Skip to content

Update SQLite to 3.28 in Windows and macOS installer builds #79541

Closed
Closed
Update SQLite to 3.28 in Windows and macOS installer builds#79541
Labels
3.7 (EOL)end of life3.8 (EOL)end of lifeOS-macOS-windowsbuildThe build process and cross-build

Description

@vstinner
vstinner
opened on Nov 30, 2018
BPO 35360
Nosy @pfmoore, @ronaldoussoren, @tjguk, @ned-deily, @ceronman, @berkerpeksag, @zware, @zooba, @animalize, @Mariatta, @miss-islington
PRs
  • bpo-35360: Update Windows builds to use SQLite 3.28.0 #14179
  • bpo-35360: Update macOS installer to use SQLite 3.28.0 #14180
  • [2.7] bpo-35360: Update Windows builds to use SQLite 3.28.0 #14182
  • [2.7] bpo-35360: Update macOS installer to use SQLite 3.28.0 #14183
  • [3.8] bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180) #14195
  • [3.7] bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180) #14196
  • [3.8] bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179) #14352
  • [3.7] bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179) #14353
  • [2.7] bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179) #14354
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2019-06-24.23:44:30.521>
created_at = <Date 2018-11-30.12:14:30.437>
labels = ['OS-mac', '3.8', 'build', '3.7', 'OS-windows']
title = 'Update SQLite to 3.28 in Windows and macOS installer builds'
updated_at = <Date 2019-09-30.14:52:45.917>
user = 'https://github.com/vstinner'

    bugs.python.org fields:

    activity = <Date 2019-09-30.14:52:45.917>
actor = 'steve.dower'
assignee = 'none'
closed = True
closed_date = <Date 2019-06-24.23:44:30.521>
closer = 'steve.dower'
components = ['Build', 'macOS', 'Windows']
creation = <Date 2018-11-30.12:14:30.437>
creator = 'vstinner'
dependencies = []
files = []
hgrepos = []
issue_num = 35360
keywords = ['patch']
message_count = 25.0
messages = ['330779', '330783', '331947', '332014', '332261', '340978', '343456', '343531', '345708', '345865', '345890', '345901', '345939', '345941', '345970', '345974', '345977', '345979', '346448', '346449', '346453', '346455', '347161', '353441', '353583']
nosy_count = 14.0
nosy_names = ['paul.moore', 'ghaering', 'ronaldoussoren', 'tim.golden', 'ned.deily', 'ceronman', 'berker.peksag', 'zach.ware', 'steve.dower', 'malin', 'Big Stone', 'Mariatta', 'miss-islington', 'Scott Stevens']
pr_nums = ['14179', '14180', '14182', '14183', '14195', '14196', '14352', '14353', '14354']
priority = 'high'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue35360'
versions = ['Python 2.7', 'Python 3.7', 'Python 3.8']

    Activity

    1. vstinner commented on Nov 30, 2018

      @vstinner
      vstinner
      on Nov 30, 2018
      MemberAuthor

      Windows and macOS installers require SQLite, but they require different versions! Windows uses 3.21 or 3.14, but macOS uses 3.22.

      I'm talking about the following line in PCbuild\get_externals.bat:

      set libraries=%libraries% sqlite-3.21.0.0

      • 3.6, 3.7 and master branches:

      SQLite[Windows]: 3.21.0.0
      SQLite[macOS]: 3.22.0

      • 2.7 branch:

      SQLite[Windows]: 3.14.2.0
      SQLite[macOS]: 3.22.0

      Note: I wrote a script to get external dependencies:

      https://github.com/vstinner/misc/blob/master/cpython/external_versions.py

    2. vstinner
      added
      3.8 (EOL)end of life
      3.7 (EOL)end of life
      buildThe build process and cross-build
      OS-windows
      on Nov 30, 2018

    3. vstinner commented on Nov 30, 2018

      @vstinner
      vstinner
      on Nov 30, 2018
      MemberAuthor

      First the sqlite branch should be updated in:
      https://github.com/python/cpython-source-deps

      Then a new tag should be created in this repository.

      I tried to update cpython-source-deps, but "git push" never completed. I will retry next week ;-)

    4. ScottStevens commented on Dec 17, 2018

      @ScottStevens
      ScottStevensmannequin
      on Dec 17, 2018
      Mannequin

      With the discovery of the SQLite "Magellan" bug, could the version be upgraded to 3.26 for all Python versions? As far as I know, the security case is restricted to where the user is allowing aribitrary SQL execution without arbitrary Python execution, but in that case I do believe remote code execution is possible.

      https://blade.tencent.com/magellan/index_en.html

    5. zooba commented on Dec 17, 2018

      @zooba
      zooba
      on Dec 17, 2018
      Member

      SQLite updates and changes for us almost always get stuck on someone being willing to verify that nothing has broken (and stand by their analysis).

      Without an active expert (I just nosied ghaering in case they are around), I'm not confident to make this change in any version prior to 3.8.

