From nobody Tue Jun 9 14:53:46 2026 X-Original-To: python@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gZX3d2vX7z6g6ds; Tue, 09 Jun 2026 14:53:49 +0000 (UTC) (envelope-from joneum@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gZX3d2Cqwz41Sf; Tue, 09 Jun 2026 14:53:49 +0000 (UTC) (envelope-from joneum@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781016829; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZLYKkDcCy6HIHmIK2lq5jkyxzEG5mThjRFlldTAXlcU=; b=SQCrlxkB9NzHaw8gr1e89RM+cJkU8Kmx52j/58Jx3wpdaNQHib6r4QQlahrCmfJRiVqOVS 0i4z/Qp/JTxBNRhGrXvfnNdQCZbUYOD3cVo7MdbSDHaFS5Lt6fD9eVtpEFPBsYJ7ZauJDH pxBvFNN69XCVihycBKsLWbBlMFi0J4yXJwvT7DDNGVmdjI2/rNhHSH4RNyKa5Ac/EykS7A /2/DcFAR36CAnOcAI+LDFKafqD/D8WE1HD+89kUh7915hyQYIAFjIxP1kJmvJ1TjqUtugN WVY5WfFgt9rxHX5pX/jzJZjAW7s7pZTfT6nNl8uj/39Si4dy0gKHh1AswXEQCA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1781016829; a=rsa-sha256; cv=none; b=yEXJgc0TvkiCoUHxxK2CRMDoAG+hH6Qur68xPm7leycaytmR1HlIIJ/lCQMOirbbz312sj 0c++K9/Da4r72/QUfWBNHXPGTkHY2AGJyao/lSM4G4XmlML6vzrVQm/7xMVU/n2YL9erEK jstPQWVHiC5HeZYXZdFr1OO46nQgGgqjfSPBK6fxhp/hM5YH57HviZQPnCdnPei1UCxrWb bPkHUVsXKjq4IgLNPXiDH6hFNUnpu77p1UXyAYgO6uRc+yXLAmbtsxBpR0CPwTHI4gYttd d6CMRCBVT+pjblnSAtk0+Bie/NN+9q9atzsTeEhdeivRYlokeJibtXQqAPaQ/g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1781016829; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZLYKkDcCy6HIHmIK2lq5jkyxzEG5mThjRFlldTAXlcU=; b=yEDp81IdT21WRBYtbYBdGQU3oELTCCZrPAWvllVrvHhxbHL8yAt5k61TVZDdyKj8D2mbLO Ik9H79diyaN574qzoIhA7ppVSEglaDCI7AomSsYp67KWtOBLJZ489Bxe0dWE5QYZM8W7sv z1SBmh4zExR2dh8IzP/oEAbiGAGUxmwfaFBDuwUjWYljQ7oDFEFv6DzNT6PZyA+bvMuXcB NJqaVAjqelLxKeKhzJH/+PnpGF8yS+/JTTfxakV94RS8HLgqokbLM2FfPjv/22ocdzMJA6 Dsqrmtu4zyYSFPJfQ1gidgjo7+ByhxsyNwXm7y8t9bgfv0s1CHxZizHKSYrZnQ== Received: from [192.168.188.189] (p5b24688a.dip0.t-ipconnect.de [91.36.104.138]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: joneum/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id 4gZX3c4gXszMgD; Tue, 09 Jun 2026 14:53:48 +0000 (UTC) (envelope-from joneum@FreeBSD.org) Message-ID: Date: Tue, 9 Jun 2026 16:53:46 +0200 List-Id: FreeBSD-specific Python issues List-Archive: https://lists.freebsd.org/archives/freebsd-python List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-python@freebsd.org Sender: owner-freebsd-python@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Python 3.14/3.15 maintenance on short notice Content-Language: de-DE To: Matthias Andree , python@FreeBSD.org Cc: ports-secteam , Gleb Popov References: <7b4a06c3-1117-4b50-821d-a464f8cd2f35@tu-dortmund.de> From: Jochen Neumeister In-Reply-To: <7b4a06c3-1117-4b50-821d-a464f8cd2f35@tu-dortmund.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Matthias, I am replying solely in my capacity as a member of ports-secteam. I do not intend to comment on the questions raised regarding maintainership, portmgr@ decisions, commit bits, or other governance matters. Those topics are outside the scope of ports-secteam. Regarding CVE-2026-9669, the primary concern from a ports-secteam perspective is that the relevant technical information, patches, upstream references, and testing results are available so that any necessary security fixes can be evaluated and processed in a timely manner. If a tested patch for lang/python314 is available, making it accessible through the project's established processes will help ensure that it can be reviewed and considered without unnecessary delay. Regarding VuXML, I am currently not aware of an existing entry for this issue. If VuXML coverage is required, that can be evaluated as part of the normal security handling process. Regardless of any ongoing discussions elsewhere, I believe the immediate priority should be ensuring that any security-related issues affecting FreeBSD users are addressed appropriately and without unnecessary delay. Where security vulnerabilities are involved, ports-secteam routinely assists with the established security handling process, including vulnerability assessment, VuXML review and maintenance where applicable, and coordination of related security work. Best regards, Jochen (ports-secteam) Am 09.06.26 um 04:23 schrieb Matthias Andree: > [resend, first didn't reach python@ team because I botched the To: address] > > > Greetings, > > mat@ assigned my python ports 3.14 and 3.15 and assigned them to you. > This wasn't authorized, there is no reason other than bullying, I don't > recognize it, isn't in the project's best interest or portmgr@ charter, > so this is on core.14@'s agenda. > > Still the focus is on our ports users, and now CVE-2026-9669 was just > out (bzip2 compressor smashes stack when reused after error). > > I have a fix for the bzip2 stack smasher ready for 3.14 [1] albeit > without reference to some VuXML entry, the pending medium CVE available > in upstream PRs are not cherry-picked into the port - not sure if > upstream will issue an extraordinary 3.14.6 or just pursue usual schedule. > > 3.15 not yet started to fix the CVE stuff, beta2 just landed, but the > upstream pull request is available so we could have it, too. > > > 1. So, until core@ decides on the unhelpful portmgr@ incursions (see > below), how do we co-ordinate in the interim to get fixes to ports users > quickly, which includes MFH 2026Q2? Proposals? > > 2. Who's having the VuXML? > > > Please respond within 24h. > > > Speak soon. > Matthias > > [1] https://github.com/mandree/freebsd-ports/ > commit/5fed4d57a3b786583ad5572f22349998bced1654 > > > > P.S. Still you will have noticed I have been working on making Python > 3.14 and 3.15b1/b2 smooth rides for our ports users, with swift updates, > and arrowd@ already knows that something's cooking with upstream on 3.15 > self-test failures, > see q=is%3Aissue%20author%3Amandree%20FreeBSD%20state%3Aopen> what's on the > burner. Some will trickle down to 3.14, some we should re-test and nudge > there. > > > >