diff options
| author | Thiago Kenji Okada <thiagokokada@gmail.com> | 2022-12-18 00:01:57 +0000 |
|---|---|---|
| committer | Thiago Kenji Okada <thiagokokada@gmail.com> | 2022-12-18 12:32:51 +0000 |
| commit | 47f904bad14c906e223ac0e7a5536b9042e5b3e2 (patch) | |
| tree | ecee89d29800845e89704d0e33604cc22c676ba0 | |
| parent | 06db865023568be36737d2dd09bfbdd68c7f6c1c (diff) | |
python27: use ffi/expat as system libraries
Without `--with-system-{ffi,expat}` flags, Python will use its own
embedded libraries that are out-of-date. Thanks to it, they can be a
security issue. So let's use our own libraries instead.
This is already what Python 3.x does, so should be safe.
| -rw-r--r-- | pkgs/development/interpreters/python/cpython/2.7/default.nix | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix index 15626fe28cd7c..4052281b0f0df 100644 --- a/pkgs/development/interpreters/python/cpython/2.7/default.nix +++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix @@ -199,11 +199,10 @@ let "--enable-shared" ] ++ [ "--with-threads" - "--enable-unicode=ucs${toString ucsEncoding}" - ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [ "--with-system-ffi" - ] ++ optionals stdenv.hostPlatform.isCygwin [ "--with-system-expat" + "--enable-unicode=ucs${toString ucsEncoding}" + ] ++ optionals stdenv.hostPlatform.isCygwin [ "ac_cv_func_bind_textdomain_codeset=yes" ] ++ optionals stdenv.isDarwin [ "--disable-toolbox-glue" @@ -238,10 +237,7 @@ let strictDeps = true; buildInputs = optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++ - [ bzip2 openssl zlib ] - ++ optional (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) libffi - ++ optional stdenv.hostPlatform.isCygwin expat - ++ [ db gdbm ncurses sqlite readline ] + [ bzip2 openssl zlib libffi expat db gdbm ncurses sqlite readline ] ++ optionals x11Support [ tcl tk libX11 ] ++ optional (stdenv.isDarwin && configd != null) configd; nativeBuildInputs = |