    6. ned-deily commented on Dec 20, 2018

      @ned-deily
      ned-deily
      on Dec 20, 2018
      Member

      We should look at doing this for the next set of maintenance updates. This doesn't appear to be critical enough to delay current releases unless someone can show how this exploit could be used in a typical Python application.

    7. ned-deily
      added
      OS-mac
      on Dec 20, 2018
    8. ned-deily
      changed the title [-][Windows] Update SQLite dependency[/-] [+]Update SQLite to 3.26 in Windows and macOS installer builds[/+] on Dec 20, 2018

    9. BigStone commented on Apr 27, 2019

      @BigStone
      BigStonemannequin
      on Apr 27, 2019
      Mannequin

      sqlite-3.28.0 now available, with extended window functio support: EXCLUDE clause, GROUPS frame types, window chaining, and support for "<expr> PRECEDING" and "<expr> FOLLOWING" boundaries in RANGE frames.

    10. BigStone commented on May 25, 2019

      @BigStone
      BigStonemannequin
      on May 25, 2019
      Mannequin

      any hope to have a SQLite refresh in Python-3.8.0b1 for Windows/Mac ?

      It's generally the ideal / less annoying moment to do so.

    11. animalize commented on May 26, 2019

      @animalize
      animalizemannequin
      on May 26, 2019
      Mannequin

      @Mariatta Wijaya, would you update SQLite?

      I want to do it myself, by following your patch in bpo-28791.
      But I find I have to commit SQLite's source code to https://github.com/python/cpython-source-deps, so I think this should be done by a core developer.

    12. BigStone commented on Jun 15, 2019

      @BigStone
      BigStonemannequin
      on Jun 15, 2019
      Mannequin

      any hope for beta2 ?

    13. 4 remaining items

    14. animalize
      changed the title [-]Update SQLite to 3.26 in Windows and macOS installer builds[/-] [+]Update SQLite to 3.28 in Windows and macOS installer builds[/+] on Jun 18, 2019

    15. animalize commented on Jun 18, 2019

      @animalize
      animalizemannequin
      on Jun 18, 2019
      Mannequin

      2.7 branch:

      PR 14182 is for Windows build
      PR 14183 is for Mac OS X build

    16. ned-deily commented on Jun 18, 2019

      @ned-deily
      ned-deily
      on Jun 18, 2019
      Member

      New changeset d8f336f by Ned Deily (animalize) in branch 'master':
      bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180)
      d8f336f

    17. ned-deily commented on Jun 18, 2019

      @ned-deily
      ned-deily
      on Jun 18, 2019
      Member

      New changeset 373dace by Ned Deily (animalize) in branch '2.7':
      [2.7] bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14183)
      373dace

    18. miss-islington commented on Jun 18, 2019

      @miss-islington
      miss-islington
      on Jun 18, 2019
      Contributor

      New changeset a7072ff by Miss Islington (bot) in branch '3.8':
      bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180)
      a7072ff

    19. miss-islington commented on Jun 18, 2019

      @miss-islington
      miss-islington
      on Jun 18, 2019
      Contributor

      New changeset 624c9a2 by Miss Islington (bot) in branch '3.7':
      bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180)
      624c9a2

    20. zooba commented on Jun 24, 2019

      @zooba
      zooba
      on Jun 24, 2019
      Member

      New changeset 7fd2ba3 by Steve Dower (animalize) in branch 'master':
      bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
      7fd2ba3

    21. zooba commented on Jun 24, 2019

      @zooba
      zooba
      on Jun 24, 2019
      Member

      New changeset 0fc14b3 by Steve Dower (animalize) in branch '2.7':
      bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14182)
      0fc14b3

    22. miss-islington commented on Jun 24, 2019

      @miss-islington
      miss-islington
      on Jun 24, 2019
      Contributor

      New changeset dad8f79 by Miss Islington (bot) in branch '3.8':
      bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
      dad8f79

    23. miss-islington commented on Jun 24, 2019

      @miss-islington
      miss-islington
      on Jun 24, 2019
      Contributor

      New changeset 14c179f by Miss Islington (bot) in branch '3.7':
      bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
      14c179f

    24. zooba
      closed this as completedon Jun 24, 2019

    25. ned-deily commented on Jul 2, 2019

      @ned-deily
      ned-deily
      on Jul 2, 2019
      Member

      New changeset c58fc3a by Ned Deily (Miss Islington (bot)) in branch '3.7':
      bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
      c58fc3a

    26. BigStone commented on Sep 28, 2019

      @BigStone
      BigStonemannequin
      on Sep 28, 2019
      Mannequin

      there will be a security fix in sqlite-3.30 around October 10th.

      https://nvd.nist.gov/vuln/detail/CVE-2019-16168#VulnChangeHistorySection

      https://www.sqlite.org/draft/releaselog/3_30_0.html

    27. zooba commented on Sep 30, 2019

      @zooba
      zooba
      on Sep 30, 2019
      Member

      Please file a new issue

    28. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.7 (EOL)end of life3.8 (EOL)end of lifeOS-macOS-windowsbuildThe build process and cross-build

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions