflagopt = f"-Wl,--rpath={dirs.prefix}/lib"
     if ldflagopt not in env["LDFLAGS"]:
         env["LDFLAGS"] = f"{ldflagopt} {env['LDFLAGS']}"
@@ -379,11 +464,11 @@ def build_python(env, dirs, logfp):
     )
 
     if pathlib.Path("setup.py").exists():
-        with tempfile.NamedTemporaryFile(mode="w", suffix="_patch") as patch_file:
-            patch_file.write(PATCH)
-            patch_file.flush()
+        with tempfile.NamedTemporaryFile(mode="w", suffix="_patch") as p_file:
+            p_file.write(PATCH)
+            p_file.flush()
             runcmd(
-                ["patch", "-p0", "-i", patch_file.name],
+                ["patch", "-p0", "-i", p_file.name],
                 env=env,
                 stderr=logfp,
                 stdout=logfp,
@@ -477,167 +562,302 @@ def build_python(env, dirs, logfp):
 
 build = builds.add("linux", populate_env=populate_env)
 
+# Get dependency versions from JSON (with fallback to hardcoded values)
+openssl_info = get_dependency_version("openssl", "linux")
+if openssl_info:
+    openssl_version = openssl_info["version"]
+    openssl_url = openssl_info["url"]
+    openssl_checksum = openssl_info["sha256"]
+else:
+    # Fallback to hardcoded values
+    openssl_version = "3.5.4"
+    openssl_url = "https://github.com/openssl/openssl/releases/download/openssl-{version}/openssl-{version}.tar.gz"
+    openssl_checksum = "b75daac8e10f189abe28a076ba5905d363e4801f"
+
 build.add(
     "openssl",
     build_func=build_openssl,
     download={
-        "url": "https://github.com/openssl/openssl/releases/download/openssl-{version}/openssl-{version}.tar.gz",
-        "version": "3.5.4",
-        "checksum": "b75daac8e10f189abe28a076ba5905d363e4801f",
-        "checkfunc": tarball_version,
-        "checkurl": "https://www.openssl.org/source/",
+        "url": openssl_url,
+        "version": openssl_version,
+        "checksum": openssl_checksum,
     },
 )
 
+# If openssl-fips-module runs before openssl we get an error installing openssl
+# becuase <prefix>/lib/ossl-modules exists.
 build.add(
     "openssl-fips-module",
-    build_func=build_openssl_fips,
     wait_on=["openssl"],
+    build_func=build_openssl_fips,
     download={
         "url": "https://www.openssl.org/source/openssl-{version}.tar.gz",
         "version": "3.1.2",
         "checksum": "206036c21264e53f0196f715d81d905742e6245b",
-        "checkfunc": tarball_version,
-        "checkurl": "https://www.openssl.org/source/",
     },
 )
 
 
+# Get libxcrypt version from JSON
+libxcrypt_info = get_dependency_version("libxcrypt", "linux")
+if libxcrypt_info:
+    libxcrypt_version = libxcrypt_info["version"]
+    libxcrypt_url = libxcrypt_info["url"]
+    libxcrypt_checksum = libxcrypt_info["sha256"]
+else:
+    libxcrypt_version = "4.4.38"
+    libxcrypt_url = "https://github.com/besser82/libxcrypt/releases/download/v{version}/libxcrypt-{version}.tar.xz"
+    libxcrypt_checksum = "9aa2fa261be6144af492e9b6bfd03bfaa47f7159"
+
 build.add(
     "libxcrypt",
     download={
-        "url": "https://github.com/besser82/libxcrypt/releases/download/v{version}/libxcrypt-{version}.tar.xz",
-        "version": "4.4.38",
-        "checksum": "9aa2fa261be6144af492e9b6bfd03bfaa47f7159",
-        "checkfunc": github_version,
-        "checkurl": "https://github.com/besser82/libxcrypt/releases/",
+        "url": libxcrypt_url,
+        "version": libxcrypt_version,
+        "checksum": libxcrypt_checksum,
     },
 )
 
+# Get XZ version from JSON
+xz_info = get_dependency_version("xz", "linux")
+if xz_info:
+    xz_version = xz_info["version"]
+    xz_url = xz_info["url"]
+    xz_checksum = xz_info["sha256"]
+else:
+    # Fallback to hardcoded values
+    xz_version = "5.8.1"
+    xz_url = "http://tukaani.org/xz/xz-{version}.tar.gz"
+    xz_checksum = "ed4d5589c4cfe84e1697bd02a9954b76af336931"
+
 build.add(
     "XZ",
     download={
-        "url": "http://tukaani.org/xz/xz-{version}.tar.gz",
-        "version": "5.8.1",
-        "checksum": "ed4d5589c4cfe84e1697bd02a9954b76af336931",
-        "checkfunc": tarball_version,
+        "url": xz_url,
+        "version": xz_version,
+        "checksum": xz_checksum,
     },
 )
 
+# Get SQLite version from JSON
+sqlite_info = get_dependency_version("sqlite", "linux")
+if sqlite_info:
+    sqlite_url = sqlite_info["url"]
+    sqlite_checksum = sqlite_info["sha256"]
+    # SQLite uses a special 7-digit version number
+    sqlite_version_num = sqlite_info.get("sqliteversion", "3500400")
+else:
+    # Fallback to hardcoded values
+    sqlite_version_num = "3500400"
+    sqlite_url = "https://sqlite.org/2025/sqlite-autoconf-{version}.tar.gz"
+    sqlite_checksum = "145048005c777796dd8494aa1cfed304e8c34283"
+
 build.add(
     name="SQLite",
     build_func=build_sqlite,
     download={
-        "url": "https://sqlite.org/2025/sqlite-autoconf-{version}.tar.gz",
-        "version": "3500400",
-        "checksum": "145048005c777796dd8494aa1cfed304e8c34283",
-        "checkfunc": sqlite_version,
-        "checkurl": "https://sqlite.org/",
+        "url": sqlite_url,
+        "version": sqlite_version_num,
+        "checksum": sqlite_checksum,
     },
 )
 
+# Get bzip2 version from JSON
+bzip2_info = get_dependency_version("bzip2", "linux")
+if bzip2_info:
+    bzip2_version = bzip2_info["version"]
+    bzip2_url = bzip2_info["url"]
+    bzip2_checksum = bzip2_info["sha256"]
+else:
+    bzip2_version = "1.0.8"
+    bzip2_url = "https://sourceware.org/pub/bzip2/bzip2-{version}.tar.gz"
+    bzip2_checksum = "bf7badf7e248e0ecf465d33c2f5aeec774209227"
+
 build.add(
     name="bzip2",
     build_func=build_bzip2,
     download={
-        "url": "https://sourceware.org/pub/bzip2/bzip2-{version}.tar.gz",
-        "version": "1.0.8",
-        "checksum": "bf7badf7e248e0ecf465d33c2f5aeec774209227",
-        "checkfunc": tarball_version,
+        "url": bzip2_url,
+        "version": bzip2_version,
+        "checksum": bzip2_checksum,
     },
 )
 
+# Get gdbm version from JSON
+gdbm_info = get_dependency_version("gdbm", "linux")
+if gdbm_info:
+    gdbm_version = gdbm_info["version"]
+    gdbm_url = gdbm_info["url"]
+    gdbm_checksum = gdbm_info["sha256"]
+else:
+    gdbm_version = "1.26"
+    gdbm_url = "https://mirrors.ocf.berkeley.edu/gnu/gdbm/gdbm-{version}.tar.gz"
+    gdbm_checksum = "6cee3657de948e691e8df26509157be950cef4d4"
+
 build.add(
     name="gdbm",
     build_func=build_gdbm,
     download={
-        "url": "https://mirrors.ocf.berkeley.edu/gnu/gdbm/gdbm-{version}.tar.gz",
-        "version": "1.26",
-        "checksum": "6cee3657de948e691e8df26509157be950cef4d4",
-        "checkfunc": tarball_version,
+        "url": gdbm_url,
+        "version": gdbm_version,
+        "checksum": gdbm_checksum,
     },
 )
 
+# Get ncurses version from JSON
+ncurses_info = get_dependency_version("ncurses", "linux")
+if ncurses_info:
+    ncurses_version = ncurses_info["version"]
+    ncurses_url = ncurses_info["url"]
+    ncurses_checksum = ncurses_info["sha256"]
+else:
+    ncurses_version = "6.5"
+    ncurses_url = (
+        "https://mirrors.ocf.berkeley.edu/gnu/ncurses/ncurses-{version}.tar.gz"
+    )
+    ncurses_checksum = "cde3024ac3f9ef21eaed6f001476ea8fffcaa381"
+
 build.add(
     name="ncurses",
     build_func=build_ncurses,
     download={
-        "url": "https://mirrors.ocf.berkeley.edu/gnu/ncurses/ncurses-{version}.tar.gz",
-        "version": "6.5",
-        "checksum": "cde3024ac3f9ef21eaed6f001476ea8fffcaa381",
-        "checkfunc": tarball_version,
+        "url": ncurses_url,
+        "version": ncurses_version,
+        "checksum": ncurses_checksum,
     },
 )
 
+# Get libffi version from JSON
+libffi_info = get_dependency_version("libffi", "linux")
+if libffi_info:
+    libffi_version = libffi_info["version"]
+    libffi_url = libffi_info["url"]
+    libffi_checksum = libffi_info["sha256"]
+else:
+    libffi_version = "3.5.2"
+    libffi_url = "https://github.com/libffi/libffi/releases/download/v{version}/libffi-{version}.tar.gz"
+    libffi_checksum = "2bd35b135b0eeb5c631e02422c9dbe786ddb626a"
+
 build.add(
     "libffi",
     build_libffi,
     download={
-        "url": "https://github.com/libffi/libffi/releases/download/v{version}/libffi-{version}.tar.gz",
-        "version": "3.5.2",
-        "checksum": "2bd35b135b0eeb5c631e02422c9dbe786ddb626a",
-        "checkfunc": github_version,
-        "checkurl": "https://github.com/libffi/libffi/releases/",
+        "url": libffi_url,
+        "version": libffi_version,
+        "checksum": libffi_checksum,
     },
 )
 
+# Get zlib version from JSON
+zlib_info = get_dependency_version("zlib", "linux")
+if zlib_info:
+    zlib_version = zlib_info["version"]
+    zlib_url = zlib_info["url"]
+    zlib_checksum = zlib_info["sha256"]
+else:
+    zlib_version = "1.3.1"
+    zlib_url = "https://zlib.net/fossils/zlib-{version}.tar.gz"
+    zlib_checksum = "f535367b1a11e2f9ac3bec723fb007fbc0d189e5"
+
 build.add(
     "zlib",
     build_zlib,
     download={
-        "url": "https://zlib.net/fossils/zlib-{version}.tar.gz",
-        "version": "1.3.1",
-        "checksum": "f535367b1a11e2f9ac3bec723fb007fbc0d189e5",
-        "checkfunc": tarball_version,
+        "url": zlib_url,
+        "version": zlib_version,
+        "checksum": zlib_checksum,
     },
 )
 
+# Get uuid version from JSON
+uuid_info = get_dependency_version("uuid", "linux")
+if uuid_info:
+    uuid_ver = uuid_info["version"]
+    uuid_url = uuid_info["url"]
+    uuid_checksum = uuid_info["sha256"]
+else:
+    uuid_ver = "1.0.3"
+    uuid_url = "https://sourceforge.net/projects/libuuid/files/libuuid-{version}.tar.gz"
+    uuid_checksum = "46eaedb875ae6e63677b51ec583656199241d597"
+
 build.add(
     "uuid",
     download={
-        "url": "https://sourceforge.net/projects/libuuid/files/libuuid-{version}.tar.gz",
-        "version": "1.0.3",
-        "checksum": "46eaedb875ae6e63677b51ec583656199241d597",
-        "checkfunc": uuid_version,
+        "url": uuid_url,
+        "version": uuid_ver,
+        "checksum": uuid_checksum,
     },
 )
 
+# Get krb5 version from JSON
+krb5_info = get_dependency_version("krb5", "linux")
+if krb5_info:
+    krb5_version = krb5_info["version"]
+    krb5_url = krb5_info["url"]
+    krb5_checksum = krb5_info["sha256"]
+else:
+    krb5_version = "1.22"
+    krb5_url = "https://kerberos.org/dist/krb5/{version}/krb5-{version}.tar.gz"
+    krb5_checksum = "3ad930ab036a8dc3678356fbb9de9246567e7984"
+
 build.add(
     "krb5",
     build_func=build_krb,
     wait_on=["openssl"],
     download={
-        "url": "https://kerberos.org/dist/krb5/{version}/krb5-{version}.tar.gz",
-        "version": "1.22",
-        "checksum": "3ad930ab036a8dc3678356fbb9de9246567e7984",
-        "checkfunc": krb_version,
-        "checkurl": "https://kerberos.org/dist/krb5/",
+        "url": krb5_url,
+        "version": krb5_version,
+        "checksum": krb5_checksum,
     },
 )
 
+# Get readline version from JSON
+readline_info = get_dependency_version("readline", "linux")
+if readline_info:
+    readline_version = readline_info["version"]
+    readline_url = readline_info["url"]
+    readline_checksum = readline_info["sha256"]
+else:
+    readline_version = "8.3"
+    readline_url = (
+        "https://mirrors.ocf.berkeley.edu/gnu/readline/readline-{version}.tar.gz"
+    )
+    readline_checksum = "2c05ae9350b695f69d70b47f17f092611de2081f"
+
 build.add(
     "readline",
     build_func=build_readline,
     wait_on=["ncurses"],
     download={
-        "url": "https://mirrors.ocf.berkeley.edu/gnu/readline/readline-{version}.tar.gz",
-        "version": "8.3",
-        "checksum": "2c05ae9350b695f69d70b47f17f092611de2081f",
-        "checkfunc": tarball_version,
+        "url": readline_url,
+        "version": readline_version,
+        "checksum": readline_checksum,
     },
 )
 
+# Get tirpc version from JSON
+tirpc_info = get_dependency_version("tirpc", "linux")
+if tirpc_info:
+    tirpc_version = tirpc_info["version"]
+    tirpc_url = tirpc_info["url"]
+    tirpc_checksum = tirpc_info["sha256"]
+else:
+    tirpc_version = "1.3.4"
+    tirpc_url = (
+        "https://sourceforge.net/projects/libtirpc/files/libtirpc-{version}.tar.bz2"
+    )
+    tirpc_checksum = "63c800f81f823254d2706637bab551dec176b99b"
+
 build.add(
     "tirpc",
     wait_on=[
         "krb5",
     ],
     download={
-        "url": "https://sourceforge.net/projects/libtirpc/files/libtirpc-{version}.tar.bz2",
+        "url": tirpc_url,
         # "url": "https://downloads.sourceforge.net/projects/libtirpc/files/libtirpc-{version}.tar.bz2",
-        "version": "1.3.4",
-        "checksum": "63c800f81f823254d2706637bab551dec176b99b",
-        "checkfunc": tarball_version,
+        "version": tirpc_version,
+        "checksum": tirpc_checksum,
     },
 )
 
@@ -663,8 +883,6 @@ build.add(
         "url": "https://www.python.org/ftp/python/{version}/Python-{version}.tar.xz",
         "version": build.version,
         "checksum": "d31d548cd2c5ca2ae713bebe346ba15e8406633a",
-        "checkfunc": python_version,
-        "checkurl": "https://www.python.org/ftp/python/",
     },
 )